Analysis
-
max time kernel
169s -
max time network
231s -
platform
windows7_x64 -
resource
win7-20220718-en -
resource tags
arch:x64arch:x86image:win7-20220718-enlocale:en-usos:windows7-x64system -
submitted
31-07-2022 19:32
Static task
static1
Behavioral task
behavioral1
Sample
5eaf2714cc996f09d764d358bb6be88fe7eaf892d4cc04f85b3f022d0efb81e0.exe
Resource
win7-20220718-en
General
-
Target
5eaf2714cc996f09d764d358bb6be88fe7eaf892d4cc04f85b3f022d0efb81e0.exe
-
Size
1.3MB
-
MD5
41f3dbdd92071247b28fdb7e43b34bef
-
SHA1
1e1919d995f75098d0ee65b638e7bc90cca1039c
-
SHA256
5eaf2714cc996f09d764d358bb6be88fe7eaf892d4cc04f85b3f022d0efb81e0
-
SHA512
d550a440e361544a2cea4f2b8fa5ab930d5c95daa9005e817062dfb4c95dc4b0d4b57d71c1e46d564a3e5dbf0736b97fde751e0df4045e907c166ca912e7cbd9
Malware Config
Extracted
darkcomet
Guest16
109.20.230.130:1604
DC_MUTEX-N4XL9B6
-
gencode
m8Aeownffhl6
-
install
false
-
offline_keylogger
true
-
persistence
false
Signatures
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
5eaf2714cc996f09d764d358bb6be88fe7eaf892d4cc04f85b3f022d0efb81e0.exedescription pid process target process PID 1000 set thread context of 1128 1000 5eaf2714cc996f09d764d358bb6be88fe7eaf892d4cc04f85b3f022d0efb81e0.exe 5eaf2714cc996f09d764d358bb6be88fe7eaf892d4cc04f85b3f022d0efb81e0.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of AdjustPrivilegeToken 23 IoCs
Processes:
5eaf2714cc996f09d764d358bb6be88fe7eaf892d4cc04f85b3f022d0efb81e0.exedescription pid process Token: SeIncreaseQuotaPrivilege 1128 5eaf2714cc996f09d764d358bb6be88fe7eaf892d4cc04f85b3f022d0efb81e0.exe Token: SeSecurityPrivilege 1128 5eaf2714cc996f09d764d358bb6be88fe7eaf892d4cc04f85b3f022d0efb81e0.exe Token: SeTakeOwnershipPrivilege 1128 5eaf2714cc996f09d764d358bb6be88fe7eaf892d4cc04f85b3f022d0efb81e0.exe Token: SeLoadDriverPrivilege 1128 5eaf2714cc996f09d764d358bb6be88fe7eaf892d4cc04f85b3f022d0efb81e0.exe Token: SeSystemProfilePrivilege 1128 5eaf2714cc996f09d764d358bb6be88fe7eaf892d4cc04f85b3f022d0efb81e0.exe Token: SeSystemtimePrivilege 1128 5eaf2714cc996f09d764d358bb6be88fe7eaf892d4cc04f85b3f022d0efb81e0.exe Token: SeProfSingleProcessPrivilege 1128 5eaf2714cc996f09d764d358bb6be88fe7eaf892d4cc04f85b3f022d0efb81e0.exe Token: SeIncBasePriorityPrivilege 1128 5eaf2714cc996f09d764d358bb6be88fe7eaf892d4cc04f85b3f022d0efb81e0.exe Token: SeCreatePagefilePrivilege 1128 5eaf2714cc996f09d764d358bb6be88fe7eaf892d4cc04f85b3f022d0efb81e0.exe Token: SeBackupPrivilege 1128 5eaf2714cc996f09d764d358bb6be88fe7eaf892d4cc04f85b3f022d0efb81e0.exe Token: SeRestorePrivilege 1128 5eaf2714cc996f09d764d358bb6be88fe7eaf892d4cc04f85b3f022d0efb81e0.exe Token: SeShutdownPrivilege 1128 5eaf2714cc996f09d764d358bb6be88fe7eaf892d4cc04f85b3f022d0efb81e0.exe Token: SeDebugPrivilege 1128 5eaf2714cc996f09d764d358bb6be88fe7eaf892d4cc04f85b3f022d0efb81e0.exe Token: SeSystemEnvironmentPrivilege 1128 5eaf2714cc996f09d764d358bb6be88fe7eaf892d4cc04f85b3f022d0efb81e0.exe Token: SeChangeNotifyPrivilege 1128 5eaf2714cc996f09d764d358bb6be88fe7eaf892d4cc04f85b3f022d0efb81e0.exe Token: SeRemoteShutdownPrivilege 1128 5eaf2714cc996f09d764d358bb6be88fe7eaf892d4cc04f85b3f022d0efb81e0.exe Token: SeUndockPrivilege 1128 5eaf2714cc996f09d764d358bb6be88fe7eaf892d4cc04f85b3f022d0efb81e0.exe Token: SeManageVolumePrivilege 1128 5eaf2714cc996f09d764d358bb6be88fe7eaf892d4cc04f85b3f022d0efb81e0.exe Token: SeImpersonatePrivilege 1128 5eaf2714cc996f09d764d358bb6be88fe7eaf892d4cc04f85b3f022d0efb81e0.exe Token: SeCreateGlobalPrivilege 1128 5eaf2714cc996f09d764d358bb6be88fe7eaf892d4cc04f85b3f022d0efb81e0.exe Token: 33 1128 5eaf2714cc996f09d764d358bb6be88fe7eaf892d4cc04f85b3f022d0efb81e0.exe Token: 34 1128 5eaf2714cc996f09d764d358bb6be88fe7eaf892d4cc04f85b3f022d0efb81e0.exe Token: 35 1128 5eaf2714cc996f09d764d358bb6be88fe7eaf892d4cc04f85b3f022d0efb81e0.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
5eaf2714cc996f09d764d358bb6be88fe7eaf892d4cc04f85b3f022d0efb81e0.exepid process 1128 5eaf2714cc996f09d764d358bb6be88fe7eaf892d4cc04f85b3f022d0efb81e0.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
5eaf2714cc996f09d764d358bb6be88fe7eaf892d4cc04f85b3f022d0efb81e0.exedescription pid process target process PID 1000 wrote to memory of 1128 1000 5eaf2714cc996f09d764d358bb6be88fe7eaf892d4cc04f85b3f022d0efb81e0.exe 5eaf2714cc996f09d764d358bb6be88fe7eaf892d4cc04f85b3f022d0efb81e0.exe PID 1000 wrote to memory of 1128 1000 5eaf2714cc996f09d764d358bb6be88fe7eaf892d4cc04f85b3f022d0efb81e0.exe 5eaf2714cc996f09d764d358bb6be88fe7eaf892d4cc04f85b3f022d0efb81e0.exe PID 1000 wrote to memory of 1128 1000 5eaf2714cc996f09d764d358bb6be88fe7eaf892d4cc04f85b3f022d0efb81e0.exe 5eaf2714cc996f09d764d358bb6be88fe7eaf892d4cc04f85b3f022d0efb81e0.exe PID 1000 wrote to memory of 1128 1000 5eaf2714cc996f09d764d358bb6be88fe7eaf892d4cc04f85b3f022d0efb81e0.exe 5eaf2714cc996f09d764d358bb6be88fe7eaf892d4cc04f85b3f022d0efb81e0.exe PID 1000 wrote to memory of 1128 1000 5eaf2714cc996f09d764d358bb6be88fe7eaf892d4cc04f85b3f022d0efb81e0.exe 5eaf2714cc996f09d764d358bb6be88fe7eaf892d4cc04f85b3f022d0efb81e0.exe PID 1000 wrote to memory of 1128 1000 5eaf2714cc996f09d764d358bb6be88fe7eaf892d4cc04f85b3f022d0efb81e0.exe 5eaf2714cc996f09d764d358bb6be88fe7eaf892d4cc04f85b3f022d0efb81e0.exe PID 1000 wrote to memory of 1128 1000 5eaf2714cc996f09d764d358bb6be88fe7eaf892d4cc04f85b3f022d0efb81e0.exe 5eaf2714cc996f09d764d358bb6be88fe7eaf892d4cc04f85b3f022d0efb81e0.exe PID 1000 wrote to memory of 1128 1000 5eaf2714cc996f09d764d358bb6be88fe7eaf892d4cc04f85b3f022d0efb81e0.exe 5eaf2714cc996f09d764d358bb6be88fe7eaf892d4cc04f85b3f022d0efb81e0.exe PID 1000 wrote to memory of 1128 1000 5eaf2714cc996f09d764d358bb6be88fe7eaf892d4cc04f85b3f022d0efb81e0.exe 5eaf2714cc996f09d764d358bb6be88fe7eaf892d4cc04f85b3f022d0efb81e0.exe PID 1000 wrote to memory of 1128 1000 5eaf2714cc996f09d764d358bb6be88fe7eaf892d4cc04f85b3f022d0efb81e0.exe 5eaf2714cc996f09d764d358bb6be88fe7eaf892d4cc04f85b3f022d0efb81e0.exe PID 1000 wrote to memory of 1128 1000 5eaf2714cc996f09d764d358bb6be88fe7eaf892d4cc04f85b3f022d0efb81e0.exe 5eaf2714cc996f09d764d358bb6be88fe7eaf892d4cc04f85b3f022d0efb81e0.exe PID 1000 wrote to memory of 1128 1000 5eaf2714cc996f09d764d358bb6be88fe7eaf892d4cc04f85b3f022d0efb81e0.exe 5eaf2714cc996f09d764d358bb6be88fe7eaf892d4cc04f85b3f022d0efb81e0.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\5eaf2714cc996f09d764d358bb6be88fe7eaf892d4cc04f85b3f022d0efb81e0.exe"C:\Users\Admin\AppData\Local\Temp\5eaf2714cc996f09d764d358bb6be88fe7eaf892d4cc04f85b3f022d0efb81e0.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\5eaf2714cc996f09d764d358bb6be88fe7eaf892d4cc04f85b3f022d0efb81e0.exe"C:\Users\Admin\AppData\Local\Temp\5eaf2714cc996f09d764d358bb6be88fe7eaf892d4cc04f85b3f022d0efb81e0.exe"2⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1000-54-0x00000000762D1000-0x00000000762D3000-memory.dmpFilesize
8KB
-
memory/1128-55-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/1128-56-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/1128-58-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/1128-60-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/1128-62-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/1128-64-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/1128-65-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/1128-70-0x000000000048F888-mapping.dmp
-
memory/1128-71-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/1128-69-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/1128-67-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/1128-73-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/1128-74-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/1128-75-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB