Analysis
-
max time kernel
158s -
max time network
162s -
platform
windows10-2004_x64 -
resource
win10v2004-20220722-en -
resource tags
arch:x64arch:x86image:win10v2004-20220722-enlocale:en-usos:windows10-2004-x64system -
submitted
31-07-2022 11:41
Behavioral task
behavioral1
Sample
c439c14021fc0aa06d37ea075b6629e4eedee4518a5960f73941bc82291cf784.exe
Resource
win7-20220715-en
General
-
Target
c439c14021fc0aa06d37ea075b6629e4eedee4518a5960f73941bc82291cf784.exe
-
Size
659KB
-
MD5
c98ab7ddf2809a9db363bce22d5468f9
-
SHA1
f3d28dae38bba6b614a63504119f202f08308919
-
SHA256
c439c14021fc0aa06d37ea075b6629e4eedee4518a5960f73941bc82291cf784
-
SHA512
2b8ce86d4de1fe35b12195f42881737506f32cd4abad2be9688d3f5077427f7a477ef35677fe05bc85c70ba4b17faaaf8d6a717b52f26bc86a36d862220bf302
Malware Config
Extracted
darkcomet
ZQW
http://aliq.no-ip.info:1604
http://aliq.no-ip.info:1605
http://aliq.no-ip.info:2147
http://aliq.no-ip.info:4569
aliq.no-ip.info:1604
aliq.no-ip.info:1605
aliq.no-ip.info:2147
aliq.no-ip.info:4569
http://aliq111.no-ip.info:1604
http://aliq111.no-ip.info:1605
http://aliq111.no-ip.info:2147
http://aliq111.no-ip.info:4569
http://aliq555.publicvm.com:1604
http://aliq555.publicvm.com:2147
http://aliq555.publicvm.com:1605
http://aliq555.publicvm.com:4569
aliq555.publicvm.com:1604
aliq555.publicvm.com:1605
aliq555.publicvm.com:2147
aliq555.publicvm.com:4569
DC_MUTEX-BM2VJFH
-
InstallPath
C:\MSDCSC\ZQWZ.exe
-
gencode
N7GilaH4YpEz
-
install
true
-
offline_keylogger
true
-
persistence
true
-
reg_key
ZQWZ
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
Processes:
c439c14021fc0aa06d37ea075b6629e4eedee4518a5960f73941bc82291cf784.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\MSDCSC\\ZQWZ.exe" c439c14021fc0aa06d37ea075b6629e4eedee4518a5960f73941bc82291cf784.exe -
Executes dropped EXE 1 IoCs
Processes:
ZQWZ.exepid process 2808 ZQWZ.exe -
Sets file to hidden 1 TTPs 2 IoCs
Modifies file attributes to stop it showing in Explorer etc.
Processes:
attrib.exeattrib.exepid process 1708 attrib.exe 1660 attrib.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
c439c14021fc0aa06d37ea075b6629e4eedee4518a5960f73941bc82291cf784.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-3463845317-933582289-45817732-1000\Control Panel\International\Geo\Nation c439c14021fc0aa06d37ea075b6629e4eedee4518a5960f73941bc82291cf784.exe -
Adds Run key to start application 2 TTPs 3 IoCs
Processes:
c439c14021fc0aa06d37ea075b6629e4eedee4518a5960f73941bc82291cf784.exeZQWZ.exeiexplore.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3463845317-933582289-45817732-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ZQWZ = "C:\\MSDCSC\\ZQWZ.exe" c439c14021fc0aa06d37ea075b6629e4eedee4518a5960f73941bc82291cf784.exe Set value (str) \REGISTRY\USER\S-1-5-21-3463845317-933582289-45817732-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ZQWZ = "C:\\MSDCSC\\ZQWZ.exe" ZQWZ.exe Set value (str) \REGISTRY\USER\S-1-5-21-3463845317-933582289-45817732-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ZQWZ = "C:\\MSDCSC\\ZQWZ.exe" iexplore.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
ZQWZ.exedescription pid process target process PID 2808 set thread context of 2276 2808 ZQWZ.exe iexplore.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Modifies registry class 1 IoCs
Processes:
c439c14021fc0aa06d37ea075b6629e4eedee4518a5960f73941bc82291cf784.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ c439c14021fc0aa06d37ea075b6629e4eedee4518a5960f73941bc82291cf784.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
iexplore.exepid process 2276 iexplore.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
c439c14021fc0aa06d37ea075b6629e4eedee4518a5960f73941bc82291cf784.exeZQWZ.exeiexplore.exedescription pid process Token: SeIncreaseQuotaPrivilege 2800 c439c14021fc0aa06d37ea075b6629e4eedee4518a5960f73941bc82291cf784.exe Token: SeSecurityPrivilege 2800 c439c14021fc0aa06d37ea075b6629e4eedee4518a5960f73941bc82291cf784.exe Token: SeTakeOwnershipPrivilege 2800 c439c14021fc0aa06d37ea075b6629e4eedee4518a5960f73941bc82291cf784.exe Token: SeLoadDriverPrivilege 2800 c439c14021fc0aa06d37ea075b6629e4eedee4518a5960f73941bc82291cf784.exe Token: SeSystemProfilePrivilege 2800 c439c14021fc0aa06d37ea075b6629e4eedee4518a5960f73941bc82291cf784.exe Token: SeSystemtimePrivilege 2800 c439c14021fc0aa06d37ea075b6629e4eedee4518a5960f73941bc82291cf784.exe Token: SeProfSingleProcessPrivilege 2800 c439c14021fc0aa06d37ea075b6629e4eedee4518a5960f73941bc82291cf784.exe Token: SeIncBasePriorityPrivilege 2800 c439c14021fc0aa06d37ea075b6629e4eedee4518a5960f73941bc82291cf784.exe Token: SeCreatePagefilePrivilege 2800 c439c14021fc0aa06d37ea075b6629e4eedee4518a5960f73941bc82291cf784.exe Token: SeBackupPrivilege 2800 c439c14021fc0aa06d37ea075b6629e4eedee4518a5960f73941bc82291cf784.exe Token: SeRestorePrivilege 2800 c439c14021fc0aa06d37ea075b6629e4eedee4518a5960f73941bc82291cf784.exe Token: SeShutdownPrivilege 2800 c439c14021fc0aa06d37ea075b6629e4eedee4518a5960f73941bc82291cf784.exe Token: SeDebugPrivilege 2800 c439c14021fc0aa06d37ea075b6629e4eedee4518a5960f73941bc82291cf784.exe Token: SeSystemEnvironmentPrivilege 2800 c439c14021fc0aa06d37ea075b6629e4eedee4518a5960f73941bc82291cf784.exe Token: SeChangeNotifyPrivilege 2800 c439c14021fc0aa06d37ea075b6629e4eedee4518a5960f73941bc82291cf784.exe Token: SeRemoteShutdownPrivilege 2800 c439c14021fc0aa06d37ea075b6629e4eedee4518a5960f73941bc82291cf784.exe Token: SeUndockPrivilege 2800 c439c14021fc0aa06d37ea075b6629e4eedee4518a5960f73941bc82291cf784.exe Token: SeManageVolumePrivilege 2800 c439c14021fc0aa06d37ea075b6629e4eedee4518a5960f73941bc82291cf784.exe Token: SeImpersonatePrivilege 2800 c439c14021fc0aa06d37ea075b6629e4eedee4518a5960f73941bc82291cf784.exe Token: SeCreateGlobalPrivilege 2800 c439c14021fc0aa06d37ea075b6629e4eedee4518a5960f73941bc82291cf784.exe Token: 33 2800 c439c14021fc0aa06d37ea075b6629e4eedee4518a5960f73941bc82291cf784.exe Token: 34 2800 c439c14021fc0aa06d37ea075b6629e4eedee4518a5960f73941bc82291cf784.exe Token: 35 2800 c439c14021fc0aa06d37ea075b6629e4eedee4518a5960f73941bc82291cf784.exe Token: 36 2800 c439c14021fc0aa06d37ea075b6629e4eedee4518a5960f73941bc82291cf784.exe Token: SeIncreaseQuotaPrivilege 2808 ZQWZ.exe Token: SeSecurityPrivilege 2808 ZQWZ.exe Token: SeTakeOwnershipPrivilege 2808 ZQWZ.exe Token: SeLoadDriverPrivilege 2808 ZQWZ.exe Token: SeSystemProfilePrivilege 2808 ZQWZ.exe Token: SeSystemtimePrivilege 2808 ZQWZ.exe Token: SeProfSingleProcessPrivilege 2808 ZQWZ.exe Token: SeIncBasePriorityPrivilege 2808 ZQWZ.exe Token: SeCreatePagefilePrivilege 2808 ZQWZ.exe Token: SeBackupPrivilege 2808 ZQWZ.exe Token: SeRestorePrivilege 2808 ZQWZ.exe Token: SeShutdownPrivilege 2808 ZQWZ.exe Token: SeDebugPrivilege 2808 ZQWZ.exe Token: SeSystemEnvironmentPrivilege 2808 ZQWZ.exe Token: SeChangeNotifyPrivilege 2808 ZQWZ.exe Token: SeRemoteShutdownPrivilege 2808 ZQWZ.exe Token: SeUndockPrivilege 2808 ZQWZ.exe Token: SeManageVolumePrivilege 2808 ZQWZ.exe Token: SeImpersonatePrivilege 2808 ZQWZ.exe Token: SeCreateGlobalPrivilege 2808 ZQWZ.exe Token: 33 2808 ZQWZ.exe Token: 34 2808 ZQWZ.exe Token: 35 2808 ZQWZ.exe Token: 36 2808 ZQWZ.exe Token: SeIncreaseQuotaPrivilege 2276 iexplore.exe Token: SeSecurityPrivilege 2276 iexplore.exe Token: SeTakeOwnershipPrivilege 2276 iexplore.exe Token: SeLoadDriverPrivilege 2276 iexplore.exe Token: SeSystemProfilePrivilege 2276 iexplore.exe Token: SeSystemtimePrivilege 2276 iexplore.exe Token: SeProfSingleProcessPrivilege 2276 iexplore.exe Token: SeIncBasePriorityPrivilege 2276 iexplore.exe Token: SeCreatePagefilePrivilege 2276 iexplore.exe Token: SeBackupPrivilege 2276 iexplore.exe Token: SeRestorePrivilege 2276 iexplore.exe Token: SeShutdownPrivilege 2276 iexplore.exe Token: SeDebugPrivilege 2276 iexplore.exe Token: SeSystemEnvironmentPrivilege 2276 iexplore.exe Token: SeChangeNotifyPrivilege 2276 iexplore.exe Token: SeRemoteShutdownPrivilege 2276 iexplore.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
iexplore.exepid process 2276 iexplore.exe -
Suspicious use of WriteProcessMemory 59 IoCs
Processes:
c439c14021fc0aa06d37ea075b6629e4eedee4518a5960f73941bc82291cf784.execmd.execmd.exeZQWZ.exeiexplore.exedescription pid process target process PID 2800 wrote to memory of 3708 2800 c439c14021fc0aa06d37ea075b6629e4eedee4518a5960f73941bc82291cf784.exe cmd.exe PID 2800 wrote to memory of 3708 2800 c439c14021fc0aa06d37ea075b6629e4eedee4518a5960f73941bc82291cf784.exe cmd.exe PID 2800 wrote to memory of 3708 2800 c439c14021fc0aa06d37ea075b6629e4eedee4518a5960f73941bc82291cf784.exe cmd.exe PID 2800 wrote to memory of 2548 2800 c439c14021fc0aa06d37ea075b6629e4eedee4518a5960f73941bc82291cf784.exe cmd.exe PID 2800 wrote to memory of 2548 2800 c439c14021fc0aa06d37ea075b6629e4eedee4518a5960f73941bc82291cf784.exe cmd.exe PID 2800 wrote to memory of 2548 2800 c439c14021fc0aa06d37ea075b6629e4eedee4518a5960f73941bc82291cf784.exe cmd.exe PID 2800 wrote to memory of 1840 2800 c439c14021fc0aa06d37ea075b6629e4eedee4518a5960f73941bc82291cf784.exe notepad.exe PID 2800 wrote to memory of 1840 2800 c439c14021fc0aa06d37ea075b6629e4eedee4518a5960f73941bc82291cf784.exe notepad.exe PID 2800 wrote to memory of 1840 2800 c439c14021fc0aa06d37ea075b6629e4eedee4518a5960f73941bc82291cf784.exe notepad.exe PID 2800 wrote to memory of 1840 2800 c439c14021fc0aa06d37ea075b6629e4eedee4518a5960f73941bc82291cf784.exe notepad.exe PID 2800 wrote to memory of 1840 2800 c439c14021fc0aa06d37ea075b6629e4eedee4518a5960f73941bc82291cf784.exe notepad.exe PID 2800 wrote to memory of 1840 2800 c439c14021fc0aa06d37ea075b6629e4eedee4518a5960f73941bc82291cf784.exe notepad.exe PID 2800 wrote to memory of 1840 2800 c439c14021fc0aa06d37ea075b6629e4eedee4518a5960f73941bc82291cf784.exe notepad.exe PID 2800 wrote to memory of 1840 2800 c439c14021fc0aa06d37ea075b6629e4eedee4518a5960f73941bc82291cf784.exe notepad.exe PID 2800 wrote to memory of 1840 2800 c439c14021fc0aa06d37ea075b6629e4eedee4518a5960f73941bc82291cf784.exe notepad.exe PID 2800 wrote to memory of 1840 2800 c439c14021fc0aa06d37ea075b6629e4eedee4518a5960f73941bc82291cf784.exe notepad.exe PID 2800 wrote to memory of 1840 2800 c439c14021fc0aa06d37ea075b6629e4eedee4518a5960f73941bc82291cf784.exe notepad.exe PID 2800 wrote to memory of 1840 2800 c439c14021fc0aa06d37ea075b6629e4eedee4518a5960f73941bc82291cf784.exe notepad.exe PID 2800 wrote to memory of 1840 2800 c439c14021fc0aa06d37ea075b6629e4eedee4518a5960f73941bc82291cf784.exe notepad.exe PID 2800 wrote to memory of 1840 2800 c439c14021fc0aa06d37ea075b6629e4eedee4518a5960f73941bc82291cf784.exe notepad.exe PID 2800 wrote to memory of 1840 2800 c439c14021fc0aa06d37ea075b6629e4eedee4518a5960f73941bc82291cf784.exe notepad.exe PID 2800 wrote to memory of 1840 2800 c439c14021fc0aa06d37ea075b6629e4eedee4518a5960f73941bc82291cf784.exe notepad.exe PID 2800 wrote to memory of 1840 2800 c439c14021fc0aa06d37ea075b6629e4eedee4518a5960f73941bc82291cf784.exe notepad.exe PID 3708 wrote to memory of 1660 3708 cmd.exe attrib.exe PID 3708 wrote to memory of 1660 3708 cmd.exe attrib.exe PID 3708 wrote to memory of 1660 3708 cmd.exe attrib.exe PID 2548 wrote to memory of 1708 2548 cmd.exe attrib.exe PID 2548 wrote to memory of 1708 2548 cmd.exe attrib.exe PID 2548 wrote to memory of 1708 2548 cmd.exe attrib.exe PID 2800 wrote to memory of 2808 2800 c439c14021fc0aa06d37ea075b6629e4eedee4518a5960f73941bc82291cf784.exe ZQWZ.exe PID 2800 wrote to memory of 2808 2800 c439c14021fc0aa06d37ea075b6629e4eedee4518a5960f73941bc82291cf784.exe ZQWZ.exe PID 2800 wrote to memory of 2808 2800 c439c14021fc0aa06d37ea075b6629e4eedee4518a5960f73941bc82291cf784.exe ZQWZ.exe PID 2808 wrote to memory of 2276 2808 ZQWZ.exe iexplore.exe PID 2808 wrote to memory of 2276 2808 ZQWZ.exe iexplore.exe PID 2808 wrote to memory of 2276 2808 ZQWZ.exe iexplore.exe PID 2808 wrote to memory of 2276 2808 ZQWZ.exe iexplore.exe PID 2808 wrote to memory of 2276 2808 ZQWZ.exe iexplore.exe PID 2276 wrote to memory of 3256 2276 iexplore.exe notepad.exe PID 2276 wrote to memory of 3256 2276 iexplore.exe notepad.exe PID 2276 wrote to memory of 3256 2276 iexplore.exe notepad.exe PID 2276 wrote to memory of 3256 2276 iexplore.exe notepad.exe PID 2276 wrote to memory of 3256 2276 iexplore.exe notepad.exe PID 2276 wrote to memory of 3256 2276 iexplore.exe notepad.exe PID 2276 wrote to memory of 3256 2276 iexplore.exe notepad.exe PID 2276 wrote to memory of 3256 2276 iexplore.exe notepad.exe PID 2276 wrote to memory of 3256 2276 iexplore.exe notepad.exe PID 2276 wrote to memory of 3256 2276 iexplore.exe notepad.exe PID 2276 wrote to memory of 3256 2276 iexplore.exe notepad.exe PID 2276 wrote to memory of 3256 2276 iexplore.exe notepad.exe PID 2276 wrote to memory of 3256 2276 iexplore.exe notepad.exe PID 2276 wrote to memory of 3256 2276 iexplore.exe notepad.exe PID 2276 wrote to memory of 3256 2276 iexplore.exe notepad.exe PID 2276 wrote to memory of 3256 2276 iexplore.exe notepad.exe PID 2276 wrote to memory of 3256 2276 iexplore.exe notepad.exe PID 2276 wrote to memory of 3256 2276 iexplore.exe notepad.exe PID 2276 wrote to memory of 3256 2276 iexplore.exe notepad.exe PID 2276 wrote to memory of 3256 2276 iexplore.exe notepad.exe PID 2276 wrote to memory of 3256 2276 iexplore.exe notepad.exe PID 2276 wrote to memory of 3256 2276 iexplore.exe notepad.exe -
Views/modifies file attributes 1 TTPs 2 IoCs
Processes:
attrib.exeattrib.exepid process 1708 attrib.exe 1660 attrib.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\c439c14021fc0aa06d37ea075b6629e4eedee4518a5960f73941bc82291cf784.exe"C:\Users\Admin\AppData\Local\Temp\c439c14021fc0aa06d37ea075b6629e4eedee4518a5960f73941bc82291cf784.exe"1⤵
- Modifies WinLogon for persistence
- Checks computer location settings
- Adds Run key to start application
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp\c439c14021fc0aa06d37ea075b6629e4eedee4518a5960f73941bc82291cf784.exe" +s +h2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Users\Admin\AppData\Local\Temp\c439c14021fc0aa06d37ea075b6629e4eedee4518a5960f73941bc82291cf784.exe" +s +h3⤵
- Sets file to hidden
- Views/modifies file attributes
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp" +s +h2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Users\Admin\AppData\Local\Temp" +s +h3⤵
- Sets file to hidden
- Views/modifies file attributes
-
C:\Windows\SysWOW64\notepad.exenotepad2⤵
-
C:\MSDCSC\ZQWZ.exe"C:\MSDCSC\ZQWZ.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\iexplore.exe"C:\Program Files (x86)\Internet Explorer\iexplore.exe"3⤵
- Adds Run key to start application
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\notepad.exenotepad4⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\MSDCSC\ZQWZ.exeFilesize
659KB
MD5c98ab7ddf2809a9db363bce22d5468f9
SHA1f3d28dae38bba6b614a63504119f202f08308919
SHA256c439c14021fc0aa06d37ea075b6629e4eedee4518a5960f73941bc82291cf784
SHA5122b8ce86d4de1fe35b12195f42881737506f32cd4abad2be9688d3f5077427f7a477ef35677fe05bc85c70ba4b17faaaf8d6a717b52f26bc86a36d862220bf302
-
C:\MSDCSC\ZQWZ.exeFilesize
659KB
MD5c98ab7ddf2809a9db363bce22d5468f9
SHA1f3d28dae38bba6b614a63504119f202f08308919
SHA256c439c14021fc0aa06d37ea075b6629e4eedee4518a5960f73941bc82291cf784
SHA5122b8ce86d4de1fe35b12195f42881737506f32cd4abad2be9688d3f5077427f7a477ef35677fe05bc85c70ba4b17faaaf8d6a717b52f26bc86a36d862220bf302
-
memory/1660-135-0x0000000000000000-mapping.dmp
-
memory/1708-136-0x0000000000000000-mapping.dmp
-
memory/1840-134-0x0000000000000000-mapping.dmp
-
memory/2548-133-0x0000000000000000-mapping.dmp
-
memory/2808-137-0x0000000000000000-mapping.dmp
-
memory/3256-140-0x0000000000000000-mapping.dmp
-
memory/3708-132-0x0000000000000000-mapping.dmp