Analysis
- max time kernel
139s - max time network
148s - platform
windows10-2004_x64 - resource
win10v2004-20220812-en - resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system - submitted
09/09/2022, 18:55
Behavioral task
behavioral1
Sample
darktest.exe
Resource
win7-20220812-en
windows7-x64
12 signatures
150 seconds
General
- Target darktest.exe
- Size 349KB
- Sample220909-xkrzeacfdr
- SHA256 cafe8d935b3afac2695aca899b702c039c97cd1c4fbbc67f2ea80ec5e1808c09
- MD5 ae5d11ab94b48e917e1ce2b1e7c4ed12
- SHA1 1c723713a0e6ec3afa227e8039f4dec01a8b1a98
- SHA512 f411e47118f16d10382ec8bf3df475669d8b4baa7f2f1c582c0bd48fee91c4f376dee915956e9af318cc5e910881e9c1cd20943e12a9d651083fc534680490e4
- SSDEEP 6144:ccNYS996KFifeVjBpeExgVTFSXFoMc5RhCaL37gplvccV:ccW7KEZlPzCy37gfUcV
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Extracted
Family
-
darkcomet
Botnet
-
test16
C2
-
70.70.19.220:1420
-
70.70.19.220:1421
-
70.70.19.220:1422
-
70.70.19.220:1423
-
70.70.19.220:1444
Mutex
-
DC_MUTEX-KC7Q893
Attributes
-
InstallPath
MSDCSC\msdcsc.exe
-
gencode
TpGvyfYL1uEx
-
install
true
-
offline_keylogger
true
-
persistence
false
-
reg_key
MicroUpdate
Signatures
- Modifies WinLogon for persistence 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\MSDCSC\\msdcsc.exe" darktest.exe - Executes dropped EXE 1 IoCs
pid Process 3844 msdcsc.exe - Sets file to hidden 1 TTPs 1 IoCs
Modifies file attributes to stop it showing in Explorer etc.
pid Process 4652 attrib.exe -
resource yara_rule behavioral2/memory/2204-133-0x0000000000400000-0x00000000004E8000-memory.dmp upx behavioral2/files/0x0007000000022e70-135.dat upx behavioral2/files/0x0007000000022e70-136.dat upx behavioral2/memory/3844-138-0x0000000000400000-0x00000000004E8000-memory.dmp upx behavioral2/memory/2204-139-0x0000000000400000-0x00000000004E8000-memory.dmp upx behavioral2/memory/3844-140-0x0000000000400000-0x00000000004E8000-memory.dmp upx - Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation darktest.exe - Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\MSDCSC\\msdcsc.exe" darktest.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Suspicious use of AdjustPrivilegeToken 48 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 2204 darktest.exe Token: SeSecurityPrivilege 2204 darktest.exe Token: SeTakeOwnershipPrivilege 2204 darktest.exe Token: SeLoadDriverPrivilege 2204 darktest.exe Token: SeSystemProfilePrivilege 2204 darktest.exe Token: SeSystemtimePrivilege 2204 darktest.exe Token: SeProfSingleProcessPrivilege 2204 darktest.exe Token: SeIncBasePriorityPrivilege 2204 darktest.exe Token: SeCreatePagefilePrivilege 2204 darktest.exe Token: SeBackupPrivilege 2204 darktest.exe Token: SeRestorePrivilege 2204 darktest.exe Token: SeShutdownPrivilege 2204 darktest.exe Token: SeDebugPrivilege 2204 darktest.exe Token: SeSystemEnvironmentPrivilege 2204 darktest.exe Token: SeChangeNotifyPrivilege 2204 darktest.exe Token: SeRemoteShutdownPrivilege 2204 darktest.exe Token: SeUndockPrivilege 2204 darktest.exe Token: SeManageVolumePrivilege 2204 darktest.exe Token: SeImpersonatePrivilege 2204 darktest.exe Token: SeCreateGlobalPrivilege 2204 darktest.exe Token: 33 2204 darktest.exe Token: 34 2204 darktest.exe Token: 35 2204 darktest.exe Token: 36 2204 darktest.exe Token: SeIncreaseQuotaPrivilege 3844 msdcsc.exe Token: SeSecurityPrivilege 3844 msdcsc.exe Token: SeTakeOwnershipPrivilege 3844 msdcsc.exe Token: SeLoadDriverPrivilege 3844 msdcsc.exe Token: SeSystemProfilePrivilege 3844 msdcsc.exe Token: SeSystemtimePrivilege 3844 msdcsc.exe Token: SeProfSingleProcessPrivilege 3844 msdcsc.exe Token: SeIncBasePriorityPrivilege 3844 msdcsc.exe Token: SeCreatePagefilePrivilege 3844 msdcsc.exe Token: SeBackupPrivilege 3844 msdcsc.exe Token: SeRestorePrivilege 3844 msdcsc.exe Token: SeShutdownPrivilege 3844 msdcsc.exe Token: SeDebugPrivilege 3844 msdcsc.exe Token: SeSystemEnvironmentPrivilege 3844 msdcsc.exe Token: SeChangeNotifyPrivilege 3844 msdcsc.exe Token: SeRemoteShutdownPrivilege 3844 msdcsc.exe Token: SeUndockPrivilege 3844 msdcsc.exe Token: SeManageVolumePrivilege 3844 msdcsc.exe Token: SeImpersonatePrivilege 3844 msdcsc.exe Token: SeCreateGlobalPrivilege 3844 msdcsc.exe Token: 33 3844 msdcsc.exe Token: 34 3844 msdcsc.exe Token: 35 3844 msdcsc.exe Token: 36 3844 msdcsc.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 3844 msdcsc.exe - Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 2204 wrote to memory of 2180 2204 darktest.exe 85 PID 2204 wrote to memory of 2180 2204 darktest.exe 85 PID 2204 wrote to memory of 2180 2204 darktest.exe 85 PID 2204 wrote to memory of 3844 2204 darktest.exe 87 PID 2204 wrote to memory of 3844 2204 darktest.exe 87 PID 2204 wrote to memory of 3844 2204 darktest.exe 87 PID 2180 wrote to memory of 4652 2180 cmd.exe 88 PID 2180 wrote to memory of 4652 2180 cmd.exe 88 PID 2180 wrote to memory of 4652 2180 cmd.exe 88 - Views/modifies file attributes 1 TTPs 1 IoCs
pid Process 4652 attrib.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\darktest.exe"C:\Users\Admin\AppData\Local\Temp\darktest.exe"1⤵
- Modifies WinLogon for persistence
- Checks computer location settings
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2204 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp\darktest.exe" +s +h2⤵
- Suspicious use of WriteProcessMemory
PID:2180 -
C:\Windows\SysWOW64\attrib.exeattrib "C:\Users\Admin\AppData\Local\Temp\darktest.exe" +s +h3⤵
- Sets file to hidden
- Views/modifies file attributes
PID:4652
-
-
-
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\MSDCSC\msdcsc.exe"C:\ProgramData\Microsoft\Windows\Start Menu\Programs\MSDCSC\msdcsc.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:3844
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\MSDCSC\msdcsc.exe
- Size 349KB
- SHA256 cafe8d935b3afac2695aca899b702c039c97cd1c4fbbc67f2ea80ec5e1808c09
- MD5 ae5d11ab94b48e917e1ce2b1e7c4ed12
- SHA1 1c723713a0e6ec3afa227e8039f4dec01a8b1a98
- SHA512 f411e47118f16d10382ec8bf3df475669d8b4baa7f2f1c582c0bd48fee91c4f376dee915956e9af318cc5e910881e9c1cd20943e12a9d651083fc534680490e4
- SSDEEP 6144:ccNYS996KFifeVjBpeExgVTFSXFoMc5RhCaL37gplvccV:ccW7KEZlPzCy37gfUcV
- MD5 SHA1 SHA512 SSDEEP
- Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\MSDCSC\msdcsc.exe
- Size 349KB
- SHA256 cafe8d935b3afac2695aca899b702c039c97cd1c4fbbc67f2ea80ec5e1808c09
- MD5 ae5d11ab94b48e917e1ce2b1e7c4ed12
- SHA1 1c723713a0e6ec3afa227e8039f4dec01a8b1a98
- SHA512 f411e47118f16d10382ec8bf3df475669d8b4baa7f2f1c582c0bd48fee91c4f376dee915956e9af318cc5e910881e9c1cd20943e12a9d651083fc534680490e4
- SSDEEP 6144:ccNYS996KFifeVjBpeExgVTFSXFoMc5RhCaL37gplvccV:ccW7KEZlPzCy37gfUcV
- MD5 SHA1 SHA512 SSDEEP