Analysis
-
max time kernel
149s -
max time network
127s -
platform
windows10-2004_x64 -
resource
win10v2004-20220901-en -
resource tags
arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system -
submitted
19-09-2022 01:52
Static task
static1
Behavioral task
behavioral1
Sample
51ec26d5e74978479605310e9d0d9ae95d8c757815a59414675c1abcfc402731.exe
Resource
win7-20220812-en
General
-
Target
51ec26d5e74978479605310e9d0d9ae95d8c757815a59414675c1abcfc402731.exe
-
Size
723KB
-
MD5
405a7c8ce43495472b9cf657e5e9146d
-
SHA1
b5a8f51aa534d3810fe703484cc42abd207bebac
-
SHA256
51ec26d5e74978479605310e9d0d9ae95d8c757815a59414675c1abcfc402731
-
SHA512
b814debe07c1d6be624d3a46ee29b5cbcc169e18fc360a8b166167eac01c8c0ef83bc004bae04672f03b6a7701dee1f0aa7812ca2bb74117f6b7ce3f88cb6467
-
SSDEEP
12288:dQagJn/vJWZ0tDFgpM+UPneKm8/C6uwYtU7z3v+Om9MOsLY4Eda7:dSFvJWZuDSm+C2y/PYtF/MOAJZ
Malware Config
Extracted
darkcomet
Guest16
127.0.0.1:1604
DC_MUTEX-U4NPZL2
-
gencode
PrbNySYPHXfQ
-
install
false
-
offline_keylogger
true
-
persistence
false
Signatures
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
51ec26d5e74978479605310e9d0d9ae95d8c757815a59414675c1abcfc402731.exedescription pid process target process PID 3928 set thread context of 4956 3928 51ec26d5e74978479605310e9d0d9ae95d8c757815a59414675c1abcfc402731.exe 51ec26d5e74978479605310e9d0d9ae95d8c757815a59414675c1abcfc402731.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of AdjustPrivilegeToken 24 IoCs
Processes:
51ec26d5e74978479605310e9d0d9ae95d8c757815a59414675c1abcfc402731.exedescription pid process Token: SeIncreaseQuotaPrivilege 4956 51ec26d5e74978479605310e9d0d9ae95d8c757815a59414675c1abcfc402731.exe Token: SeSecurityPrivilege 4956 51ec26d5e74978479605310e9d0d9ae95d8c757815a59414675c1abcfc402731.exe Token: SeTakeOwnershipPrivilege 4956 51ec26d5e74978479605310e9d0d9ae95d8c757815a59414675c1abcfc402731.exe Token: SeLoadDriverPrivilege 4956 51ec26d5e74978479605310e9d0d9ae95d8c757815a59414675c1abcfc402731.exe Token: SeSystemProfilePrivilege 4956 51ec26d5e74978479605310e9d0d9ae95d8c757815a59414675c1abcfc402731.exe Token: SeSystemtimePrivilege 4956 51ec26d5e74978479605310e9d0d9ae95d8c757815a59414675c1abcfc402731.exe Token: SeProfSingleProcessPrivilege 4956 51ec26d5e74978479605310e9d0d9ae95d8c757815a59414675c1abcfc402731.exe Token: SeIncBasePriorityPrivilege 4956 51ec26d5e74978479605310e9d0d9ae95d8c757815a59414675c1abcfc402731.exe Token: SeCreatePagefilePrivilege 4956 51ec26d5e74978479605310e9d0d9ae95d8c757815a59414675c1abcfc402731.exe Token: SeBackupPrivilege 4956 51ec26d5e74978479605310e9d0d9ae95d8c757815a59414675c1abcfc402731.exe Token: SeRestorePrivilege 4956 51ec26d5e74978479605310e9d0d9ae95d8c757815a59414675c1abcfc402731.exe Token: SeShutdownPrivilege 4956 51ec26d5e74978479605310e9d0d9ae95d8c757815a59414675c1abcfc402731.exe Token: SeDebugPrivilege 4956 51ec26d5e74978479605310e9d0d9ae95d8c757815a59414675c1abcfc402731.exe Token: SeSystemEnvironmentPrivilege 4956 51ec26d5e74978479605310e9d0d9ae95d8c757815a59414675c1abcfc402731.exe Token: SeChangeNotifyPrivilege 4956 51ec26d5e74978479605310e9d0d9ae95d8c757815a59414675c1abcfc402731.exe Token: SeRemoteShutdownPrivilege 4956 51ec26d5e74978479605310e9d0d9ae95d8c757815a59414675c1abcfc402731.exe Token: SeUndockPrivilege 4956 51ec26d5e74978479605310e9d0d9ae95d8c757815a59414675c1abcfc402731.exe Token: SeManageVolumePrivilege 4956 51ec26d5e74978479605310e9d0d9ae95d8c757815a59414675c1abcfc402731.exe Token: SeImpersonatePrivilege 4956 51ec26d5e74978479605310e9d0d9ae95d8c757815a59414675c1abcfc402731.exe Token: SeCreateGlobalPrivilege 4956 51ec26d5e74978479605310e9d0d9ae95d8c757815a59414675c1abcfc402731.exe Token: 33 4956 51ec26d5e74978479605310e9d0d9ae95d8c757815a59414675c1abcfc402731.exe Token: 34 4956 51ec26d5e74978479605310e9d0d9ae95d8c757815a59414675c1abcfc402731.exe Token: 35 4956 51ec26d5e74978479605310e9d0d9ae95d8c757815a59414675c1abcfc402731.exe Token: 36 4956 51ec26d5e74978479605310e9d0d9ae95d8c757815a59414675c1abcfc402731.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
51ec26d5e74978479605310e9d0d9ae95d8c757815a59414675c1abcfc402731.exe51ec26d5e74978479605310e9d0d9ae95d8c757815a59414675c1abcfc402731.exepid process 3928 51ec26d5e74978479605310e9d0d9ae95d8c757815a59414675c1abcfc402731.exe 4956 51ec26d5e74978479605310e9d0d9ae95d8c757815a59414675c1abcfc402731.exe -
Suspicious use of WriteProcessMemory 14 IoCs
Processes:
51ec26d5e74978479605310e9d0d9ae95d8c757815a59414675c1abcfc402731.exedescription pid process target process PID 3928 wrote to memory of 4956 3928 51ec26d5e74978479605310e9d0d9ae95d8c757815a59414675c1abcfc402731.exe 51ec26d5e74978479605310e9d0d9ae95d8c757815a59414675c1abcfc402731.exe PID 3928 wrote to memory of 4956 3928 51ec26d5e74978479605310e9d0d9ae95d8c757815a59414675c1abcfc402731.exe 51ec26d5e74978479605310e9d0d9ae95d8c757815a59414675c1abcfc402731.exe PID 3928 wrote to memory of 4956 3928 51ec26d5e74978479605310e9d0d9ae95d8c757815a59414675c1abcfc402731.exe 51ec26d5e74978479605310e9d0d9ae95d8c757815a59414675c1abcfc402731.exe PID 3928 wrote to memory of 4956 3928 51ec26d5e74978479605310e9d0d9ae95d8c757815a59414675c1abcfc402731.exe 51ec26d5e74978479605310e9d0d9ae95d8c757815a59414675c1abcfc402731.exe PID 3928 wrote to memory of 4956 3928 51ec26d5e74978479605310e9d0d9ae95d8c757815a59414675c1abcfc402731.exe 51ec26d5e74978479605310e9d0d9ae95d8c757815a59414675c1abcfc402731.exe PID 3928 wrote to memory of 4956 3928 51ec26d5e74978479605310e9d0d9ae95d8c757815a59414675c1abcfc402731.exe 51ec26d5e74978479605310e9d0d9ae95d8c757815a59414675c1abcfc402731.exe PID 3928 wrote to memory of 4956 3928 51ec26d5e74978479605310e9d0d9ae95d8c757815a59414675c1abcfc402731.exe 51ec26d5e74978479605310e9d0d9ae95d8c757815a59414675c1abcfc402731.exe PID 3928 wrote to memory of 4956 3928 51ec26d5e74978479605310e9d0d9ae95d8c757815a59414675c1abcfc402731.exe 51ec26d5e74978479605310e9d0d9ae95d8c757815a59414675c1abcfc402731.exe PID 3928 wrote to memory of 4956 3928 51ec26d5e74978479605310e9d0d9ae95d8c757815a59414675c1abcfc402731.exe 51ec26d5e74978479605310e9d0d9ae95d8c757815a59414675c1abcfc402731.exe PID 3928 wrote to memory of 4956 3928 51ec26d5e74978479605310e9d0d9ae95d8c757815a59414675c1abcfc402731.exe 51ec26d5e74978479605310e9d0d9ae95d8c757815a59414675c1abcfc402731.exe PID 3928 wrote to memory of 4956 3928 51ec26d5e74978479605310e9d0d9ae95d8c757815a59414675c1abcfc402731.exe 51ec26d5e74978479605310e9d0d9ae95d8c757815a59414675c1abcfc402731.exe PID 3928 wrote to memory of 4956 3928 51ec26d5e74978479605310e9d0d9ae95d8c757815a59414675c1abcfc402731.exe 51ec26d5e74978479605310e9d0d9ae95d8c757815a59414675c1abcfc402731.exe PID 3928 wrote to memory of 4956 3928 51ec26d5e74978479605310e9d0d9ae95d8c757815a59414675c1abcfc402731.exe 51ec26d5e74978479605310e9d0d9ae95d8c757815a59414675c1abcfc402731.exe PID 3928 wrote to memory of 4956 3928 51ec26d5e74978479605310e9d0d9ae95d8c757815a59414675c1abcfc402731.exe 51ec26d5e74978479605310e9d0d9ae95d8c757815a59414675c1abcfc402731.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\51ec26d5e74978479605310e9d0d9ae95d8c757815a59414675c1abcfc402731.exe"C:\Users\Admin\AppData\Local\Temp\51ec26d5e74978479605310e9d0d9ae95d8c757815a59414675c1abcfc402731.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\51ec26d5e74978479605310e9d0d9ae95d8c757815a59414675c1abcfc402731.exe"C:\Users\Admin\AppData\Local\Temp\51ec26d5e74978479605310e9d0d9ae95d8c757815a59414675c1abcfc402731.exe"2⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/4956-134-0x0000000000000000-mapping.dmp
-
memory/4956-135-0x0000000000400000-0x00000000004B8000-memory.dmpFilesize
736KB
-
memory/4956-136-0x0000000000400000-0x00000000004B8000-memory.dmpFilesize
736KB
-
memory/4956-137-0x0000000000400000-0x00000000004B8000-memory.dmpFilesize
736KB
-
memory/4956-138-0x0000000000400000-0x00000000004B8000-memory.dmpFilesize
736KB
-
memory/4956-139-0x0000000000400000-0x00000000004B8000-memory.dmpFilesize
736KB