Analysis
-
max time kernel
44s -
max time network
49s -
platform
windows7_x64 -
resource
win7-20220715-en -
resource tags
arch:x64arch:x86image:win7-20220715-enlocale:en-usos:windows7-x64system -
submitted
31-07-2022 19:28
Static task
static1
Behavioral task
behavioral1
Sample
cb96be84d722c68fb65e3523c4e0043cdc8cfa252ec045bc7c4ee230c85a83f8.exe
Resource
win7-20220715-en
Behavioral task
behavioral2
Sample
cb96be84d722c68fb65e3523c4e0043cdc8cfa252ec045bc7c4ee230c85a83f8.exe
Resource
win10v2004-20220721-en
General
-
Target
cb96be84d722c68fb65e3523c4e0043cdc8cfa252ec045bc7c4ee230c85a83f8.exe
-
Size
738KB
-
MD5
5eb58198721d4ded363e41e243e685cc
-
SHA1
d3e349f052d215f392fbbdc657583d808fe51828
-
SHA256
cb96be84d722c68fb65e3523c4e0043cdc8cfa252ec045bc7c4ee230c85a83f8
-
SHA512
8fd1ee50b3cd82d8764f818a78fc3f4fca83a689a8927b856feca15a469eb9e32447902cfd819ddbf5b97fabcfbea2de2464c0304bb3f5e10ff1ebe26e7737b6
Malware Config
Extracted
darkcomet
delvie
saw-88.no-ip.biz:1604
DC_MUTEX-T3GAC5L
-
InstallPath
MSDCSC\msdcsc.exe
-
gencode
zSVFbDa27L2S
-
install
true
-
offline_keylogger
true
-
persistence
true
-
reg_key
MicroUpdate
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
Processes:
cb96be84d722c68fb65e3523c4e0043cdc8cfa252ec045bc7c4ee230c85a83f8.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\MSDCSC\\msdcsc.exe" cb96be84d722c68fb65e3523c4e0043cdc8cfa252ec045bc7c4ee230c85a83f8.exe -
Executes dropped EXE 2 IoCs
Processes:
msdcsc.exemsdcsc.exepid process 472 msdcsc.exe 1700 msdcsc.exe -
Loads dropped DLL 2 IoCs
Processes:
cb96be84d722c68fb65e3523c4e0043cdc8cfa252ec045bc7c4ee230c85a83f8.exepid process 1536 cb96be84d722c68fb65e3523c4e0043cdc8cfa252ec045bc7c4ee230c85a83f8.exe 1536 cb96be84d722c68fb65e3523c4e0043cdc8cfa252ec045bc7c4ee230c85a83f8.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
cb96be84d722c68fb65e3523c4e0043cdc8cfa252ec045bc7c4ee230c85a83f8.exemsdcsc.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3440072777-2118400376-1759599358-1000\Software\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\MSDCSC\\msdcsc.exe" cb96be84d722c68fb65e3523c4e0043cdc8cfa252ec045bc7c4ee230c85a83f8.exe Set value (str) \REGISTRY\USER\S-1-5-21-3440072777-2118400376-1759599358-1000\Software\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\MSDCSC\\msdcsc.exe" msdcsc.exe -
Suspicious use of SetThreadContext 4 IoCs
Processes:
cb96be84d722c68fb65e3523c4e0043cdc8cfa252ec045bc7c4ee230c85a83f8.exemsdcsc.exemsdcsc.exeiexplore.exedescription pid process target process PID 1940 set thread context of 1536 1940 cb96be84d722c68fb65e3523c4e0043cdc8cfa252ec045bc7c4ee230c85a83f8.exe cb96be84d722c68fb65e3523c4e0043cdc8cfa252ec045bc7c4ee230c85a83f8.exe PID 472 set thread context of 1700 472 msdcsc.exe msdcsc.exe PID 1700 set thread context of 2012 1700 msdcsc.exe iexplore.exe PID 2012 set thread context of 1920 2012 iexplore.exe iexplore.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of AdjustPrivilegeToken 46 IoCs
Processes:
cb96be84d722c68fb65e3523c4e0043cdc8cfa252ec045bc7c4ee230c85a83f8.exemsdcsc.exedescription pid process Token: SeIncreaseQuotaPrivilege 1536 cb96be84d722c68fb65e3523c4e0043cdc8cfa252ec045bc7c4ee230c85a83f8.exe Token: SeSecurityPrivilege 1536 cb96be84d722c68fb65e3523c4e0043cdc8cfa252ec045bc7c4ee230c85a83f8.exe Token: SeTakeOwnershipPrivilege 1536 cb96be84d722c68fb65e3523c4e0043cdc8cfa252ec045bc7c4ee230c85a83f8.exe Token: SeLoadDriverPrivilege 1536 cb96be84d722c68fb65e3523c4e0043cdc8cfa252ec045bc7c4ee230c85a83f8.exe Token: SeSystemProfilePrivilege 1536 cb96be84d722c68fb65e3523c4e0043cdc8cfa252ec045bc7c4ee230c85a83f8.exe Token: SeSystemtimePrivilege 1536 cb96be84d722c68fb65e3523c4e0043cdc8cfa252ec045bc7c4ee230c85a83f8.exe Token: SeProfSingleProcessPrivilege 1536 cb96be84d722c68fb65e3523c4e0043cdc8cfa252ec045bc7c4ee230c85a83f8.exe Token: SeIncBasePriorityPrivilege 1536 cb96be84d722c68fb65e3523c4e0043cdc8cfa252ec045bc7c4ee230c85a83f8.exe Token: SeCreatePagefilePrivilege 1536 cb96be84d722c68fb65e3523c4e0043cdc8cfa252ec045bc7c4ee230c85a83f8.exe Token: SeBackupPrivilege 1536 cb96be84d722c68fb65e3523c4e0043cdc8cfa252ec045bc7c4ee230c85a83f8.exe Token: SeRestorePrivilege 1536 cb96be84d722c68fb65e3523c4e0043cdc8cfa252ec045bc7c4ee230c85a83f8.exe Token: SeShutdownPrivilege 1536 cb96be84d722c68fb65e3523c4e0043cdc8cfa252ec045bc7c4ee230c85a83f8.exe Token: SeDebugPrivilege 1536 cb96be84d722c68fb65e3523c4e0043cdc8cfa252ec045bc7c4ee230c85a83f8.exe Token: SeSystemEnvironmentPrivilege 1536 cb96be84d722c68fb65e3523c4e0043cdc8cfa252ec045bc7c4ee230c85a83f8.exe Token: SeChangeNotifyPrivilege 1536 cb96be84d722c68fb65e3523c4e0043cdc8cfa252ec045bc7c4ee230c85a83f8.exe Token: SeRemoteShutdownPrivilege 1536 cb96be84d722c68fb65e3523c4e0043cdc8cfa252ec045bc7c4ee230c85a83f8.exe Token: SeUndockPrivilege 1536 cb96be84d722c68fb65e3523c4e0043cdc8cfa252ec045bc7c4ee230c85a83f8.exe Token: SeManageVolumePrivilege 1536 cb96be84d722c68fb65e3523c4e0043cdc8cfa252ec045bc7c4ee230c85a83f8.exe Token: SeImpersonatePrivilege 1536 cb96be84d722c68fb65e3523c4e0043cdc8cfa252ec045bc7c4ee230c85a83f8.exe Token: SeCreateGlobalPrivilege 1536 cb96be84d722c68fb65e3523c4e0043cdc8cfa252ec045bc7c4ee230c85a83f8.exe Token: 33 1536 cb96be84d722c68fb65e3523c4e0043cdc8cfa252ec045bc7c4ee230c85a83f8.exe Token: 34 1536 cb96be84d722c68fb65e3523c4e0043cdc8cfa252ec045bc7c4ee230c85a83f8.exe Token: 35 1536 cb96be84d722c68fb65e3523c4e0043cdc8cfa252ec045bc7c4ee230c85a83f8.exe Token: SeIncreaseQuotaPrivilege 1700 msdcsc.exe Token: SeSecurityPrivilege 1700 msdcsc.exe Token: SeTakeOwnershipPrivilege 1700 msdcsc.exe Token: SeLoadDriverPrivilege 1700 msdcsc.exe Token: SeSystemProfilePrivilege 1700 msdcsc.exe Token: SeSystemtimePrivilege 1700 msdcsc.exe Token: SeProfSingleProcessPrivilege 1700 msdcsc.exe Token: SeIncBasePriorityPrivilege 1700 msdcsc.exe Token: SeCreatePagefilePrivilege 1700 msdcsc.exe Token: SeBackupPrivilege 1700 msdcsc.exe Token: SeRestorePrivilege 1700 msdcsc.exe Token: SeShutdownPrivilege 1700 msdcsc.exe Token: SeDebugPrivilege 1700 msdcsc.exe Token: SeSystemEnvironmentPrivilege 1700 msdcsc.exe Token: SeChangeNotifyPrivilege 1700 msdcsc.exe Token: SeRemoteShutdownPrivilege 1700 msdcsc.exe Token: SeUndockPrivilege 1700 msdcsc.exe Token: SeManageVolumePrivilege 1700 msdcsc.exe Token: SeImpersonatePrivilege 1700 msdcsc.exe Token: SeCreateGlobalPrivilege 1700 msdcsc.exe Token: 33 1700 msdcsc.exe Token: 34 1700 msdcsc.exe Token: 35 1700 msdcsc.exe -
Suspicious use of WriteProcessMemory 49 IoCs
Processes:
cb96be84d722c68fb65e3523c4e0043cdc8cfa252ec045bc7c4ee230c85a83f8.execb96be84d722c68fb65e3523c4e0043cdc8cfa252ec045bc7c4ee230c85a83f8.exemsdcsc.exemsdcsc.exeiexplore.exedescription pid process target process PID 1940 wrote to memory of 1536 1940 cb96be84d722c68fb65e3523c4e0043cdc8cfa252ec045bc7c4ee230c85a83f8.exe cb96be84d722c68fb65e3523c4e0043cdc8cfa252ec045bc7c4ee230c85a83f8.exe PID 1940 wrote to memory of 1536 1940 cb96be84d722c68fb65e3523c4e0043cdc8cfa252ec045bc7c4ee230c85a83f8.exe cb96be84d722c68fb65e3523c4e0043cdc8cfa252ec045bc7c4ee230c85a83f8.exe PID 1940 wrote to memory of 1536 1940 cb96be84d722c68fb65e3523c4e0043cdc8cfa252ec045bc7c4ee230c85a83f8.exe cb96be84d722c68fb65e3523c4e0043cdc8cfa252ec045bc7c4ee230c85a83f8.exe PID 1940 wrote to memory of 1536 1940 cb96be84d722c68fb65e3523c4e0043cdc8cfa252ec045bc7c4ee230c85a83f8.exe cb96be84d722c68fb65e3523c4e0043cdc8cfa252ec045bc7c4ee230c85a83f8.exe PID 1940 wrote to memory of 1536 1940 cb96be84d722c68fb65e3523c4e0043cdc8cfa252ec045bc7c4ee230c85a83f8.exe cb96be84d722c68fb65e3523c4e0043cdc8cfa252ec045bc7c4ee230c85a83f8.exe PID 1940 wrote to memory of 1536 1940 cb96be84d722c68fb65e3523c4e0043cdc8cfa252ec045bc7c4ee230c85a83f8.exe cb96be84d722c68fb65e3523c4e0043cdc8cfa252ec045bc7c4ee230c85a83f8.exe PID 1940 wrote to memory of 1536 1940 cb96be84d722c68fb65e3523c4e0043cdc8cfa252ec045bc7c4ee230c85a83f8.exe cb96be84d722c68fb65e3523c4e0043cdc8cfa252ec045bc7c4ee230c85a83f8.exe PID 1940 wrote to memory of 1536 1940 cb96be84d722c68fb65e3523c4e0043cdc8cfa252ec045bc7c4ee230c85a83f8.exe cb96be84d722c68fb65e3523c4e0043cdc8cfa252ec045bc7c4ee230c85a83f8.exe PID 1940 wrote to memory of 1536 1940 cb96be84d722c68fb65e3523c4e0043cdc8cfa252ec045bc7c4ee230c85a83f8.exe cb96be84d722c68fb65e3523c4e0043cdc8cfa252ec045bc7c4ee230c85a83f8.exe PID 1940 wrote to memory of 1536 1940 cb96be84d722c68fb65e3523c4e0043cdc8cfa252ec045bc7c4ee230c85a83f8.exe cb96be84d722c68fb65e3523c4e0043cdc8cfa252ec045bc7c4ee230c85a83f8.exe PID 1940 wrote to memory of 1536 1940 cb96be84d722c68fb65e3523c4e0043cdc8cfa252ec045bc7c4ee230c85a83f8.exe cb96be84d722c68fb65e3523c4e0043cdc8cfa252ec045bc7c4ee230c85a83f8.exe PID 1940 wrote to memory of 1536 1940 cb96be84d722c68fb65e3523c4e0043cdc8cfa252ec045bc7c4ee230c85a83f8.exe cb96be84d722c68fb65e3523c4e0043cdc8cfa252ec045bc7c4ee230c85a83f8.exe PID 1940 wrote to memory of 1536 1940 cb96be84d722c68fb65e3523c4e0043cdc8cfa252ec045bc7c4ee230c85a83f8.exe cb96be84d722c68fb65e3523c4e0043cdc8cfa252ec045bc7c4ee230c85a83f8.exe PID 1536 wrote to memory of 472 1536 cb96be84d722c68fb65e3523c4e0043cdc8cfa252ec045bc7c4ee230c85a83f8.exe msdcsc.exe PID 1536 wrote to memory of 472 1536 cb96be84d722c68fb65e3523c4e0043cdc8cfa252ec045bc7c4ee230c85a83f8.exe msdcsc.exe PID 1536 wrote to memory of 472 1536 cb96be84d722c68fb65e3523c4e0043cdc8cfa252ec045bc7c4ee230c85a83f8.exe msdcsc.exe PID 1536 wrote to memory of 472 1536 cb96be84d722c68fb65e3523c4e0043cdc8cfa252ec045bc7c4ee230c85a83f8.exe msdcsc.exe PID 472 wrote to memory of 1700 472 msdcsc.exe msdcsc.exe PID 472 wrote to memory of 1700 472 msdcsc.exe msdcsc.exe PID 472 wrote to memory of 1700 472 msdcsc.exe msdcsc.exe PID 472 wrote to memory of 1700 472 msdcsc.exe msdcsc.exe PID 472 wrote to memory of 1700 472 msdcsc.exe msdcsc.exe PID 472 wrote to memory of 1700 472 msdcsc.exe msdcsc.exe PID 472 wrote to memory of 1700 472 msdcsc.exe msdcsc.exe PID 472 wrote to memory of 1700 472 msdcsc.exe msdcsc.exe PID 472 wrote to memory of 1700 472 msdcsc.exe msdcsc.exe PID 472 wrote to memory of 1700 472 msdcsc.exe msdcsc.exe PID 472 wrote to memory of 1700 472 msdcsc.exe msdcsc.exe PID 472 wrote to memory of 1700 472 msdcsc.exe msdcsc.exe PID 472 wrote to memory of 1700 472 msdcsc.exe msdcsc.exe PID 1700 wrote to memory of 2012 1700 msdcsc.exe iexplore.exe PID 1700 wrote to memory of 2012 1700 msdcsc.exe iexplore.exe PID 1700 wrote to memory of 2012 1700 msdcsc.exe iexplore.exe PID 1700 wrote to memory of 2012 1700 msdcsc.exe iexplore.exe PID 1700 wrote to memory of 2012 1700 msdcsc.exe iexplore.exe PID 1700 wrote to memory of 2012 1700 msdcsc.exe iexplore.exe PID 2012 wrote to memory of 1920 2012 iexplore.exe iexplore.exe PID 2012 wrote to memory of 1920 2012 iexplore.exe iexplore.exe PID 2012 wrote to memory of 1920 2012 iexplore.exe iexplore.exe PID 2012 wrote to memory of 1920 2012 iexplore.exe iexplore.exe PID 2012 wrote to memory of 1920 2012 iexplore.exe iexplore.exe PID 2012 wrote to memory of 1920 2012 iexplore.exe iexplore.exe PID 2012 wrote to memory of 1920 2012 iexplore.exe iexplore.exe PID 2012 wrote to memory of 1920 2012 iexplore.exe iexplore.exe PID 2012 wrote to memory of 1920 2012 iexplore.exe iexplore.exe PID 2012 wrote to memory of 1920 2012 iexplore.exe iexplore.exe PID 2012 wrote to memory of 1920 2012 iexplore.exe iexplore.exe PID 2012 wrote to memory of 1920 2012 iexplore.exe iexplore.exe PID 2012 wrote to memory of 1920 2012 iexplore.exe iexplore.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\cb96be84d722c68fb65e3523c4e0043cdc8cfa252ec045bc7c4ee230c85a83f8.exe"C:\Users\Admin\AppData\Local\Temp\cb96be84d722c68fb65e3523c4e0043cdc8cfa252ec045bc7c4ee230c85a83f8.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\cb96be84d722c68fb65e3523c4e0043cdc8cfa252ec045bc7c4ee230c85a83f8.exeC:\Users\Admin\AppData\Local\Temp\cb96be84d722c68fb65e3523c4e0043cdc8cfa252ec045bc7c4ee230c85a83f8.exe2⤵
- Modifies WinLogon for persistence
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\MSDCSC\msdcsc.exe"C:\MSDCSC\msdcsc.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\MSDCSC\msdcsc.exeC:\MSDCSC\msdcsc.exe4⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\iexplore.exe"C:\Program Files (x86)\Internet Explorer\iexplore.exe"5⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\iexplore.exe"C:\Program Files (x86)\Internet Explorer\iexplore.exe"6⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\MSDCSC\msdcsc.exeFilesize
738KB
MD55eb58198721d4ded363e41e243e685cc
SHA1d3e349f052d215f392fbbdc657583d808fe51828
SHA256cb96be84d722c68fb65e3523c4e0043cdc8cfa252ec045bc7c4ee230c85a83f8
SHA5128fd1ee50b3cd82d8764f818a78fc3f4fca83a689a8927b856feca15a469eb9e32447902cfd819ddbf5b97fabcfbea2de2464c0304bb3f5e10ff1ebe26e7737b6
-
C:\MSDCSC\msdcsc.exeFilesize
738KB
MD55eb58198721d4ded363e41e243e685cc
SHA1d3e349f052d215f392fbbdc657583d808fe51828
SHA256cb96be84d722c68fb65e3523c4e0043cdc8cfa252ec045bc7c4ee230c85a83f8
SHA5128fd1ee50b3cd82d8764f818a78fc3f4fca83a689a8927b856feca15a469eb9e32447902cfd819ddbf5b97fabcfbea2de2464c0304bb3f5e10ff1ebe26e7737b6
-
C:\MSDCSC\msdcsc.exeFilesize
738KB
MD55eb58198721d4ded363e41e243e685cc
SHA1d3e349f052d215f392fbbdc657583d808fe51828
SHA256cb96be84d722c68fb65e3523c4e0043cdc8cfa252ec045bc7c4ee230c85a83f8
SHA5128fd1ee50b3cd82d8764f818a78fc3f4fca83a689a8927b856feca15a469eb9e32447902cfd819ddbf5b97fabcfbea2de2464c0304bb3f5e10ff1ebe26e7737b6
-
\MSDCSC\msdcsc.exeFilesize
738KB
MD55eb58198721d4ded363e41e243e685cc
SHA1d3e349f052d215f392fbbdc657583d808fe51828
SHA256cb96be84d722c68fb65e3523c4e0043cdc8cfa252ec045bc7c4ee230c85a83f8
SHA5128fd1ee50b3cd82d8764f818a78fc3f4fca83a689a8927b856feca15a469eb9e32447902cfd819ddbf5b97fabcfbea2de2464c0304bb3f5e10ff1ebe26e7737b6
-
\MSDCSC\msdcsc.exeFilesize
738KB
MD55eb58198721d4ded363e41e243e685cc
SHA1d3e349f052d215f392fbbdc657583d808fe51828
SHA256cb96be84d722c68fb65e3523c4e0043cdc8cfa252ec045bc7c4ee230c85a83f8
SHA5128fd1ee50b3cd82d8764f818a78fc3f4fca83a689a8927b856feca15a469eb9e32447902cfd819ddbf5b97fabcfbea2de2464c0304bb3f5e10ff1ebe26e7737b6
-
memory/472-117-0x0000000000400000-0x0000000000565000-memory.dmpFilesize
1.4MB
-
memory/472-88-0x0000000000400000-0x0000000000565000-memory.dmpFilesize
1.4MB
-
memory/472-86-0x0000000000000000-mapping.dmp
-
memory/1536-68-0x0000000000400000-0x00000000004B5000-memory.dmpFilesize
724KB
-
memory/1536-77-0x0000000000400000-0x00000000004B5000-memory.dmpFilesize
724KB
-
memory/1536-79-0x0000000000490888-mapping.dmp
-
memory/1536-55-0x0000000000400000-0x00000000004B5000-memory.dmpFilesize
724KB
-
memory/1536-80-0x0000000000400000-0x00000000004B5000-memory.dmpFilesize
724KB
-
memory/1536-82-0x00000000762A1000-0x00000000762A3000-memory.dmpFilesize
8KB
-
memory/1536-83-0x0000000000400000-0x00000000004B5000-memory.dmpFilesize
724KB
-
memory/1536-74-0x0000000000400000-0x00000000004B5000-memory.dmpFilesize
724KB
-
memory/1536-71-0x0000000000400000-0x00000000004B5000-memory.dmpFilesize
724KB
-
memory/1536-56-0x0000000000400000-0x00000000004B5000-memory.dmpFilesize
724KB
-
memory/1536-64-0x0000000000400000-0x00000000004B5000-memory.dmpFilesize
724KB
-
memory/1536-61-0x0000000000400000-0x00000000004B5000-memory.dmpFilesize
724KB
-
memory/1536-58-0x0000000000400000-0x00000000004B5000-memory.dmpFilesize
724KB
-
memory/1700-114-0x0000000000490888-mapping.dmp
-
memory/1700-119-0x0000000000400000-0x00000000004B5000-memory.dmpFilesize
724KB
-
memory/1940-54-0x0000000000400000-0x0000000000565000-memory.dmpFilesize
1.4MB
-
memory/1940-81-0x0000000000400000-0x0000000000565000-memory.dmpFilesize
1.4MB