Analysis
-
max time kernel
153s -
max time network
159s -
platform
windows7_x64 -
resource
win7-20220715-en -
resource tags
arch:x64arch:x86image:win7-20220715-enlocale:en-usos:windows7-x64system -
submitted
31-07-2022 11:41
Static task
static1
Behavioral task
behavioral1
Sample
7925fb4943617c8bf2740c0d4030243a70d5461d6069ed136c7a0360c9545744.exe
Resource
win7-20220715-en
General
-
Target
7925fb4943617c8bf2740c0d4030243a70d5461d6069ed136c7a0360c9545744.exe
-
Size
440KB
-
MD5
a56c8f7c8cc94966093d7ea2b3241f12
-
SHA1
e12bdd5b96295d73e2bd14b63d5be1dffe485796
-
SHA256
7925fb4943617c8bf2740c0d4030243a70d5461d6069ed136c7a0360c9545744
-
SHA512
5f343bd670d633f403d561312de638a4eac63bb937b86557c39b56f89a86ac94382319a36ac9bff5e9a4401e2f91950f4129e945e51668cd8937ec4a7c8849a6
Malware Config
Extracted
darkcomet
garry
212.83.162.240:4449
DC_MUTEX-HVQYYV2
-
InstallPath
MSDCSC\msdcsc.exe
-
gencode
qP9qMy51lYCf
-
install
true
-
offline_keylogger
true
-
persistence
true
-
reg_key
SQLBrowser
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
Processes:
7925fb4943617c8bf2740c0d4030243a70d5461d6069ed136c7a0360c9545744.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Users\\Admin\\Documents\\MSDCSC\\msdcsc.exe" 7925fb4943617c8bf2740c0d4030243a70d5461d6069ed136c7a0360c9545744.exe -
Executes dropped EXE 1 IoCs
Processes:
msdcsc.exepid process 980 msdcsc.exe -
Sets file to hidden 1 TTPs 1 IoCs
Modifies file attributes to stop it showing in Explorer etc.
-
Processes:
resource yara_rule behavioral1/memory/1064-56-0x0000000000400000-0x0000000000B9C000-memory.dmp upx behavioral1/memory/980-68-0x0000000000400000-0x0000000000B9C000-memory.dmp upx behavioral1/memory/1064-73-0x0000000000400000-0x0000000000B9C000-memory.dmp upx behavioral1/memory/980-74-0x0000000000400000-0x0000000000B9C000-memory.dmp upx -
Deletes itself 1 IoCs
Processes:
notepad.exepid process 2032 notepad.exe -
Loads dropped DLL 2 IoCs
Processes:
7925fb4943617c8bf2740c0d4030243a70d5461d6069ed136c7a0360c9545744.exepid process 1064 7925fb4943617c8bf2740c0d4030243a70d5461d6069ed136c7a0360c9545744.exe 1064 7925fb4943617c8bf2740c0d4030243a70d5461d6069ed136c7a0360c9545744.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
7925fb4943617c8bf2740c0d4030243a70d5461d6069ed136c7a0360c9545744.exemsdcsc.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-335065374-4263250628-1829373619-1000\Software\Microsoft\Windows\CurrentVersion\Run\SQLBrowser = "C:\\Users\\Admin\\Documents\\MSDCSC\\msdcsc.exe" 7925fb4943617c8bf2740c0d4030243a70d5461d6069ed136c7a0360c9545744.exe Set value (str) \REGISTRY\USER\S-1-5-21-335065374-4263250628-1829373619-1000\Software\Microsoft\Windows\CurrentVersion\Run\SQLBrowser = "C:\\Users\\Admin\\Documents\\MSDCSC\\msdcsc.exe" msdcsc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of AdjustPrivilegeToken 46 IoCs
Processes:
7925fb4943617c8bf2740c0d4030243a70d5461d6069ed136c7a0360c9545744.exemsdcsc.exedescription pid process Token: SeIncreaseQuotaPrivilege 1064 7925fb4943617c8bf2740c0d4030243a70d5461d6069ed136c7a0360c9545744.exe Token: SeSecurityPrivilege 1064 7925fb4943617c8bf2740c0d4030243a70d5461d6069ed136c7a0360c9545744.exe Token: SeTakeOwnershipPrivilege 1064 7925fb4943617c8bf2740c0d4030243a70d5461d6069ed136c7a0360c9545744.exe Token: SeLoadDriverPrivilege 1064 7925fb4943617c8bf2740c0d4030243a70d5461d6069ed136c7a0360c9545744.exe Token: SeSystemProfilePrivilege 1064 7925fb4943617c8bf2740c0d4030243a70d5461d6069ed136c7a0360c9545744.exe Token: SeSystemtimePrivilege 1064 7925fb4943617c8bf2740c0d4030243a70d5461d6069ed136c7a0360c9545744.exe Token: SeProfSingleProcessPrivilege 1064 7925fb4943617c8bf2740c0d4030243a70d5461d6069ed136c7a0360c9545744.exe Token: SeIncBasePriorityPrivilege 1064 7925fb4943617c8bf2740c0d4030243a70d5461d6069ed136c7a0360c9545744.exe Token: SeCreatePagefilePrivilege 1064 7925fb4943617c8bf2740c0d4030243a70d5461d6069ed136c7a0360c9545744.exe Token: SeBackupPrivilege 1064 7925fb4943617c8bf2740c0d4030243a70d5461d6069ed136c7a0360c9545744.exe Token: SeRestorePrivilege 1064 7925fb4943617c8bf2740c0d4030243a70d5461d6069ed136c7a0360c9545744.exe Token: SeShutdownPrivilege 1064 7925fb4943617c8bf2740c0d4030243a70d5461d6069ed136c7a0360c9545744.exe Token: SeDebugPrivilege 1064 7925fb4943617c8bf2740c0d4030243a70d5461d6069ed136c7a0360c9545744.exe Token: SeSystemEnvironmentPrivilege 1064 7925fb4943617c8bf2740c0d4030243a70d5461d6069ed136c7a0360c9545744.exe Token: SeChangeNotifyPrivilege 1064 7925fb4943617c8bf2740c0d4030243a70d5461d6069ed136c7a0360c9545744.exe Token: SeRemoteShutdownPrivilege 1064 7925fb4943617c8bf2740c0d4030243a70d5461d6069ed136c7a0360c9545744.exe Token: SeUndockPrivilege 1064 7925fb4943617c8bf2740c0d4030243a70d5461d6069ed136c7a0360c9545744.exe Token: SeManageVolumePrivilege 1064 7925fb4943617c8bf2740c0d4030243a70d5461d6069ed136c7a0360c9545744.exe Token: SeImpersonatePrivilege 1064 7925fb4943617c8bf2740c0d4030243a70d5461d6069ed136c7a0360c9545744.exe Token: SeCreateGlobalPrivilege 1064 7925fb4943617c8bf2740c0d4030243a70d5461d6069ed136c7a0360c9545744.exe Token: 33 1064 7925fb4943617c8bf2740c0d4030243a70d5461d6069ed136c7a0360c9545744.exe Token: 34 1064 7925fb4943617c8bf2740c0d4030243a70d5461d6069ed136c7a0360c9545744.exe Token: 35 1064 7925fb4943617c8bf2740c0d4030243a70d5461d6069ed136c7a0360c9545744.exe Token: SeIncreaseQuotaPrivilege 980 msdcsc.exe Token: SeSecurityPrivilege 980 msdcsc.exe Token: SeTakeOwnershipPrivilege 980 msdcsc.exe Token: SeLoadDriverPrivilege 980 msdcsc.exe Token: SeSystemProfilePrivilege 980 msdcsc.exe Token: SeSystemtimePrivilege 980 msdcsc.exe Token: SeProfSingleProcessPrivilege 980 msdcsc.exe Token: SeIncBasePriorityPrivilege 980 msdcsc.exe Token: SeCreatePagefilePrivilege 980 msdcsc.exe Token: SeBackupPrivilege 980 msdcsc.exe Token: SeRestorePrivilege 980 msdcsc.exe Token: SeShutdownPrivilege 980 msdcsc.exe Token: SeDebugPrivilege 980 msdcsc.exe Token: SeSystemEnvironmentPrivilege 980 msdcsc.exe Token: SeChangeNotifyPrivilege 980 msdcsc.exe Token: SeRemoteShutdownPrivilege 980 msdcsc.exe Token: SeUndockPrivilege 980 msdcsc.exe Token: SeManageVolumePrivilege 980 msdcsc.exe Token: SeImpersonatePrivilege 980 msdcsc.exe Token: SeCreateGlobalPrivilege 980 msdcsc.exe Token: 33 980 msdcsc.exe Token: 34 980 msdcsc.exe Token: 35 980 msdcsc.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
msdcsc.exepid process 980 msdcsc.exe -
Suspicious use of WriteProcessMemory 53 IoCs
Processes:
7925fb4943617c8bf2740c0d4030243a70d5461d6069ed136c7a0360c9545744.execmd.exemsdcsc.exedescription pid process target process PID 1064 wrote to memory of 1740 1064 7925fb4943617c8bf2740c0d4030243a70d5461d6069ed136c7a0360c9545744.exe cmd.exe PID 1064 wrote to memory of 1740 1064 7925fb4943617c8bf2740c0d4030243a70d5461d6069ed136c7a0360c9545744.exe cmd.exe PID 1064 wrote to memory of 1740 1064 7925fb4943617c8bf2740c0d4030243a70d5461d6069ed136c7a0360c9545744.exe cmd.exe PID 1064 wrote to memory of 1740 1064 7925fb4943617c8bf2740c0d4030243a70d5461d6069ed136c7a0360c9545744.exe cmd.exe PID 1740 wrote to memory of 1220 1740 cmd.exe attrib.exe PID 1740 wrote to memory of 1220 1740 cmd.exe attrib.exe PID 1740 wrote to memory of 1220 1740 cmd.exe attrib.exe PID 1740 wrote to memory of 1220 1740 cmd.exe attrib.exe PID 1064 wrote to memory of 2032 1064 7925fb4943617c8bf2740c0d4030243a70d5461d6069ed136c7a0360c9545744.exe notepad.exe PID 1064 wrote to memory of 2032 1064 7925fb4943617c8bf2740c0d4030243a70d5461d6069ed136c7a0360c9545744.exe notepad.exe PID 1064 wrote to memory of 2032 1064 7925fb4943617c8bf2740c0d4030243a70d5461d6069ed136c7a0360c9545744.exe notepad.exe PID 1064 wrote to memory of 2032 1064 7925fb4943617c8bf2740c0d4030243a70d5461d6069ed136c7a0360c9545744.exe notepad.exe PID 1064 wrote to memory of 2032 1064 7925fb4943617c8bf2740c0d4030243a70d5461d6069ed136c7a0360c9545744.exe notepad.exe PID 1064 wrote to memory of 2032 1064 7925fb4943617c8bf2740c0d4030243a70d5461d6069ed136c7a0360c9545744.exe notepad.exe PID 1064 wrote to memory of 2032 1064 7925fb4943617c8bf2740c0d4030243a70d5461d6069ed136c7a0360c9545744.exe notepad.exe PID 1064 wrote to memory of 2032 1064 7925fb4943617c8bf2740c0d4030243a70d5461d6069ed136c7a0360c9545744.exe notepad.exe PID 1064 wrote to memory of 2032 1064 7925fb4943617c8bf2740c0d4030243a70d5461d6069ed136c7a0360c9545744.exe notepad.exe PID 1064 wrote to memory of 2032 1064 7925fb4943617c8bf2740c0d4030243a70d5461d6069ed136c7a0360c9545744.exe notepad.exe PID 1064 wrote to memory of 2032 1064 7925fb4943617c8bf2740c0d4030243a70d5461d6069ed136c7a0360c9545744.exe notepad.exe PID 1064 wrote to memory of 2032 1064 7925fb4943617c8bf2740c0d4030243a70d5461d6069ed136c7a0360c9545744.exe notepad.exe PID 1064 wrote to memory of 2032 1064 7925fb4943617c8bf2740c0d4030243a70d5461d6069ed136c7a0360c9545744.exe notepad.exe PID 1064 wrote to memory of 2032 1064 7925fb4943617c8bf2740c0d4030243a70d5461d6069ed136c7a0360c9545744.exe notepad.exe PID 1064 wrote to memory of 2032 1064 7925fb4943617c8bf2740c0d4030243a70d5461d6069ed136c7a0360c9545744.exe notepad.exe PID 1064 wrote to memory of 2032 1064 7925fb4943617c8bf2740c0d4030243a70d5461d6069ed136c7a0360c9545744.exe notepad.exe PID 1064 wrote to memory of 2032 1064 7925fb4943617c8bf2740c0d4030243a70d5461d6069ed136c7a0360c9545744.exe notepad.exe PID 1064 wrote to memory of 2032 1064 7925fb4943617c8bf2740c0d4030243a70d5461d6069ed136c7a0360c9545744.exe notepad.exe PID 1064 wrote to memory of 980 1064 7925fb4943617c8bf2740c0d4030243a70d5461d6069ed136c7a0360c9545744.exe msdcsc.exe PID 1064 wrote to memory of 980 1064 7925fb4943617c8bf2740c0d4030243a70d5461d6069ed136c7a0360c9545744.exe msdcsc.exe PID 1064 wrote to memory of 980 1064 7925fb4943617c8bf2740c0d4030243a70d5461d6069ed136c7a0360c9545744.exe msdcsc.exe PID 1064 wrote to memory of 980 1064 7925fb4943617c8bf2740c0d4030243a70d5461d6069ed136c7a0360c9545744.exe msdcsc.exe PID 980 wrote to memory of 1724 980 msdcsc.exe notepad.exe PID 980 wrote to memory of 1724 980 msdcsc.exe notepad.exe PID 980 wrote to memory of 1724 980 msdcsc.exe notepad.exe PID 980 wrote to memory of 1724 980 msdcsc.exe notepad.exe PID 980 wrote to memory of 1724 980 msdcsc.exe notepad.exe PID 980 wrote to memory of 1724 980 msdcsc.exe notepad.exe PID 980 wrote to memory of 1724 980 msdcsc.exe notepad.exe PID 980 wrote to memory of 1724 980 msdcsc.exe notepad.exe PID 980 wrote to memory of 1724 980 msdcsc.exe notepad.exe PID 980 wrote to memory of 1724 980 msdcsc.exe notepad.exe PID 980 wrote to memory of 1724 980 msdcsc.exe notepad.exe PID 980 wrote to memory of 1724 980 msdcsc.exe notepad.exe PID 980 wrote to memory of 1724 980 msdcsc.exe notepad.exe PID 980 wrote to memory of 1724 980 msdcsc.exe notepad.exe PID 980 wrote to memory of 1724 980 msdcsc.exe notepad.exe PID 980 wrote to memory of 1724 980 msdcsc.exe notepad.exe PID 980 wrote to memory of 1724 980 msdcsc.exe notepad.exe PID 980 wrote to memory of 1724 980 msdcsc.exe notepad.exe PID 980 wrote to memory of 1724 980 msdcsc.exe notepad.exe PID 980 wrote to memory of 1724 980 msdcsc.exe notepad.exe PID 980 wrote to memory of 1724 980 msdcsc.exe notepad.exe PID 980 wrote to memory of 1724 980 msdcsc.exe notepad.exe PID 980 wrote to memory of 1724 980 msdcsc.exe notepad.exe -
Views/modifies file attributes 1 TTPs 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\7925fb4943617c8bf2740c0d4030243a70d5461d6069ed136c7a0360c9545744.exe"C:\Users\Admin\AppData\Local\Temp\7925fb4943617c8bf2740c0d4030243a70d5461d6069ed136c7a0360c9545744.exe"1⤵
- Modifies WinLogon for persistence
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp" +s +h2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Users\Admin\AppData\Local\Temp" +s +h3⤵
- Sets file to hidden
- Views/modifies file attributes
-
C:\Windows\SysWOW64\notepad.exenotepad2⤵
- Deletes itself
-
C:\Users\Admin\Documents\MSDCSC\msdcsc.exe"C:\Users\Admin\Documents\MSDCSC\msdcsc.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\notepad.exenotepad3⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\Documents\MSDCSC\msdcsc.exeFilesize
440KB
MD5a56c8f7c8cc94966093d7ea2b3241f12
SHA1e12bdd5b96295d73e2bd14b63d5be1dffe485796
SHA2567925fb4943617c8bf2740c0d4030243a70d5461d6069ed136c7a0360c9545744
SHA5125f343bd670d633f403d561312de638a4eac63bb937b86557c39b56f89a86ac94382319a36ac9bff5e9a4401e2f91950f4129e945e51668cd8937ec4a7c8849a6
-
C:\Users\Admin\Documents\MSDCSC\msdcsc.exeFilesize
440KB
MD5a56c8f7c8cc94966093d7ea2b3241f12
SHA1e12bdd5b96295d73e2bd14b63d5be1dffe485796
SHA2567925fb4943617c8bf2740c0d4030243a70d5461d6069ed136c7a0360c9545744
SHA5125f343bd670d633f403d561312de638a4eac63bb937b86557c39b56f89a86ac94382319a36ac9bff5e9a4401e2f91950f4129e945e51668cd8937ec4a7c8849a6
-
\Users\Admin\Documents\MSDCSC\msdcsc.exeFilesize
440KB
MD5a56c8f7c8cc94966093d7ea2b3241f12
SHA1e12bdd5b96295d73e2bd14b63d5be1dffe485796
SHA2567925fb4943617c8bf2740c0d4030243a70d5461d6069ed136c7a0360c9545744
SHA5125f343bd670d633f403d561312de638a4eac63bb937b86557c39b56f89a86ac94382319a36ac9bff5e9a4401e2f91950f4129e945e51668cd8937ec4a7c8849a6
-
\Users\Admin\Documents\MSDCSC\msdcsc.exeFilesize
440KB
MD5a56c8f7c8cc94966093d7ea2b3241f12
SHA1e12bdd5b96295d73e2bd14b63d5be1dffe485796
SHA2567925fb4943617c8bf2740c0d4030243a70d5461d6069ed136c7a0360c9545744
SHA5125f343bd670d633f403d561312de638a4eac63bb937b86557c39b56f89a86ac94382319a36ac9bff5e9a4401e2f91950f4129e945e51668cd8937ec4a7c8849a6
-
memory/980-74-0x0000000000400000-0x0000000000B9C000-memory.dmpFilesize
7.6MB
-
memory/980-63-0x0000000000000000-mapping.dmp
-
memory/980-67-0x000000000026E000-0x00000000002AE000-memory.dmpFilesize
256KB
-
memory/980-68-0x0000000000400000-0x0000000000B9C000-memory.dmpFilesize
7.6MB
-
memory/1064-73-0x0000000000400000-0x0000000000B9C000-memory.dmpFilesize
7.6MB
-
memory/1064-54-0x00000000760E1000-0x00000000760E3000-memory.dmpFilesize
8KB
-
memory/1064-56-0x0000000000400000-0x0000000000B9C000-memory.dmpFilesize
7.6MB
-
memory/1064-55-0x0000000000D6E000-0x0000000000DAE000-memory.dmpFilesize
256KB
-
memory/1064-66-0x0000000000D6E000-0x0000000000DAE000-memory.dmpFilesize
256KB
-
memory/1064-72-0x0000000000D6E000-0x0000000000DAE000-memory.dmpFilesize
256KB
-
memory/1220-58-0x0000000000000000-mapping.dmp
-
memory/1724-70-0x0000000000000000-mapping.dmp
-
memory/1740-57-0x0000000000000000-mapping.dmp
-
memory/2032-59-0x0000000000000000-mapping.dmp