darkcomet | f695eb089d4a33afab87887b5779fe39c48e13594c6b3d76e01393eb36da886c

Processes:

AdlingV4.6.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\System32\\Drivers.exe"	AdlingV4.6.exe

Modifies firewall policy service 2 TTPs 3 IoCs

evasion

Modify Registry

Modify Existing Service

T1031

Processes:

Drivers.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	Drivers.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0"	Drivers.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "0"	Drivers.exe

Modifies security service 2 TTPs 1 IoCs
evasion

Modify Registry
T1112

Modify Existing Service
T1031

Processes:

Drivers.exe

description ioc process

Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wscsvc\Start = "4" Drivers.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wscsvc\Start = "4"	Drivers.exe

Windows security bypass 2 TTPs 2 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

Processes:

Drivers.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	Drivers.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	Drivers.exe

Disables RegEdit via registry modification 1 IoCs

evasion

Processes:

Drivers.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	Drivers.exe

Disables Task Manager via registry modification
evasion
Executes dropped EXE 4 IoCs

Processes:

AdlingV4.6.exeresult.exeresult.exeDrivers.exe

pid process

4004 AdlingV4.6.exe
3996 result.exe
3076 result.exe
3716 Drivers.exe
Sets file to hidden 1 TTPs 2 IoCs
Modifies file attributes to stop it showing in Explorer etc.
evasion

Hidden Files and Directories
T1158

Processes:

attrib.exeattrib.exe

pid process

4916 attrib.exe
400 attrib.exe

pid	process
4004	AdlingV4.6.exe
3996	result.exe
3076	result.exe
3716	Drivers.exe

pid	process
4916	attrib.exe
400	attrib.exe

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

Processes:

result.exeresult.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	result.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	result.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

System Information Discovery

Processes:

f695eb089d4a33afab87887b5779fe39c48e13594c6b3d76e01393eb36da886c.exeAdlingV4.6.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation	f695eb089d4a33afab87887b5779fe39c48e13594c6b3d76e01393eb36da886c.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation	AdlingV4.6.exe

Drops startup file 5 IoCs

Processes:

result.exeresult.exe

description	ioc	process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\result.exe	result.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\result.exe	result.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ufr_reports	result.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ufr_reports\NO_PWDS_report_02-10-2022_13-18-36-AB63D674EF6628918A8E0D24787F862B-HDGN.bin	result.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ufr_reports\NO_PWDS_report_02-10-2022_13-18-36-AB63D674EF6628918A8E0D24787F862B-HDGN.bin	result.exe

Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Reads local data of messenger clients 2 TTPs
Infostealers often target stored data of messaging applications, which can include saved credentials and account information.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Windows security modification 2 TTPs 2 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

Processes:

Drivers.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	Drivers.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	Drivers.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

Processes:

AdlingV4.6.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\System32\\Drivers.exe"	AdlingV4.6.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

Processes:

result.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	result.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	result.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	result.exe

Suspicious behavior: EnumeratesProcesses 18 IoCs

Processes:

result.exeresult.exe

pid	process
3996	result.exe
3996	result.exe
3996	result.exe
3996	result.exe
3996	result.exe
3996	result.exe
3076	result.exe
3076	result.exe
3076	result.exe
3076	result.exe
3076	result.exe
3076	result.exe
3076	result.exe
3076	result.exe
3076	result.exe
3076	result.exe
3076	result.exe
3076	result.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

Drivers.exe

pid process

3716 Drivers.exe

pid	process
3716	Drivers.exe

Suspicious use of AdjustPrivilegeToken 48 IoCs

Processes:

AdlingV4.6.exeDrivers.exe

description	pid	process
Token: SeIncreaseQuotaPrivilege	4004	AdlingV4.6.exe
Token: SeSecurityPrivilege	4004	AdlingV4.6.exe
Token: SeTakeOwnershipPrivilege	4004	AdlingV4.6.exe
Token: SeLoadDriverPrivilege	4004	AdlingV4.6.exe
Token: SeSystemProfilePrivilege	4004	AdlingV4.6.exe
Token: SeSystemtimePrivilege	4004	AdlingV4.6.exe
Token: SeProfSingleProcessPrivilege	4004	AdlingV4.6.exe
Token: SeIncBasePriorityPrivilege	4004	AdlingV4.6.exe
Token: SeCreatePagefilePrivilege	4004	AdlingV4.6.exe
Token: SeBackupPrivilege	4004	AdlingV4.6.exe
Token: SeRestorePrivilege	4004	AdlingV4.6.exe
Token: SeShutdownPrivilege	4004	AdlingV4.6.exe
Token: SeDebugPrivilege	4004	AdlingV4.6.exe
Token: SeSystemEnvironmentPrivilege	4004	AdlingV4.6.exe
Token: SeChangeNotifyPrivilege	4004	AdlingV4.6.exe
Token: SeRemoteShutdownPrivilege	4004	AdlingV4.6.exe
Token: SeUndockPrivilege	4004	AdlingV4.6.exe
Token: SeManageVolumePrivilege	4004	AdlingV4.6.exe
Token: SeImpersonatePrivilege	4004	AdlingV4.6.exe
Token: SeCreateGlobalPrivilege	4004	AdlingV4.6.exe
Token: 33	4004	AdlingV4.6.exe
Token: 34	4004	AdlingV4.6.exe
Token: 35	4004	AdlingV4.6.exe
Token: 36	4004	AdlingV4.6.exe
Token: SeIncreaseQuotaPrivilege	3716	Drivers.exe
Token: SeSecurityPrivilege	3716	Drivers.exe
Token: SeTakeOwnershipPrivilege	3716	Drivers.exe
Token: SeLoadDriverPrivilege	3716	Drivers.exe
Token: SeSystemProfilePrivilege	3716	Drivers.exe
Token: SeSystemtimePrivilege	3716	Drivers.exe
Token: SeProfSingleProcessPrivilege	3716	Drivers.exe
Token: SeIncBasePriorityPrivilege	3716	Drivers.exe
Token: SeCreatePagefilePrivilege	3716	Drivers.exe
Token: SeBackupPrivilege	3716	Drivers.exe
Token: SeRestorePrivilege	3716	Drivers.exe
Token: SeShutdownPrivilege	3716	Drivers.exe
Token: SeDebugPrivilege	3716	Drivers.exe
Token: SeSystemEnvironmentPrivilege	3716	Drivers.exe
Token: SeChangeNotifyPrivilege	3716	Drivers.exe
Token: SeRemoteShutdownPrivilege	3716	Drivers.exe
Token: SeUndockPrivilege	3716	Drivers.exe
Token: SeManageVolumePrivilege	3716	Drivers.exe
Token: SeImpersonatePrivilege	3716	Drivers.exe
Token: SeCreateGlobalPrivilege	3716	Drivers.exe
Token: 33	3716	Drivers.exe
Token: 34	3716	Drivers.exe
Token: 35	3716	Drivers.exe
Token: 36	3716	Drivers.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

Drivers.exe

pid process

3716 Drivers.exe

pid	process
3716	Drivers.exe

Suspicious use of WriteProcessMemory 46 IoCs

Processes:

f695eb089d4a33afab87887b5779fe39c48e13594c6b3d76e01393eb36da886c.exeresult.exeAdlingV4.6.execmd.execmd.exeDrivers.exe

description	pid	process	target process
PID 4892 wrote to memory of 4004	4892	f695eb089d4a33afab87887b5779fe39c48e13594c6b3d76e01393eb36da886c.exe	AdlingV4.6.exe
PID 4892 wrote to memory of 4004	4892	f695eb089d4a33afab87887b5779fe39c48e13594c6b3d76e01393eb36da886c.exe	AdlingV4.6.exe
PID 4892 wrote to memory of 4004	4892	f695eb089d4a33afab87887b5779fe39c48e13594c6b3d76e01393eb36da886c.exe	AdlingV4.6.exe
PID 4892 wrote to memory of 3996	4892	f695eb089d4a33afab87887b5779fe39c48e13594c6b3d76e01393eb36da886c.exe	result.exe
PID 4892 wrote to memory of 3996	4892	f695eb089d4a33afab87887b5779fe39c48e13594c6b3d76e01393eb36da886c.exe	result.exe
PID 4892 wrote to memory of 3996	4892	f695eb089d4a33afab87887b5779fe39c48e13594c6b3d76e01393eb36da886c.exe	result.exe
PID 3996 wrote to memory of 3076	3996	result.exe	result.exe
PID 3996 wrote to memory of 3076	3996	result.exe	result.exe
PID 3996 wrote to memory of 3076	3996	result.exe	result.exe
PID 4004 wrote to memory of 5056	4004	AdlingV4.6.exe	cmd.exe
PID 4004 wrote to memory of 5056	4004	AdlingV4.6.exe	cmd.exe
PID 4004 wrote to memory of 5056	4004	AdlingV4.6.exe	cmd.exe
PID 4004 wrote to memory of 1496	4004	AdlingV4.6.exe	cmd.exe
PID 4004 wrote to memory of 1496	4004	AdlingV4.6.exe	cmd.exe
PID 4004 wrote to memory of 1496	4004	AdlingV4.6.exe	cmd.exe
PID 4004 wrote to memory of 3716	4004	AdlingV4.6.exe	Drivers.exe
PID 4004 wrote to memory of 3716	4004	AdlingV4.6.exe	Drivers.exe
PID 4004 wrote to memory of 3716	4004	AdlingV4.6.exe	Drivers.exe
PID 5056 wrote to memory of 4916	5056	cmd.exe	attrib.exe
PID 5056 wrote to memory of 4916	5056	cmd.exe	attrib.exe
PID 5056 wrote to memory of 4916	5056	cmd.exe	attrib.exe
PID 1496 wrote to memory of 400	1496	cmd.exe	attrib.exe
PID 1496 wrote to memory of 400	1496	cmd.exe	attrib.exe
PID 1496 wrote to memory of 400	1496	cmd.exe	attrib.exe
PID 3716 wrote to memory of 2340	3716	Drivers.exe	notepad.exe
PID 3716 wrote to memory of 2340	3716	Drivers.exe	notepad.exe
PID 3716 wrote to memory of 2340	3716	Drivers.exe	notepad.exe
PID 3716 wrote to memory of 2340	3716	Drivers.exe	notepad.exe
PID 3716 wrote to memory of 2340	3716	Drivers.exe	notepad.exe
PID 3716 wrote to memory of 2340	3716	Drivers.exe	notepad.exe
PID 3716 wrote to memory of 2340	3716	Drivers.exe	notepad.exe
PID 3716 wrote to memory of 2340	3716	Drivers.exe	notepad.exe
PID 3716 wrote to memory of 2340	3716	Drivers.exe	notepad.exe
PID 3716 wrote to memory of 2340	3716	Drivers.exe	notepad.exe
PID 3716 wrote to memory of 2340	3716	Drivers.exe	notepad.exe
PID 3716 wrote to memory of 2340	3716	Drivers.exe	notepad.exe
PID 3716 wrote to memory of 2340	3716	Drivers.exe	notepad.exe
PID 3716 wrote to memory of 2340	3716	Drivers.exe	notepad.exe
PID 3716 wrote to memory of 2340	3716	Drivers.exe	notepad.exe
PID 3716 wrote to memory of 2340	3716	Drivers.exe	notepad.exe
PID 3716 wrote to memory of 2340	3716	Drivers.exe	notepad.exe
PID 3716 wrote to memory of 2340	3716	Drivers.exe	notepad.exe
PID 3716 wrote to memory of 2340	3716	Drivers.exe	notepad.exe
PID 3716 wrote to memory of 2340	3716	Drivers.exe	notepad.exe
PID 3716 wrote to memory of 2340	3716	Drivers.exe	notepad.exe
PID 3716 wrote to memory of 2340	3716	Drivers.exe	notepad.exe

System policy modification 1 TTPs 3 IoCs

evasion

Modify Registry

Processes:

Drivers.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\CurrentVersion	Drivers.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\CurrentVersion\Explorern	Drivers.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\CurrentVersion\Explorern\NoControlPanel = "1"	Drivers.exe

Views/modifies file attributes 1 TTPs 2 IoCs
evasion

Hidden Files and Directories
T1158

Processes:

attrib.exeattrib.exe

pid process

4916 attrib.exe
400 attrib.exe

pid	process
4916	attrib.exe
400	attrib.exe

C:\Users\Admin\AppData\Local\Temp\f695eb089d4a33afab87887b5779fe39c48e13594c6b3d76e01393eb36da886c.exe
"C:\Users\Admin\AppData\Local\Temp\f695eb089d4a33afab87887b5779fe39c48e13594c6b3d76e01393eb36da886c.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4892

C:\Users\Admin\AppData\Local\Temp\AdlingV4.6.exe
"C:\Users\Admin\AppData\Local\Temp\AdlingV4.6.exe"
2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Checks computer location settings
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4004

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp\AdlingV4.6.exe" +s +h
3⤵
- Suspicious use of WriteProcessMemory
PID:5056

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Users\Admin\AppData\Local\Temp\AdlingV4.6.exe" +s +h
4⤵
- Sets file to hidden
- Views/modifies file attributes
PID:4916

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp" +s +h
3⤵
- Suspicious use of WriteProcessMemory
PID:1496

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Users\Admin\AppData\Local\Temp" +s +h
4⤵
- Sets file to hidden
- Views/modifies file attributes
PID:400

C:\ProgramData\Microsoft\Windows\Start Menu\System32\Drivers.exe
"C:\ProgramData\Microsoft\Windows\Start Menu\System32\Drivers.exe"
3⤵
- Modifies firewall policy service
- Modifies security service
- Windows security bypass
- Disables RegEdit via registry modification
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:3716

C:\Windows\SysWOW64\notepad.exe
notepad
4⤵
PID:2340

C:\Users\Admin\AppData\Local\Temp\result.exe
"C:\Users\Admin\AppData\Local\Temp\result.exe"
2⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Drops startup file
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3996

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\result.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\result.exe"
3⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Drops startup file
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
PID:3076

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Winlogon Helper DLL

T1004

Modify Existing Service

T1031

Hidden Files and Directories

T1158

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

Disabling Security Tools

T1089

Hidden Files and Directories

T1158

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

System Information Discovery