Analysis
-
max time kernel
154s -
max time network
163s -
platform
windows7_x64 -
resource
win7-20220715-en -
resource tags
arch:x64arch:x86image:win7-20220715-enlocale:en-usos:windows7-x64system -
submitted
31-07-2022 11:41
Behavioral task
behavioral1
Sample
c439c14021fc0aa06d37ea075b6629e4eedee4518a5960f73941bc82291cf784.exe
Resource
win7-20220715-en
General
-
Target
c439c14021fc0aa06d37ea075b6629e4eedee4518a5960f73941bc82291cf784.exe
-
Size
659KB
-
MD5
c98ab7ddf2809a9db363bce22d5468f9
-
SHA1
f3d28dae38bba6b614a63504119f202f08308919
-
SHA256
c439c14021fc0aa06d37ea075b6629e4eedee4518a5960f73941bc82291cf784
-
SHA512
2b8ce86d4de1fe35b12195f42881737506f32cd4abad2be9688d3f5077427f7a477ef35677fe05bc85c70ba4b17faaaf8d6a717b52f26bc86a36d862220bf302
Malware Config
Extracted
darkcomet
ZQW
http://aliq.no-ip.info:1604
http://aliq.no-ip.info:1605
http://aliq.no-ip.info:2147
http://aliq.no-ip.info:4569
aliq.no-ip.info:1604
aliq.no-ip.info:1605
aliq.no-ip.info:2147
aliq.no-ip.info:4569
http://aliq111.no-ip.info:1604
http://aliq111.no-ip.info:1605
http://aliq111.no-ip.info:2147
http://aliq111.no-ip.info:4569
http://aliq555.publicvm.com:1604
http://aliq555.publicvm.com:2147
http://aliq555.publicvm.com:1605
http://aliq555.publicvm.com:4569
aliq555.publicvm.com:1604
aliq555.publicvm.com:1605
aliq555.publicvm.com:2147
aliq555.publicvm.com:4569
DC_MUTEX-BM2VJFH
-
InstallPath
C:\MSDCSC\ZQWZ.exe
-
gencode
N7GilaH4YpEz
-
install
true
-
offline_keylogger
true
-
persistence
true
-
reg_key
ZQWZ
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
Processes:
c439c14021fc0aa06d37ea075b6629e4eedee4518a5960f73941bc82291cf784.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\MSDCSC\\ZQWZ.exe" c439c14021fc0aa06d37ea075b6629e4eedee4518a5960f73941bc82291cf784.exe -
Executes dropped EXE 1 IoCs
Processes:
ZQWZ.exepid process 1788 ZQWZ.exe -
Sets file to hidden 1 TTPs 2 IoCs
Modifies file attributes to stop it showing in Explorer etc.
Processes:
attrib.exeattrib.exepid process 1292 attrib.exe 1256 attrib.exe -
Deletes itself 1 IoCs
Processes:
notepad.exepid process 1440 notepad.exe -
Loads dropped DLL 2 IoCs
Processes:
c439c14021fc0aa06d37ea075b6629e4eedee4518a5960f73941bc82291cf784.exepid process 640 c439c14021fc0aa06d37ea075b6629e4eedee4518a5960f73941bc82291cf784.exe 640 c439c14021fc0aa06d37ea075b6629e4eedee4518a5960f73941bc82291cf784.exe -
Adds Run key to start application 2 TTPs 3 IoCs
Processes:
c439c14021fc0aa06d37ea075b6629e4eedee4518a5960f73941bc82291cf784.exeZQWZ.exeiexplore.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-335065374-4263250628-1829373619-1000\Software\Microsoft\Windows\CurrentVersion\Run\ZQWZ = "C:\\MSDCSC\\ZQWZ.exe" c439c14021fc0aa06d37ea075b6629e4eedee4518a5960f73941bc82291cf784.exe Set value (str) \REGISTRY\USER\S-1-5-21-335065374-4263250628-1829373619-1000\Software\Microsoft\Windows\CurrentVersion\Run\ZQWZ = "C:\\MSDCSC\\ZQWZ.exe" ZQWZ.exe Set value (str) \REGISTRY\USER\S-1-5-21-335065374-4263250628-1829373619-1000\Software\Microsoft\Windows\CurrentVersion\Run\ZQWZ = "C:\\MSDCSC\\ZQWZ.exe" iexplore.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
ZQWZ.exedescription pid process target process PID 1788 set thread context of 1748 1788 ZQWZ.exe iexplore.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
iexplore.exepid process 1748 iexplore.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
c439c14021fc0aa06d37ea075b6629e4eedee4518a5960f73941bc82291cf784.exeZQWZ.exeiexplore.exedescription pid process Token: SeIncreaseQuotaPrivilege 640 c439c14021fc0aa06d37ea075b6629e4eedee4518a5960f73941bc82291cf784.exe Token: SeSecurityPrivilege 640 c439c14021fc0aa06d37ea075b6629e4eedee4518a5960f73941bc82291cf784.exe Token: SeTakeOwnershipPrivilege 640 c439c14021fc0aa06d37ea075b6629e4eedee4518a5960f73941bc82291cf784.exe Token: SeLoadDriverPrivilege 640 c439c14021fc0aa06d37ea075b6629e4eedee4518a5960f73941bc82291cf784.exe Token: SeSystemProfilePrivilege 640 c439c14021fc0aa06d37ea075b6629e4eedee4518a5960f73941bc82291cf784.exe Token: SeSystemtimePrivilege 640 c439c14021fc0aa06d37ea075b6629e4eedee4518a5960f73941bc82291cf784.exe Token: SeProfSingleProcessPrivilege 640 c439c14021fc0aa06d37ea075b6629e4eedee4518a5960f73941bc82291cf784.exe Token: SeIncBasePriorityPrivilege 640 c439c14021fc0aa06d37ea075b6629e4eedee4518a5960f73941bc82291cf784.exe Token: SeCreatePagefilePrivilege 640 c439c14021fc0aa06d37ea075b6629e4eedee4518a5960f73941bc82291cf784.exe Token: SeBackupPrivilege 640 c439c14021fc0aa06d37ea075b6629e4eedee4518a5960f73941bc82291cf784.exe Token: SeRestorePrivilege 640 c439c14021fc0aa06d37ea075b6629e4eedee4518a5960f73941bc82291cf784.exe Token: SeShutdownPrivilege 640 c439c14021fc0aa06d37ea075b6629e4eedee4518a5960f73941bc82291cf784.exe Token: SeDebugPrivilege 640 c439c14021fc0aa06d37ea075b6629e4eedee4518a5960f73941bc82291cf784.exe Token: SeSystemEnvironmentPrivilege 640 c439c14021fc0aa06d37ea075b6629e4eedee4518a5960f73941bc82291cf784.exe Token: SeChangeNotifyPrivilege 640 c439c14021fc0aa06d37ea075b6629e4eedee4518a5960f73941bc82291cf784.exe Token: SeRemoteShutdownPrivilege 640 c439c14021fc0aa06d37ea075b6629e4eedee4518a5960f73941bc82291cf784.exe Token: SeUndockPrivilege 640 c439c14021fc0aa06d37ea075b6629e4eedee4518a5960f73941bc82291cf784.exe Token: SeManageVolumePrivilege 640 c439c14021fc0aa06d37ea075b6629e4eedee4518a5960f73941bc82291cf784.exe Token: SeImpersonatePrivilege 640 c439c14021fc0aa06d37ea075b6629e4eedee4518a5960f73941bc82291cf784.exe Token: SeCreateGlobalPrivilege 640 c439c14021fc0aa06d37ea075b6629e4eedee4518a5960f73941bc82291cf784.exe Token: 33 640 c439c14021fc0aa06d37ea075b6629e4eedee4518a5960f73941bc82291cf784.exe Token: 34 640 c439c14021fc0aa06d37ea075b6629e4eedee4518a5960f73941bc82291cf784.exe Token: 35 640 c439c14021fc0aa06d37ea075b6629e4eedee4518a5960f73941bc82291cf784.exe Token: SeIncreaseQuotaPrivilege 1788 ZQWZ.exe Token: SeSecurityPrivilege 1788 ZQWZ.exe Token: SeTakeOwnershipPrivilege 1788 ZQWZ.exe Token: SeLoadDriverPrivilege 1788 ZQWZ.exe Token: SeSystemProfilePrivilege 1788 ZQWZ.exe Token: SeSystemtimePrivilege 1788 ZQWZ.exe Token: SeProfSingleProcessPrivilege 1788 ZQWZ.exe Token: SeIncBasePriorityPrivilege 1788 ZQWZ.exe Token: SeCreatePagefilePrivilege 1788 ZQWZ.exe Token: SeBackupPrivilege 1788 ZQWZ.exe Token: SeRestorePrivilege 1788 ZQWZ.exe Token: SeShutdownPrivilege 1788 ZQWZ.exe Token: SeDebugPrivilege 1788 ZQWZ.exe Token: SeSystemEnvironmentPrivilege 1788 ZQWZ.exe Token: SeChangeNotifyPrivilege 1788 ZQWZ.exe Token: SeRemoteShutdownPrivilege 1788 ZQWZ.exe Token: SeUndockPrivilege 1788 ZQWZ.exe Token: SeManageVolumePrivilege 1788 ZQWZ.exe Token: SeImpersonatePrivilege 1788 ZQWZ.exe Token: SeCreateGlobalPrivilege 1788 ZQWZ.exe Token: 33 1788 ZQWZ.exe Token: 34 1788 ZQWZ.exe Token: 35 1788 ZQWZ.exe Token: SeIncreaseQuotaPrivilege 1748 iexplore.exe Token: SeSecurityPrivilege 1748 iexplore.exe Token: SeTakeOwnershipPrivilege 1748 iexplore.exe Token: SeLoadDriverPrivilege 1748 iexplore.exe Token: SeSystemProfilePrivilege 1748 iexplore.exe Token: SeSystemtimePrivilege 1748 iexplore.exe Token: SeProfSingleProcessPrivilege 1748 iexplore.exe Token: SeIncBasePriorityPrivilege 1748 iexplore.exe Token: SeCreatePagefilePrivilege 1748 iexplore.exe Token: SeBackupPrivilege 1748 iexplore.exe Token: SeRestorePrivilege 1748 iexplore.exe Token: SeShutdownPrivilege 1748 iexplore.exe Token: SeDebugPrivilege 1748 iexplore.exe Token: SeSystemEnvironmentPrivilege 1748 iexplore.exe Token: SeChangeNotifyPrivilege 1748 iexplore.exe Token: SeRemoteShutdownPrivilege 1748 iexplore.exe Token: SeUndockPrivilege 1748 iexplore.exe Token: SeManageVolumePrivilege 1748 iexplore.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
iexplore.exepid process 1748 iexplore.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
c439c14021fc0aa06d37ea075b6629e4eedee4518a5960f73941bc82291cf784.execmd.execmd.exeZQWZ.exeiexplore.exedescription pid process target process PID 640 wrote to memory of 1924 640 c439c14021fc0aa06d37ea075b6629e4eedee4518a5960f73941bc82291cf784.exe cmd.exe PID 640 wrote to memory of 1924 640 c439c14021fc0aa06d37ea075b6629e4eedee4518a5960f73941bc82291cf784.exe cmd.exe PID 640 wrote to memory of 1924 640 c439c14021fc0aa06d37ea075b6629e4eedee4518a5960f73941bc82291cf784.exe cmd.exe PID 640 wrote to memory of 1924 640 c439c14021fc0aa06d37ea075b6629e4eedee4518a5960f73941bc82291cf784.exe cmd.exe PID 640 wrote to memory of 972 640 c439c14021fc0aa06d37ea075b6629e4eedee4518a5960f73941bc82291cf784.exe cmd.exe PID 640 wrote to memory of 972 640 c439c14021fc0aa06d37ea075b6629e4eedee4518a5960f73941bc82291cf784.exe cmd.exe PID 640 wrote to memory of 972 640 c439c14021fc0aa06d37ea075b6629e4eedee4518a5960f73941bc82291cf784.exe cmd.exe PID 640 wrote to memory of 972 640 c439c14021fc0aa06d37ea075b6629e4eedee4518a5960f73941bc82291cf784.exe cmd.exe PID 640 wrote to memory of 1440 640 c439c14021fc0aa06d37ea075b6629e4eedee4518a5960f73941bc82291cf784.exe notepad.exe PID 640 wrote to memory of 1440 640 c439c14021fc0aa06d37ea075b6629e4eedee4518a5960f73941bc82291cf784.exe notepad.exe PID 640 wrote to memory of 1440 640 c439c14021fc0aa06d37ea075b6629e4eedee4518a5960f73941bc82291cf784.exe notepad.exe PID 640 wrote to memory of 1440 640 c439c14021fc0aa06d37ea075b6629e4eedee4518a5960f73941bc82291cf784.exe notepad.exe PID 640 wrote to memory of 1440 640 c439c14021fc0aa06d37ea075b6629e4eedee4518a5960f73941bc82291cf784.exe notepad.exe PID 640 wrote to memory of 1440 640 c439c14021fc0aa06d37ea075b6629e4eedee4518a5960f73941bc82291cf784.exe notepad.exe PID 640 wrote to memory of 1440 640 c439c14021fc0aa06d37ea075b6629e4eedee4518a5960f73941bc82291cf784.exe notepad.exe PID 640 wrote to memory of 1440 640 c439c14021fc0aa06d37ea075b6629e4eedee4518a5960f73941bc82291cf784.exe notepad.exe PID 640 wrote to memory of 1440 640 c439c14021fc0aa06d37ea075b6629e4eedee4518a5960f73941bc82291cf784.exe notepad.exe PID 640 wrote to memory of 1440 640 c439c14021fc0aa06d37ea075b6629e4eedee4518a5960f73941bc82291cf784.exe notepad.exe PID 640 wrote to memory of 1440 640 c439c14021fc0aa06d37ea075b6629e4eedee4518a5960f73941bc82291cf784.exe notepad.exe PID 640 wrote to memory of 1440 640 c439c14021fc0aa06d37ea075b6629e4eedee4518a5960f73941bc82291cf784.exe notepad.exe PID 640 wrote to memory of 1440 640 c439c14021fc0aa06d37ea075b6629e4eedee4518a5960f73941bc82291cf784.exe notepad.exe PID 640 wrote to memory of 1440 640 c439c14021fc0aa06d37ea075b6629e4eedee4518a5960f73941bc82291cf784.exe notepad.exe PID 640 wrote to memory of 1440 640 c439c14021fc0aa06d37ea075b6629e4eedee4518a5960f73941bc82291cf784.exe notepad.exe PID 640 wrote to memory of 1440 640 c439c14021fc0aa06d37ea075b6629e4eedee4518a5960f73941bc82291cf784.exe notepad.exe PID 640 wrote to memory of 1440 640 c439c14021fc0aa06d37ea075b6629e4eedee4518a5960f73941bc82291cf784.exe notepad.exe PID 640 wrote to memory of 1440 640 c439c14021fc0aa06d37ea075b6629e4eedee4518a5960f73941bc82291cf784.exe notepad.exe PID 1924 wrote to memory of 1256 1924 cmd.exe attrib.exe PID 1924 wrote to memory of 1256 1924 cmd.exe attrib.exe PID 1924 wrote to memory of 1256 1924 cmd.exe attrib.exe PID 1924 wrote to memory of 1256 1924 cmd.exe attrib.exe PID 972 wrote to memory of 1292 972 cmd.exe attrib.exe PID 972 wrote to memory of 1292 972 cmd.exe attrib.exe PID 972 wrote to memory of 1292 972 cmd.exe attrib.exe PID 972 wrote to memory of 1292 972 cmd.exe attrib.exe PID 640 wrote to memory of 1788 640 c439c14021fc0aa06d37ea075b6629e4eedee4518a5960f73941bc82291cf784.exe ZQWZ.exe PID 640 wrote to memory of 1788 640 c439c14021fc0aa06d37ea075b6629e4eedee4518a5960f73941bc82291cf784.exe ZQWZ.exe PID 640 wrote to memory of 1788 640 c439c14021fc0aa06d37ea075b6629e4eedee4518a5960f73941bc82291cf784.exe ZQWZ.exe PID 640 wrote to memory of 1788 640 c439c14021fc0aa06d37ea075b6629e4eedee4518a5960f73941bc82291cf784.exe ZQWZ.exe PID 1788 wrote to memory of 1748 1788 ZQWZ.exe iexplore.exe PID 1788 wrote to memory of 1748 1788 ZQWZ.exe iexplore.exe PID 1788 wrote to memory of 1748 1788 ZQWZ.exe iexplore.exe PID 1788 wrote to memory of 1748 1788 ZQWZ.exe iexplore.exe PID 1788 wrote to memory of 1748 1788 ZQWZ.exe iexplore.exe PID 1788 wrote to memory of 1748 1788 ZQWZ.exe iexplore.exe PID 1748 wrote to memory of 1724 1748 iexplore.exe notepad.exe PID 1748 wrote to memory of 1724 1748 iexplore.exe notepad.exe PID 1748 wrote to memory of 1724 1748 iexplore.exe notepad.exe PID 1748 wrote to memory of 1724 1748 iexplore.exe notepad.exe PID 1748 wrote to memory of 1724 1748 iexplore.exe notepad.exe PID 1748 wrote to memory of 1724 1748 iexplore.exe notepad.exe PID 1748 wrote to memory of 1724 1748 iexplore.exe notepad.exe PID 1748 wrote to memory of 1724 1748 iexplore.exe notepad.exe PID 1748 wrote to memory of 1724 1748 iexplore.exe notepad.exe PID 1748 wrote to memory of 1724 1748 iexplore.exe notepad.exe PID 1748 wrote to memory of 1724 1748 iexplore.exe notepad.exe PID 1748 wrote to memory of 1724 1748 iexplore.exe notepad.exe PID 1748 wrote to memory of 1724 1748 iexplore.exe notepad.exe PID 1748 wrote to memory of 1724 1748 iexplore.exe notepad.exe PID 1748 wrote to memory of 1724 1748 iexplore.exe notepad.exe PID 1748 wrote to memory of 1724 1748 iexplore.exe notepad.exe PID 1748 wrote to memory of 1724 1748 iexplore.exe notepad.exe PID 1748 wrote to memory of 1724 1748 iexplore.exe notepad.exe PID 1748 wrote to memory of 1724 1748 iexplore.exe notepad.exe PID 1748 wrote to memory of 1724 1748 iexplore.exe notepad.exe -
Views/modifies file attributes 1 TTPs 2 IoCs
Processes:
attrib.exeattrib.exepid process 1256 attrib.exe 1292 attrib.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\c439c14021fc0aa06d37ea075b6629e4eedee4518a5960f73941bc82291cf784.exe"C:\Users\Admin\AppData\Local\Temp\c439c14021fc0aa06d37ea075b6629e4eedee4518a5960f73941bc82291cf784.exe"1⤵
- Modifies WinLogon for persistence
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp\c439c14021fc0aa06d37ea075b6629e4eedee4518a5960f73941bc82291cf784.exe" +s +h2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Users\Admin\AppData\Local\Temp\c439c14021fc0aa06d37ea075b6629e4eedee4518a5960f73941bc82291cf784.exe" +s +h3⤵
- Sets file to hidden
- Views/modifies file attributes
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp" +s +h2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Users\Admin\AppData\Local\Temp" +s +h3⤵
- Sets file to hidden
- Views/modifies file attributes
-
C:\Windows\SysWOW64\notepad.exenotepad2⤵
- Deletes itself
-
C:\MSDCSC\ZQWZ.exe"C:\MSDCSC\ZQWZ.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\iexplore.exe"C:\Program Files (x86)\Internet Explorer\iexplore.exe"3⤵
- Adds Run key to start application
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\notepad.exenotepad4⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\MSDCSC\ZQWZ.exeFilesize
659KB
MD5c98ab7ddf2809a9db363bce22d5468f9
SHA1f3d28dae38bba6b614a63504119f202f08308919
SHA256c439c14021fc0aa06d37ea075b6629e4eedee4518a5960f73941bc82291cf784
SHA5122b8ce86d4de1fe35b12195f42881737506f32cd4abad2be9688d3f5077427f7a477ef35677fe05bc85c70ba4b17faaaf8d6a717b52f26bc86a36d862220bf302
-
C:\MSDCSC\ZQWZ.exeFilesize
659KB
MD5c98ab7ddf2809a9db363bce22d5468f9
SHA1f3d28dae38bba6b614a63504119f202f08308919
SHA256c439c14021fc0aa06d37ea075b6629e4eedee4518a5960f73941bc82291cf784
SHA5122b8ce86d4de1fe35b12195f42881737506f32cd4abad2be9688d3f5077427f7a477ef35677fe05bc85c70ba4b17faaaf8d6a717b52f26bc86a36d862220bf302
-
\MSDCSC\ZQWZ.exeFilesize
659KB
MD5c98ab7ddf2809a9db363bce22d5468f9
SHA1f3d28dae38bba6b614a63504119f202f08308919
SHA256c439c14021fc0aa06d37ea075b6629e4eedee4518a5960f73941bc82291cf784
SHA5122b8ce86d4de1fe35b12195f42881737506f32cd4abad2be9688d3f5077427f7a477ef35677fe05bc85c70ba4b17faaaf8d6a717b52f26bc86a36d862220bf302
-
\MSDCSC\ZQWZ.exeFilesize
659KB
MD5c98ab7ddf2809a9db363bce22d5468f9
SHA1f3d28dae38bba6b614a63504119f202f08308919
SHA256c439c14021fc0aa06d37ea075b6629e4eedee4518a5960f73941bc82291cf784
SHA5122b8ce86d4de1fe35b12195f42881737506f32cd4abad2be9688d3f5077427f7a477ef35677fe05bc85c70ba4b17faaaf8d6a717b52f26bc86a36d862220bf302
-
memory/640-54-0x0000000075CD1000-0x0000000075CD3000-memory.dmpFilesize
8KB
-
memory/972-56-0x0000000000000000-mapping.dmp
-
memory/1256-59-0x0000000000000000-mapping.dmp
-
memory/1292-60-0x0000000000000000-mapping.dmp
-
memory/1440-57-0x0000000000000000-mapping.dmp
-
memory/1724-67-0x0000000000000000-mapping.dmp
-
memory/1788-63-0x0000000000000000-mapping.dmp
-
memory/1924-55-0x0000000000000000-mapping.dmp