Analysis
-
max time kernel
91s -
max time network
142s -
platform
windows10-2004_x64 -
resource
win10v2004-20220721-en -
resource tags
arch:x64arch:x86image:win10v2004-20220721-enlocale:en-usos:windows10-2004-x64system -
submitted
31-07-2022 11:41
Behavioral task
behavioral1
Sample
aad73bfd7a30fb114cec0596fdd818edb7ddda1d27856682cf3134dcc3de0eee.exe
Resource
win7-20220715-en
Behavioral task
behavioral2
Sample
aad73bfd7a30fb114cec0596fdd818edb7ddda1d27856682cf3134dcc3de0eee.exe
Resource
win10v2004-20220721-en
General
-
Target
aad73bfd7a30fb114cec0596fdd818edb7ddda1d27856682cf3134dcc3de0eee.exe
-
Size
690KB
-
MD5
2194793f9dcc7cc77d208c1f2b1e7e2c
-
SHA1
bbfe71946bcc3e94eb7032485da79a1186981e6b
-
SHA256
aad73bfd7a30fb114cec0596fdd818edb7ddda1d27856682cf3134dcc3de0eee
-
SHA512
41c2c41b2ab78c8c9df63d4ebe5eb7cc927422324b744a8734caf633a7fbfba6c5063fd8807d47417228aa81e04664901444e9cbcb224f80e646b3b598176e7a
Malware Config
Extracted
darkcomet
Guest16
192.168.1.4:1604
DC_MUTEX-PZNKCGY
-
InstallPath
MSDCSC\msdcsc.exe
-
gencode
AQtHj77eZQcF
-
install
true
-
offline_keylogger
true
-
persistence
false
-
reg_key
MicroUpdate
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
Processes:
aad73bfd7a30fb114cec0596fdd818edb7ddda1d27856682cf3134dcc3de0eee.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Users\\Admin\\Documents\\MSDCSC\\msdcsc.exe" aad73bfd7a30fb114cec0596fdd818edb7ddda1d27856682cf3134dcc3de0eee.exe -
Executes dropped EXE 1 IoCs
Processes:
msdcsc.exepid process 3436 msdcsc.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
aad73bfd7a30fb114cec0596fdd818edb7ddda1d27856682cf3134dcc3de0eee.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2660308776-3705150086-26593515-1000\Control Panel\International\Geo\Nation aad73bfd7a30fb114cec0596fdd818edb7ddda1d27856682cf3134dcc3de0eee.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
aad73bfd7a30fb114cec0596fdd818edb7ddda1d27856682cf3134dcc3de0eee.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2660308776-3705150086-26593515-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Users\\Admin\\Documents\\MSDCSC\\msdcsc.exe" aad73bfd7a30fb114cec0596fdd818edb7ddda1d27856682cf3134dcc3de0eee.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of AdjustPrivilegeToken 48 IoCs
Processes:
aad73bfd7a30fb114cec0596fdd818edb7ddda1d27856682cf3134dcc3de0eee.exemsdcsc.exedescription pid process Token: SeIncreaseQuotaPrivilege 4324 aad73bfd7a30fb114cec0596fdd818edb7ddda1d27856682cf3134dcc3de0eee.exe Token: SeSecurityPrivilege 4324 aad73bfd7a30fb114cec0596fdd818edb7ddda1d27856682cf3134dcc3de0eee.exe Token: SeTakeOwnershipPrivilege 4324 aad73bfd7a30fb114cec0596fdd818edb7ddda1d27856682cf3134dcc3de0eee.exe Token: SeLoadDriverPrivilege 4324 aad73bfd7a30fb114cec0596fdd818edb7ddda1d27856682cf3134dcc3de0eee.exe Token: SeSystemProfilePrivilege 4324 aad73bfd7a30fb114cec0596fdd818edb7ddda1d27856682cf3134dcc3de0eee.exe Token: SeSystemtimePrivilege 4324 aad73bfd7a30fb114cec0596fdd818edb7ddda1d27856682cf3134dcc3de0eee.exe Token: SeProfSingleProcessPrivilege 4324 aad73bfd7a30fb114cec0596fdd818edb7ddda1d27856682cf3134dcc3de0eee.exe Token: SeIncBasePriorityPrivilege 4324 aad73bfd7a30fb114cec0596fdd818edb7ddda1d27856682cf3134dcc3de0eee.exe Token: SeCreatePagefilePrivilege 4324 aad73bfd7a30fb114cec0596fdd818edb7ddda1d27856682cf3134dcc3de0eee.exe Token: SeBackupPrivilege 4324 aad73bfd7a30fb114cec0596fdd818edb7ddda1d27856682cf3134dcc3de0eee.exe Token: SeRestorePrivilege 4324 aad73bfd7a30fb114cec0596fdd818edb7ddda1d27856682cf3134dcc3de0eee.exe Token: SeShutdownPrivilege 4324 aad73bfd7a30fb114cec0596fdd818edb7ddda1d27856682cf3134dcc3de0eee.exe Token: SeDebugPrivilege 4324 aad73bfd7a30fb114cec0596fdd818edb7ddda1d27856682cf3134dcc3de0eee.exe Token: SeSystemEnvironmentPrivilege 4324 aad73bfd7a30fb114cec0596fdd818edb7ddda1d27856682cf3134dcc3de0eee.exe Token: SeChangeNotifyPrivilege 4324 aad73bfd7a30fb114cec0596fdd818edb7ddda1d27856682cf3134dcc3de0eee.exe Token: SeRemoteShutdownPrivilege 4324 aad73bfd7a30fb114cec0596fdd818edb7ddda1d27856682cf3134dcc3de0eee.exe Token: SeUndockPrivilege 4324 aad73bfd7a30fb114cec0596fdd818edb7ddda1d27856682cf3134dcc3de0eee.exe Token: SeManageVolumePrivilege 4324 aad73bfd7a30fb114cec0596fdd818edb7ddda1d27856682cf3134dcc3de0eee.exe Token: SeImpersonatePrivilege 4324 aad73bfd7a30fb114cec0596fdd818edb7ddda1d27856682cf3134dcc3de0eee.exe Token: SeCreateGlobalPrivilege 4324 aad73bfd7a30fb114cec0596fdd818edb7ddda1d27856682cf3134dcc3de0eee.exe Token: 33 4324 aad73bfd7a30fb114cec0596fdd818edb7ddda1d27856682cf3134dcc3de0eee.exe Token: 34 4324 aad73bfd7a30fb114cec0596fdd818edb7ddda1d27856682cf3134dcc3de0eee.exe Token: 35 4324 aad73bfd7a30fb114cec0596fdd818edb7ddda1d27856682cf3134dcc3de0eee.exe Token: 36 4324 aad73bfd7a30fb114cec0596fdd818edb7ddda1d27856682cf3134dcc3de0eee.exe Token: SeIncreaseQuotaPrivilege 3436 msdcsc.exe Token: SeSecurityPrivilege 3436 msdcsc.exe Token: SeTakeOwnershipPrivilege 3436 msdcsc.exe Token: SeLoadDriverPrivilege 3436 msdcsc.exe Token: SeSystemProfilePrivilege 3436 msdcsc.exe Token: SeSystemtimePrivilege 3436 msdcsc.exe Token: SeProfSingleProcessPrivilege 3436 msdcsc.exe Token: SeIncBasePriorityPrivilege 3436 msdcsc.exe Token: SeCreatePagefilePrivilege 3436 msdcsc.exe Token: SeBackupPrivilege 3436 msdcsc.exe Token: SeRestorePrivilege 3436 msdcsc.exe Token: SeShutdownPrivilege 3436 msdcsc.exe Token: SeDebugPrivilege 3436 msdcsc.exe Token: SeSystemEnvironmentPrivilege 3436 msdcsc.exe Token: SeChangeNotifyPrivilege 3436 msdcsc.exe Token: SeRemoteShutdownPrivilege 3436 msdcsc.exe Token: SeUndockPrivilege 3436 msdcsc.exe Token: SeManageVolumePrivilege 3436 msdcsc.exe Token: SeImpersonatePrivilege 3436 msdcsc.exe Token: SeCreateGlobalPrivilege 3436 msdcsc.exe Token: 33 3436 msdcsc.exe Token: 34 3436 msdcsc.exe Token: 35 3436 msdcsc.exe Token: 36 3436 msdcsc.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
msdcsc.exepid process 3436 msdcsc.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
aad73bfd7a30fb114cec0596fdd818edb7ddda1d27856682cf3134dcc3de0eee.exedescription pid process target process PID 4324 wrote to memory of 3436 4324 aad73bfd7a30fb114cec0596fdd818edb7ddda1d27856682cf3134dcc3de0eee.exe msdcsc.exe PID 4324 wrote to memory of 3436 4324 aad73bfd7a30fb114cec0596fdd818edb7ddda1d27856682cf3134dcc3de0eee.exe msdcsc.exe PID 4324 wrote to memory of 3436 4324 aad73bfd7a30fb114cec0596fdd818edb7ddda1d27856682cf3134dcc3de0eee.exe msdcsc.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\aad73bfd7a30fb114cec0596fdd818edb7ddda1d27856682cf3134dcc3de0eee.exe"C:\Users\Admin\AppData\Local\Temp\aad73bfd7a30fb114cec0596fdd818edb7ddda1d27856682cf3134dcc3de0eee.exe"1⤵
- Modifies WinLogon for persistence
- Checks computer location settings
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\Documents\MSDCSC\msdcsc.exe"C:\Users\Admin\Documents\MSDCSC\msdcsc.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\Documents\MSDCSC\msdcsc.exeFilesize
690KB
MD52194793f9dcc7cc77d208c1f2b1e7e2c
SHA1bbfe71946bcc3e94eb7032485da79a1186981e6b
SHA256aad73bfd7a30fb114cec0596fdd818edb7ddda1d27856682cf3134dcc3de0eee
SHA51241c2c41b2ab78c8c9df63d4ebe5eb7cc927422324b744a8734caf633a7fbfba6c5063fd8807d47417228aa81e04664901444e9cbcb224f80e646b3b598176e7a
-
C:\Users\Admin\Documents\MSDCSC\msdcsc.exeFilesize
690KB
MD52194793f9dcc7cc77d208c1f2b1e7e2c
SHA1bbfe71946bcc3e94eb7032485da79a1186981e6b
SHA256aad73bfd7a30fb114cec0596fdd818edb7ddda1d27856682cf3134dcc3de0eee
SHA51241c2c41b2ab78c8c9df63d4ebe5eb7cc927422324b744a8734caf633a7fbfba6c5063fd8807d47417228aa81e04664901444e9cbcb224f80e646b3b598176e7a
-
memory/3436-130-0x0000000000000000-mapping.dmp