Analysis
-
max time kernel
151s -
max time network
47s -
platform
windows7_x64 -
resource
win7-20220718-en -
resource tags
arch:x64arch:x86image:win7-20220718-enlocale:en-usos:windows7-x64system -
submitted
31-07-2022 18:09
Behavioral task
behavioral1
Sample
5f21c7279140fe637b951a0678c7fe6fd84198a43cf26d3b21e1e37ebc12b932.exe
Resource
win7-20220718-en
Behavioral task
behavioral2
Sample
5f21c7279140fe637b951a0678c7fe6fd84198a43cf26d3b21e1e37ebc12b932.exe
Resource
win10v2004-20220721-en
General
-
Target
5f21c7279140fe637b951a0678c7fe6fd84198a43cf26d3b21e1e37ebc12b932.exe
-
Size
756KB
-
MD5
30cd1eb2e9eb2de1b915df13e69d9ab5
-
SHA1
b08ebca830448d2607741169c8c96de385b90a92
-
SHA256
5f21c7279140fe637b951a0678c7fe6fd84198a43cf26d3b21e1e37ebc12b932
-
SHA512
1d64fc1205609d4e3139dc43340e8e62c81810ddee9ab532883dda49b3c315292c3e826071effafbb8b4aabc61ffe3587f5e8fdc7bb384a4e05ceeba8bf2f9bb
Malware Config
Extracted
darkcomet
P_Olsen
secure.gotdns.com:5053
DC_MUTEX-CKVKEKE
-
InstallPath
Final Fantasy\FFXIV.exe
-
gencode
8K1HPoiJsS4s
-
install
true
-
offline_keylogger
true
-
persistence
true
-
reg_key
FFupdater
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
Processes:
5f21c7279140fe637b951a0678c7fe6fd84198a43cf26d3b21e1e37ebc12b932.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Users\\Admin\\Favorites\\Final Fantasy\\FFXIV.exe" 5f21c7279140fe637b951a0678c7fe6fd84198a43cf26d3b21e1e37ebc12b932.exe -
Executes dropped EXE 1 IoCs
Processes:
FFXIV.exepid process 1392 FFXIV.exe -
Loads dropped DLL 2 IoCs
Processes:
5f21c7279140fe637b951a0678c7fe6fd84198a43cf26d3b21e1e37ebc12b932.exepid process 1132 5f21c7279140fe637b951a0678c7fe6fd84198a43cf26d3b21e1e37ebc12b932.exe 1132 5f21c7279140fe637b951a0678c7fe6fd84198a43cf26d3b21e1e37ebc12b932.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
5f21c7279140fe637b951a0678c7fe6fd84198a43cf26d3b21e1e37ebc12b932.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3762437355-3468409815-1164039494-1000\Software\Microsoft\Windows\CurrentVersion\Run\FFupdater = "C:\\Users\\Admin\\Favorites\\Final Fantasy\\FFXIV.exe" 5f21c7279140fe637b951a0678c7fe6fd84198a43cf26d3b21e1e37ebc12b932.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of AdjustPrivilegeToken 46 IoCs
Processes:
5f21c7279140fe637b951a0678c7fe6fd84198a43cf26d3b21e1e37ebc12b932.exeFFXIV.exedescription pid process Token: SeIncreaseQuotaPrivilege 1132 5f21c7279140fe637b951a0678c7fe6fd84198a43cf26d3b21e1e37ebc12b932.exe Token: SeSecurityPrivilege 1132 5f21c7279140fe637b951a0678c7fe6fd84198a43cf26d3b21e1e37ebc12b932.exe Token: SeTakeOwnershipPrivilege 1132 5f21c7279140fe637b951a0678c7fe6fd84198a43cf26d3b21e1e37ebc12b932.exe Token: SeLoadDriverPrivilege 1132 5f21c7279140fe637b951a0678c7fe6fd84198a43cf26d3b21e1e37ebc12b932.exe Token: SeSystemProfilePrivilege 1132 5f21c7279140fe637b951a0678c7fe6fd84198a43cf26d3b21e1e37ebc12b932.exe Token: SeSystemtimePrivilege 1132 5f21c7279140fe637b951a0678c7fe6fd84198a43cf26d3b21e1e37ebc12b932.exe Token: SeProfSingleProcessPrivilege 1132 5f21c7279140fe637b951a0678c7fe6fd84198a43cf26d3b21e1e37ebc12b932.exe Token: SeIncBasePriorityPrivilege 1132 5f21c7279140fe637b951a0678c7fe6fd84198a43cf26d3b21e1e37ebc12b932.exe Token: SeCreatePagefilePrivilege 1132 5f21c7279140fe637b951a0678c7fe6fd84198a43cf26d3b21e1e37ebc12b932.exe Token: SeBackupPrivilege 1132 5f21c7279140fe637b951a0678c7fe6fd84198a43cf26d3b21e1e37ebc12b932.exe Token: SeRestorePrivilege 1132 5f21c7279140fe637b951a0678c7fe6fd84198a43cf26d3b21e1e37ebc12b932.exe Token: SeShutdownPrivilege 1132 5f21c7279140fe637b951a0678c7fe6fd84198a43cf26d3b21e1e37ebc12b932.exe Token: SeDebugPrivilege 1132 5f21c7279140fe637b951a0678c7fe6fd84198a43cf26d3b21e1e37ebc12b932.exe Token: SeSystemEnvironmentPrivilege 1132 5f21c7279140fe637b951a0678c7fe6fd84198a43cf26d3b21e1e37ebc12b932.exe Token: SeChangeNotifyPrivilege 1132 5f21c7279140fe637b951a0678c7fe6fd84198a43cf26d3b21e1e37ebc12b932.exe Token: SeRemoteShutdownPrivilege 1132 5f21c7279140fe637b951a0678c7fe6fd84198a43cf26d3b21e1e37ebc12b932.exe Token: SeUndockPrivilege 1132 5f21c7279140fe637b951a0678c7fe6fd84198a43cf26d3b21e1e37ebc12b932.exe Token: SeManageVolumePrivilege 1132 5f21c7279140fe637b951a0678c7fe6fd84198a43cf26d3b21e1e37ebc12b932.exe Token: SeImpersonatePrivilege 1132 5f21c7279140fe637b951a0678c7fe6fd84198a43cf26d3b21e1e37ebc12b932.exe Token: SeCreateGlobalPrivilege 1132 5f21c7279140fe637b951a0678c7fe6fd84198a43cf26d3b21e1e37ebc12b932.exe Token: 33 1132 5f21c7279140fe637b951a0678c7fe6fd84198a43cf26d3b21e1e37ebc12b932.exe Token: 34 1132 5f21c7279140fe637b951a0678c7fe6fd84198a43cf26d3b21e1e37ebc12b932.exe Token: 35 1132 5f21c7279140fe637b951a0678c7fe6fd84198a43cf26d3b21e1e37ebc12b932.exe Token: SeIncreaseQuotaPrivilege 1392 FFXIV.exe Token: SeSecurityPrivilege 1392 FFXIV.exe Token: SeTakeOwnershipPrivilege 1392 FFXIV.exe Token: SeLoadDriverPrivilege 1392 FFXIV.exe Token: SeSystemProfilePrivilege 1392 FFXIV.exe Token: SeSystemtimePrivilege 1392 FFXIV.exe Token: SeProfSingleProcessPrivilege 1392 FFXIV.exe Token: SeIncBasePriorityPrivilege 1392 FFXIV.exe Token: SeCreatePagefilePrivilege 1392 FFXIV.exe Token: SeBackupPrivilege 1392 FFXIV.exe Token: SeRestorePrivilege 1392 FFXIV.exe Token: SeShutdownPrivilege 1392 FFXIV.exe Token: SeDebugPrivilege 1392 FFXIV.exe Token: SeSystemEnvironmentPrivilege 1392 FFXIV.exe Token: SeChangeNotifyPrivilege 1392 FFXIV.exe Token: SeRemoteShutdownPrivilege 1392 FFXIV.exe Token: SeUndockPrivilege 1392 FFXIV.exe Token: SeManageVolumePrivilege 1392 FFXIV.exe Token: SeImpersonatePrivilege 1392 FFXIV.exe Token: SeCreateGlobalPrivilege 1392 FFXIV.exe Token: 33 1392 FFXIV.exe Token: 34 1392 FFXIV.exe Token: 35 1392 FFXIV.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
FFXIV.exepid process 1392 FFXIV.exe -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
5f21c7279140fe637b951a0678c7fe6fd84198a43cf26d3b21e1e37ebc12b932.exedescription pid process target process PID 1132 wrote to memory of 1392 1132 5f21c7279140fe637b951a0678c7fe6fd84198a43cf26d3b21e1e37ebc12b932.exe FFXIV.exe PID 1132 wrote to memory of 1392 1132 5f21c7279140fe637b951a0678c7fe6fd84198a43cf26d3b21e1e37ebc12b932.exe FFXIV.exe PID 1132 wrote to memory of 1392 1132 5f21c7279140fe637b951a0678c7fe6fd84198a43cf26d3b21e1e37ebc12b932.exe FFXIV.exe PID 1132 wrote to memory of 1392 1132 5f21c7279140fe637b951a0678c7fe6fd84198a43cf26d3b21e1e37ebc12b932.exe FFXIV.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\5f21c7279140fe637b951a0678c7fe6fd84198a43cf26d3b21e1e37ebc12b932.exe"C:\Users\Admin\AppData\Local\Temp\5f21c7279140fe637b951a0678c7fe6fd84198a43cf26d3b21e1e37ebc12b932.exe"1⤵
- Modifies WinLogon for persistence
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\Favorites\Final Fantasy\FFXIV.exe"C:\Users\Admin\Favorites\Final Fantasy\FFXIV.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\Favorites\Final Fantasy\FFXIV.exeFilesize
756KB
MD530cd1eb2e9eb2de1b915df13e69d9ab5
SHA1b08ebca830448d2607741169c8c96de385b90a92
SHA2565f21c7279140fe637b951a0678c7fe6fd84198a43cf26d3b21e1e37ebc12b932
SHA5121d64fc1205609d4e3139dc43340e8e62c81810ddee9ab532883dda49b3c315292c3e826071effafbb8b4aabc61ffe3587f5e8fdc7bb384a4e05ceeba8bf2f9bb
-
C:\Users\Admin\Favorites\Final Fantasy\FFXIV.exeFilesize
756KB
MD530cd1eb2e9eb2de1b915df13e69d9ab5
SHA1b08ebca830448d2607741169c8c96de385b90a92
SHA2565f21c7279140fe637b951a0678c7fe6fd84198a43cf26d3b21e1e37ebc12b932
SHA5121d64fc1205609d4e3139dc43340e8e62c81810ddee9ab532883dda49b3c315292c3e826071effafbb8b4aabc61ffe3587f5e8fdc7bb384a4e05ceeba8bf2f9bb
-
\Users\Admin\Favorites\Final Fantasy\FFXIV.exeFilesize
756KB
MD530cd1eb2e9eb2de1b915df13e69d9ab5
SHA1b08ebca830448d2607741169c8c96de385b90a92
SHA2565f21c7279140fe637b951a0678c7fe6fd84198a43cf26d3b21e1e37ebc12b932
SHA5121d64fc1205609d4e3139dc43340e8e62c81810ddee9ab532883dda49b3c315292c3e826071effafbb8b4aabc61ffe3587f5e8fdc7bb384a4e05ceeba8bf2f9bb
-
\Users\Admin\Favorites\Final Fantasy\FFXIV.exeFilesize
756KB
MD530cd1eb2e9eb2de1b915df13e69d9ab5
SHA1b08ebca830448d2607741169c8c96de385b90a92
SHA2565f21c7279140fe637b951a0678c7fe6fd84198a43cf26d3b21e1e37ebc12b932
SHA5121d64fc1205609d4e3139dc43340e8e62c81810ddee9ab532883dda49b3c315292c3e826071effafbb8b4aabc61ffe3587f5e8fdc7bb384a4e05ceeba8bf2f9bb
-
memory/1132-54-0x0000000075CE1000-0x0000000075CE3000-memory.dmpFilesize
8KB
-
memory/1392-57-0x0000000000000000-mapping.dmp