Analysis
-
max time kernel
153s -
max time network
157s -
platform
windows10-2004_x64 -
resource
win10v2004-20220721-en -
resource tags
arch:x64arch:x86image:win10v2004-20220721-enlocale:en-usos:windows10-2004-x64system -
submitted
31-07-2022 10:26
Static task
static1
Behavioral task
behavioral1
Sample
5fa2570e3641c4048abd79604c149951ca69077787ce3e86d9a4798efe2fc4ef.exe
Resource
win7-20220715-en
General
-
Target
5fa2570e3641c4048abd79604c149951ca69077787ce3e86d9a4798efe2fc4ef.exe
-
Size
1.1MB
-
MD5
051f250fd72cdbdc953e3c4d836cb514
-
SHA1
44d427d84c48cc3fd86d887150f0bbe732cae430
-
SHA256
5fa2570e3641c4048abd79604c149951ca69077787ce3e86d9a4798efe2fc4ef
-
SHA512
6c6901b0c34a0aac6f2a9022545385bfd235c1337f01758dc7a084da2305f805383334544b18cdba1c2bc7a732cddc4a1cfcf58cb9f2d4549e7a4e6b1ec0134a
Malware Config
Extracted
darkcomet
n19
e44.no-ip.biz:1337
DC_MUTEX-BTMHVCZ
-
gencode
b79tyFR0J2jW
-
install
false
-
offline_keylogger
true
-
persistence
false
Signatures
-
Modifies firewall policy service 2 TTPs 3 IoCs
Processes:
5fa2570e3641c4048abd79604c149951ca69077787ce3e86d9a4798efe2fc4ef.exedescription ioc process Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile 5fa2570e3641c4048abd79604c149951ca69077787ce3e86d9a4798efe2fc4ef.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" 5fa2570e3641c4048abd79604c149951ca69077787ce3e86d9a4798efe2fc4ef.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "0" 5fa2570e3641c4048abd79604c149951ca69077787ce3e86d9a4798efe2fc4ef.exe -
Executes dropped EXE 1 IoCs
Processes:
5fa2570e3641c4048abd79604c149951ca69077787ce3e86d9a4798efe2fc4ef.exepid process 840 5fa2570e3641c4048abd79604c149951ca69077787ce3e86d9a4798efe2fc4ef.exe -
Sets file to hidden 1 TTPs 1 IoCs
Modifies file attributes to stop it showing in Explorer etc.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
5fa2570e3641c4048abd79604c149951ca69077787ce3e86d9a4798efe2fc4ef.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-1101907861-274115917-2188613224-1000\Control Panel\International\Geo\Nation 5fa2570e3641c4048abd79604c149951ca69077787ce3e86d9a4798efe2fc4ef.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
5fa2570e3641c4048abd79604c149951ca69077787ce3e86d9a4798efe2fc4ef.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-1101907861-274115917-2188613224-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsUpdate = "\"C:\\Users\\Admin\\AppData\\Roaming\\V5FC58ZRWSGT43M3\\Gemon\\Product Version\\WindowsUpdate.exe\"" 5fa2570e3641c4048abd79604c149951ca69077787ce3e86d9a4798efe2fc4ef.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
5fa2570e3641c4048abd79604c149951ca69077787ce3e86d9a4798efe2fc4ef.exedescription pid process target process PID 2528 set thread context of 840 2528 5fa2570e3641c4048abd79604c149951ca69077787ce3e86d9a4798efe2fc4ef.exe 5fa2570e3641c4048abd79604c149951ca69077787ce3e86d9a4798efe2fc4ef.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of AdjustPrivilegeToken 24 IoCs
Processes:
5fa2570e3641c4048abd79604c149951ca69077787ce3e86d9a4798efe2fc4ef.exedescription pid process Token: SeIncreaseQuotaPrivilege 840 5fa2570e3641c4048abd79604c149951ca69077787ce3e86d9a4798efe2fc4ef.exe Token: SeSecurityPrivilege 840 5fa2570e3641c4048abd79604c149951ca69077787ce3e86d9a4798efe2fc4ef.exe Token: SeTakeOwnershipPrivilege 840 5fa2570e3641c4048abd79604c149951ca69077787ce3e86d9a4798efe2fc4ef.exe Token: SeLoadDriverPrivilege 840 5fa2570e3641c4048abd79604c149951ca69077787ce3e86d9a4798efe2fc4ef.exe Token: SeSystemProfilePrivilege 840 5fa2570e3641c4048abd79604c149951ca69077787ce3e86d9a4798efe2fc4ef.exe Token: SeSystemtimePrivilege 840 5fa2570e3641c4048abd79604c149951ca69077787ce3e86d9a4798efe2fc4ef.exe Token: SeProfSingleProcessPrivilege 840 5fa2570e3641c4048abd79604c149951ca69077787ce3e86d9a4798efe2fc4ef.exe Token: SeIncBasePriorityPrivilege 840 5fa2570e3641c4048abd79604c149951ca69077787ce3e86d9a4798efe2fc4ef.exe Token: SeCreatePagefilePrivilege 840 5fa2570e3641c4048abd79604c149951ca69077787ce3e86d9a4798efe2fc4ef.exe Token: SeBackupPrivilege 840 5fa2570e3641c4048abd79604c149951ca69077787ce3e86d9a4798efe2fc4ef.exe Token: SeRestorePrivilege 840 5fa2570e3641c4048abd79604c149951ca69077787ce3e86d9a4798efe2fc4ef.exe Token: SeShutdownPrivilege 840 5fa2570e3641c4048abd79604c149951ca69077787ce3e86d9a4798efe2fc4ef.exe Token: SeDebugPrivilege 840 5fa2570e3641c4048abd79604c149951ca69077787ce3e86d9a4798efe2fc4ef.exe Token: SeSystemEnvironmentPrivilege 840 5fa2570e3641c4048abd79604c149951ca69077787ce3e86d9a4798efe2fc4ef.exe Token: SeChangeNotifyPrivilege 840 5fa2570e3641c4048abd79604c149951ca69077787ce3e86d9a4798efe2fc4ef.exe Token: SeRemoteShutdownPrivilege 840 5fa2570e3641c4048abd79604c149951ca69077787ce3e86d9a4798efe2fc4ef.exe Token: SeUndockPrivilege 840 5fa2570e3641c4048abd79604c149951ca69077787ce3e86d9a4798efe2fc4ef.exe Token: SeManageVolumePrivilege 840 5fa2570e3641c4048abd79604c149951ca69077787ce3e86d9a4798efe2fc4ef.exe Token: SeImpersonatePrivilege 840 5fa2570e3641c4048abd79604c149951ca69077787ce3e86d9a4798efe2fc4ef.exe Token: SeCreateGlobalPrivilege 840 5fa2570e3641c4048abd79604c149951ca69077787ce3e86d9a4798efe2fc4ef.exe Token: 33 840 5fa2570e3641c4048abd79604c149951ca69077787ce3e86d9a4798efe2fc4ef.exe Token: 34 840 5fa2570e3641c4048abd79604c149951ca69077787ce3e86d9a4798efe2fc4ef.exe Token: 35 840 5fa2570e3641c4048abd79604c149951ca69077787ce3e86d9a4798efe2fc4ef.exe Token: 36 840 5fa2570e3641c4048abd79604c149951ca69077787ce3e86d9a4798efe2fc4ef.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
5fa2570e3641c4048abd79604c149951ca69077787ce3e86d9a4798efe2fc4ef.exepid process 840 5fa2570e3641c4048abd79604c149951ca69077787ce3e86d9a4798efe2fc4ef.exe -
Suspicious use of WriteProcessMemory 42 IoCs
Processes:
5fa2570e3641c4048abd79604c149951ca69077787ce3e86d9a4798efe2fc4ef.exe5fa2570e3641c4048abd79604c149951ca69077787ce3e86d9a4798efe2fc4ef.execmd.exedescription pid process target process PID 2528 wrote to memory of 840 2528 5fa2570e3641c4048abd79604c149951ca69077787ce3e86d9a4798efe2fc4ef.exe 5fa2570e3641c4048abd79604c149951ca69077787ce3e86d9a4798efe2fc4ef.exe PID 2528 wrote to memory of 840 2528 5fa2570e3641c4048abd79604c149951ca69077787ce3e86d9a4798efe2fc4ef.exe 5fa2570e3641c4048abd79604c149951ca69077787ce3e86d9a4798efe2fc4ef.exe PID 2528 wrote to memory of 840 2528 5fa2570e3641c4048abd79604c149951ca69077787ce3e86d9a4798efe2fc4ef.exe 5fa2570e3641c4048abd79604c149951ca69077787ce3e86d9a4798efe2fc4ef.exe PID 2528 wrote to memory of 840 2528 5fa2570e3641c4048abd79604c149951ca69077787ce3e86d9a4798efe2fc4ef.exe 5fa2570e3641c4048abd79604c149951ca69077787ce3e86d9a4798efe2fc4ef.exe PID 2528 wrote to memory of 840 2528 5fa2570e3641c4048abd79604c149951ca69077787ce3e86d9a4798efe2fc4ef.exe 5fa2570e3641c4048abd79604c149951ca69077787ce3e86d9a4798efe2fc4ef.exe PID 2528 wrote to memory of 840 2528 5fa2570e3641c4048abd79604c149951ca69077787ce3e86d9a4798efe2fc4ef.exe 5fa2570e3641c4048abd79604c149951ca69077787ce3e86d9a4798efe2fc4ef.exe PID 2528 wrote to memory of 840 2528 5fa2570e3641c4048abd79604c149951ca69077787ce3e86d9a4798efe2fc4ef.exe 5fa2570e3641c4048abd79604c149951ca69077787ce3e86d9a4798efe2fc4ef.exe PID 2528 wrote to memory of 840 2528 5fa2570e3641c4048abd79604c149951ca69077787ce3e86d9a4798efe2fc4ef.exe 5fa2570e3641c4048abd79604c149951ca69077787ce3e86d9a4798efe2fc4ef.exe PID 2528 wrote to memory of 840 2528 5fa2570e3641c4048abd79604c149951ca69077787ce3e86d9a4798efe2fc4ef.exe 5fa2570e3641c4048abd79604c149951ca69077787ce3e86d9a4798efe2fc4ef.exe PID 2528 wrote to memory of 840 2528 5fa2570e3641c4048abd79604c149951ca69077787ce3e86d9a4798efe2fc4ef.exe 5fa2570e3641c4048abd79604c149951ca69077787ce3e86d9a4798efe2fc4ef.exe PID 2528 wrote to memory of 840 2528 5fa2570e3641c4048abd79604c149951ca69077787ce3e86d9a4798efe2fc4ef.exe 5fa2570e3641c4048abd79604c149951ca69077787ce3e86d9a4798efe2fc4ef.exe PID 2528 wrote to memory of 840 2528 5fa2570e3641c4048abd79604c149951ca69077787ce3e86d9a4798efe2fc4ef.exe 5fa2570e3641c4048abd79604c149951ca69077787ce3e86d9a4798efe2fc4ef.exe PID 2528 wrote to memory of 840 2528 5fa2570e3641c4048abd79604c149951ca69077787ce3e86d9a4798efe2fc4ef.exe 5fa2570e3641c4048abd79604c149951ca69077787ce3e86d9a4798efe2fc4ef.exe PID 2528 wrote to memory of 840 2528 5fa2570e3641c4048abd79604c149951ca69077787ce3e86d9a4798efe2fc4ef.exe 5fa2570e3641c4048abd79604c149951ca69077787ce3e86d9a4798efe2fc4ef.exe PID 840 wrote to memory of 1404 840 5fa2570e3641c4048abd79604c149951ca69077787ce3e86d9a4798efe2fc4ef.exe cmd.exe PID 840 wrote to memory of 1404 840 5fa2570e3641c4048abd79604c149951ca69077787ce3e86d9a4798efe2fc4ef.exe cmd.exe PID 840 wrote to memory of 1404 840 5fa2570e3641c4048abd79604c149951ca69077787ce3e86d9a4798efe2fc4ef.exe cmd.exe PID 840 wrote to memory of 2264 840 5fa2570e3641c4048abd79604c149951ca69077787ce3e86d9a4798efe2fc4ef.exe notepad.exe PID 840 wrote to memory of 2264 840 5fa2570e3641c4048abd79604c149951ca69077787ce3e86d9a4798efe2fc4ef.exe notepad.exe PID 840 wrote to memory of 2264 840 5fa2570e3641c4048abd79604c149951ca69077787ce3e86d9a4798efe2fc4ef.exe notepad.exe PID 840 wrote to memory of 2264 840 5fa2570e3641c4048abd79604c149951ca69077787ce3e86d9a4798efe2fc4ef.exe notepad.exe PID 840 wrote to memory of 2264 840 5fa2570e3641c4048abd79604c149951ca69077787ce3e86d9a4798efe2fc4ef.exe notepad.exe PID 840 wrote to memory of 2264 840 5fa2570e3641c4048abd79604c149951ca69077787ce3e86d9a4798efe2fc4ef.exe notepad.exe PID 840 wrote to memory of 2264 840 5fa2570e3641c4048abd79604c149951ca69077787ce3e86d9a4798efe2fc4ef.exe notepad.exe PID 840 wrote to memory of 2264 840 5fa2570e3641c4048abd79604c149951ca69077787ce3e86d9a4798efe2fc4ef.exe notepad.exe PID 840 wrote to memory of 2264 840 5fa2570e3641c4048abd79604c149951ca69077787ce3e86d9a4798efe2fc4ef.exe notepad.exe PID 840 wrote to memory of 2264 840 5fa2570e3641c4048abd79604c149951ca69077787ce3e86d9a4798efe2fc4ef.exe notepad.exe PID 840 wrote to memory of 2264 840 5fa2570e3641c4048abd79604c149951ca69077787ce3e86d9a4798efe2fc4ef.exe notepad.exe PID 840 wrote to memory of 2264 840 5fa2570e3641c4048abd79604c149951ca69077787ce3e86d9a4798efe2fc4ef.exe notepad.exe PID 840 wrote to memory of 2264 840 5fa2570e3641c4048abd79604c149951ca69077787ce3e86d9a4798efe2fc4ef.exe notepad.exe PID 840 wrote to memory of 2264 840 5fa2570e3641c4048abd79604c149951ca69077787ce3e86d9a4798efe2fc4ef.exe notepad.exe PID 840 wrote to memory of 2264 840 5fa2570e3641c4048abd79604c149951ca69077787ce3e86d9a4798efe2fc4ef.exe notepad.exe PID 840 wrote to memory of 2264 840 5fa2570e3641c4048abd79604c149951ca69077787ce3e86d9a4798efe2fc4ef.exe notepad.exe PID 840 wrote to memory of 2264 840 5fa2570e3641c4048abd79604c149951ca69077787ce3e86d9a4798efe2fc4ef.exe notepad.exe PID 840 wrote to memory of 2264 840 5fa2570e3641c4048abd79604c149951ca69077787ce3e86d9a4798efe2fc4ef.exe notepad.exe PID 840 wrote to memory of 2264 840 5fa2570e3641c4048abd79604c149951ca69077787ce3e86d9a4798efe2fc4ef.exe notepad.exe PID 840 wrote to memory of 2264 840 5fa2570e3641c4048abd79604c149951ca69077787ce3e86d9a4798efe2fc4ef.exe notepad.exe PID 840 wrote to memory of 2264 840 5fa2570e3641c4048abd79604c149951ca69077787ce3e86d9a4798efe2fc4ef.exe notepad.exe PID 840 wrote to memory of 2264 840 5fa2570e3641c4048abd79604c149951ca69077787ce3e86d9a4798efe2fc4ef.exe notepad.exe PID 1404 wrote to memory of 800 1404 cmd.exe attrib.exe PID 1404 wrote to memory of 800 1404 cmd.exe attrib.exe PID 1404 wrote to memory of 800 1404 cmd.exe attrib.exe -
Views/modifies file attributes 1 TTPs 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\5fa2570e3641c4048abd79604c149951ca69077787ce3e86d9a4798efe2fc4ef.exe"C:\Users\Admin\AppData\Local\Temp\5fa2570e3641c4048abd79604c149951ca69077787ce3e86d9a4798efe2fc4ef.exe"1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\5fa2570e3641c4048abd79604c149951ca69077787ce3e86d9a4798efe2fc4ef.exeC:\Users\Admin\AppData\Local\Temp\5fa2570e3641c4048abd79604c149951ca69077787ce3e86d9a4798efe2fc4ef.exe2⤵
- Modifies firewall policy service
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp\5fa2570e3641c4048abd79604c149951ca69077787ce3e86d9a4798efe2fc4ef.exe" +s +h3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Users\Admin\AppData\Local\Temp\5fa2570e3641c4048abd79604c149951ca69077787ce3e86d9a4798efe2fc4ef.exe" +s +h4⤵
- Sets file to hidden
- Views/modifies file attributes
-
C:\Windows\SysWOW64\notepad.exenotepad3⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\5fa2570e3641c4048abd79604c149951ca69077787ce3e86d9a4798efe2fc4ef.exeFilesize
1.1MB
MD5051f250fd72cdbdc953e3c4d836cb514
SHA144d427d84c48cc3fd86d887150f0bbe732cae430
SHA2565fa2570e3641c4048abd79604c149951ca69077787ce3e86d9a4798efe2fc4ef
SHA5126c6901b0c34a0aac6f2a9022545385bfd235c1337f01758dc7a084da2305f805383334544b18cdba1c2bc7a732cddc4a1cfcf58cb9f2d4549e7a4e6b1ec0134a
-
memory/800-139-0x0000000000000000-mapping.dmp
-
memory/840-131-0x0000000000000000-mapping.dmp
-
memory/840-132-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/840-134-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/840-135-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/1404-137-0x0000000000000000-mapping.dmp
-
memory/2264-138-0x0000000000000000-mapping.dmp
-
memory/2528-130-0x0000000074FC0000-0x0000000075571000-memory.dmpFilesize
5.7MB
-
memory/2528-136-0x0000000074FC0000-0x0000000075571000-memory.dmpFilesize
5.7MB