Analysis
-
max time kernel
141s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
02-10-2022 12:15
Static task
static1
Behavioral task
behavioral1
Sample
ccc9396f0e4b7501d5a1e964ed76ce38cb933447ad1836956ecb56460cab9d63.exe
Resource
win7-20220901-en
General
-
Target
ccc9396f0e4b7501d5a1e964ed76ce38cb933447ad1836956ecb56460cab9d63.exe
-
Size
693KB
-
MD5
6de7cd0ab88ab2804c3406df023bb3a0
-
SHA1
edf82e682f3eed25b22755ae52226131d9ccaf66
-
SHA256
ccc9396f0e4b7501d5a1e964ed76ce38cb933447ad1836956ecb56460cab9d63
-
SHA512
2ac5d42ed2ba3282881e2df8afc59043793baad6499eea5fc7dc3ce4e650e986d8833a7eee541b29c74794edaff7ce1ae4630be6c95303687f5714055d0d5368
-
SSDEEP
12288:BZ8nw7Aaw+qphbSZmoTeBrp8pLKHxA/qnGIVuett6C63qGWKPMto3bybWBTBn/r:BZ8wEaL0oyBVSgJnGIVjGWFKbvn/r
Malware Config
Extracted
darkcomet
HackEd
net0.noip.me:1604
DC_MUTEX-TEWLSPF
-
InstallPath
Microsoft\windows\explorer.exe
-
gencode
J5KZ635fLizV
-
install
true
-
offline_keylogger
true
-
persistence
true
-
reg_key
Microsoft Windows
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
Processes:
ccc9396f0e4b7501d5a1e964ed76ce38cb933447ad1836956ecb56460cab9d63.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Users\\Admin\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Microsoft\\windows\\explorer.exe" ccc9396f0e4b7501d5a1e964ed76ce38cb933447ad1836956ecb56460cab9d63.exe -
Sets file to hidden 1 TTPs 2 IoCs
Modifies file attributes to stop it showing in Explorer etc.
Processes:
attrib.exeattrib.exepid process 4764 attrib.exe 4772 attrib.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
ccc9396f0e4b7501d5a1e964ed76ce38cb933447ad1836956ecb56460cab9d63.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation ccc9396f0e4b7501d5a1e964ed76ce38cb933447ad1836956ecb56460cab9d63.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
ccc9396f0e4b7501d5a1e964ed76ce38cb933447ad1836956ecb56460cab9d63.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Microsoft Windows = "C:\\Users\\Admin\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Microsoft\\windows\\explorer.exe" ccc9396f0e4b7501d5a1e964ed76ce38cb933447ad1836956ecb56460cab9d63.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Modifies registry class 1 IoCs
Processes:
ccc9396f0e4b7501d5a1e964ed76ce38cb933447ad1836956ecb56460cab9d63.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ ccc9396f0e4b7501d5a1e964ed76ce38cb933447ad1836956ecb56460cab9d63.exe -
Suspicious use of AdjustPrivilegeToken 24 IoCs
Processes:
ccc9396f0e4b7501d5a1e964ed76ce38cb933447ad1836956ecb56460cab9d63.exedescription pid process Token: SeIncreaseQuotaPrivilege 4172 ccc9396f0e4b7501d5a1e964ed76ce38cb933447ad1836956ecb56460cab9d63.exe Token: SeSecurityPrivilege 4172 ccc9396f0e4b7501d5a1e964ed76ce38cb933447ad1836956ecb56460cab9d63.exe Token: SeTakeOwnershipPrivilege 4172 ccc9396f0e4b7501d5a1e964ed76ce38cb933447ad1836956ecb56460cab9d63.exe Token: SeLoadDriverPrivilege 4172 ccc9396f0e4b7501d5a1e964ed76ce38cb933447ad1836956ecb56460cab9d63.exe Token: SeSystemProfilePrivilege 4172 ccc9396f0e4b7501d5a1e964ed76ce38cb933447ad1836956ecb56460cab9d63.exe Token: SeSystemtimePrivilege 4172 ccc9396f0e4b7501d5a1e964ed76ce38cb933447ad1836956ecb56460cab9d63.exe Token: SeProfSingleProcessPrivilege 4172 ccc9396f0e4b7501d5a1e964ed76ce38cb933447ad1836956ecb56460cab9d63.exe Token: SeIncBasePriorityPrivilege 4172 ccc9396f0e4b7501d5a1e964ed76ce38cb933447ad1836956ecb56460cab9d63.exe Token: SeCreatePagefilePrivilege 4172 ccc9396f0e4b7501d5a1e964ed76ce38cb933447ad1836956ecb56460cab9d63.exe Token: SeBackupPrivilege 4172 ccc9396f0e4b7501d5a1e964ed76ce38cb933447ad1836956ecb56460cab9d63.exe Token: SeRestorePrivilege 4172 ccc9396f0e4b7501d5a1e964ed76ce38cb933447ad1836956ecb56460cab9d63.exe Token: SeShutdownPrivilege 4172 ccc9396f0e4b7501d5a1e964ed76ce38cb933447ad1836956ecb56460cab9d63.exe Token: SeDebugPrivilege 4172 ccc9396f0e4b7501d5a1e964ed76ce38cb933447ad1836956ecb56460cab9d63.exe Token: SeSystemEnvironmentPrivilege 4172 ccc9396f0e4b7501d5a1e964ed76ce38cb933447ad1836956ecb56460cab9d63.exe Token: SeChangeNotifyPrivilege 4172 ccc9396f0e4b7501d5a1e964ed76ce38cb933447ad1836956ecb56460cab9d63.exe Token: SeRemoteShutdownPrivilege 4172 ccc9396f0e4b7501d5a1e964ed76ce38cb933447ad1836956ecb56460cab9d63.exe Token: SeUndockPrivilege 4172 ccc9396f0e4b7501d5a1e964ed76ce38cb933447ad1836956ecb56460cab9d63.exe Token: SeManageVolumePrivilege 4172 ccc9396f0e4b7501d5a1e964ed76ce38cb933447ad1836956ecb56460cab9d63.exe Token: SeImpersonatePrivilege 4172 ccc9396f0e4b7501d5a1e964ed76ce38cb933447ad1836956ecb56460cab9d63.exe Token: SeCreateGlobalPrivilege 4172 ccc9396f0e4b7501d5a1e964ed76ce38cb933447ad1836956ecb56460cab9d63.exe Token: 33 4172 ccc9396f0e4b7501d5a1e964ed76ce38cb933447ad1836956ecb56460cab9d63.exe Token: 34 4172 ccc9396f0e4b7501d5a1e964ed76ce38cb933447ad1836956ecb56460cab9d63.exe Token: 35 4172 ccc9396f0e4b7501d5a1e964ed76ce38cb933447ad1836956ecb56460cab9d63.exe Token: 36 4172 ccc9396f0e4b7501d5a1e964ed76ce38cb933447ad1836956ecb56460cab9d63.exe -
Suspicious use of WriteProcessMemory 29 IoCs
Processes:
ccc9396f0e4b7501d5a1e964ed76ce38cb933447ad1836956ecb56460cab9d63.execmd.execmd.exedescription pid process target process PID 4172 wrote to memory of 4680 4172 ccc9396f0e4b7501d5a1e964ed76ce38cb933447ad1836956ecb56460cab9d63.exe cmd.exe PID 4172 wrote to memory of 4680 4172 ccc9396f0e4b7501d5a1e964ed76ce38cb933447ad1836956ecb56460cab9d63.exe cmd.exe PID 4172 wrote to memory of 4680 4172 ccc9396f0e4b7501d5a1e964ed76ce38cb933447ad1836956ecb56460cab9d63.exe cmd.exe PID 4172 wrote to memory of 3996 4172 ccc9396f0e4b7501d5a1e964ed76ce38cb933447ad1836956ecb56460cab9d63.exe cmd.exe PID 4172 wrote to memory of 3996 4172 ccc9396f0e4b7501d5a1e964ed76ce38cb933447ad1836956ecb56460cab9d63.exe cmd.exe PID 4172 wrote to memory of 3996 4172 ccc9396f0e4b7501d5a1e964ed76ce38cb933447ad1836956ecb56460cab9d63.exe cmd.exe PID 4172 wrote to memory of 4500 4172 ccc9396f0e4b7501d5a1e964ed76ce38cb933447ad1836956ecb56460cab9d63.exe notepad.exe PID 4172 wrote to memory of 4500 4172 ccc9396f0e4b7501d5a1e964ed76ce38cb933447ad1836956ecb56460cab9d63.exe notepad.exe PID 4172 wrote to memory of 4500 4172 ccc9396f0e4b7501d5a1e964ed76ce38cb933447ad1836956ecb56460cab9d63.exe notepad.exe PID 4172 wrote to memory of 4500 4172 ccc9396f0e4b7501d5a1e964ed76ce38cb933447ad1836956ecb56460cab9d63.exe notepad.exe PID 4172 wrote to memory of 4500 4172 ccc9396f0e4b7501d5a1e964ed76ce38cb933447ad1836956ecb56460cab9d63.exe notepad.exe PID 4172 wrote to memory of 4500 4172 ccc9396f0e4b7501d5a1e964ed76ce38cb933447ad1836956ecb56460cab9d63.exe notepad.exe PID 4172 wrote to memory of 4500 4172 ccc9396f0e4b7501d5a1e964ed76ce38cb933447ad1836956ecb56460cab9d63.exe notepad.exe PID 4172 wrote to memory of 4500 4172 ccc9396f0e4b7501d5a1e964ed76ce38cb933447ad1836956ecb56460cab9d63.exe notepad.exe PID 4172 wrote to memory of 4500 4172 ccc9396f0e4b7501d5a1e964ed76ce38cb933447ad1836956ecb56460cab9d63.exe notepad.exe PID 4172 wrote to memory of 4500 4172 ccc9396f0e4b7501d5a1e964ed76ce38cb933447ad1836956ecb56460cab9d63.exe notepad.exe PID 4172 wrote to memory of 4500 4172 ccc9396f0e4b7501d5a1e964ed76ce38cb933447ad1836956ecb56460cab9d63.exe notepad.exe PID 4172 wrote to memory of 4500 4172 ccc9396f0e4b7501d5a1e964ed76ce38cb933447ad1836956ecb56460cab9d63.exe notepad.exe PID 4172 wrote to memory of 4500 4172 ccc9396f0e4b7501d5a1e964ed76ce38cb933447ad1836956ecb56460cab9d63.exe notepad.exe PID 4172 wrote to memory of 4500 4172 ccc9396f0e4b7501d5a1e964ed76ce38cb933447ad1836956ecb56460cab9d63.exe notepad.exe PID 4172 wrote to memory of 4500 4172 ccc9396f0e4b7501d5a1e964ed76ce38cb933447ad1836956ecb56460cab9d63.exe notepad.exe PID 4172 wrote to memory of 4500 4172 ccc9396f0e4b7501d5a1e964ed76ce38cb933447ad1836956ecb56460cab9d63.exe notepad.exe PID 4172 wrote to memory of 4500 4172 ccc9396f0e4b7501d5a1e964ed76ce38cb933447ad1836956ecb56460cab9d63.exe notepad.exe PID 4680 wrote to memory of 4772 4680 cmd.exe attrib.exe PID 4680 wrote to memory of 4772 4680 cmd.exe attrib.exe PID 4680 wrote to memory of 4772 4680 cmd.exe attrib.exe PID 3996 wrote to memory of 4764 3996 cmd.exe attrib.exe PID 3996 wrote to memory of 4764 3996 cmd.exe attrib.exe PID 3996 wrote to memory of 4764 3996 cmd.exe attrib.exe -
Views/modifies file attributes 1 TTPs 2 IoCs
Processes:
attrib.exeattrib.exepid process 4764 attrib.exe 4772 attrib.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\ccc9396f0e4b7501d5a1e964ed76ce38cb933447ad1836956ecb56460cab9d63.exe"C:\Users\Admin\AppData\Local\Temp\ccc9396f0e4b7501d5a1e964ed76ce38cb933447ad1836956ecb56460cab9d63.exe"1⤵
- Modifies WinLogon for persistence
- Checks computer location settings
- Adds Run key to start application
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp\ccc9396f0e4b7501d5a1e964ed76ce38cb933447ad1836956ecb56460cab9d63.exe" +s +h2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Users\Admin\AppData\Local\Temp\ccc9396f0e4b7501d5a1e964ed76ce38cb933447ad1836956ecb56460cab9d63.exe" +s +h3⤵
- Sets file to hidden
- Views/modifies file attributes
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp" +s +h2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Users\Admin\AppData\Local\Temp" +s +h3⤵
- Sets file to hidden
- Views/modifies file attributes
-
C:\Windows\SysWOW64\notepad.exenotepad2⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/3996-135-0x0000000000000000-mapping.dmp
-
memory/4172-132-0x0000000000400000-0x0000000000579000-memory.dmpFilesize
1.5MB
-
memory/4172-133-0x0000000000400000-0x0000000000579000-memory.dmpFilesize
1.5MB
-
memory/4172-139-0x0000000000400000-0x0000000000579000-memory.dmpFilesize
1.5MB
-
memory/4500-136-0x0000000000000000-mapping.dmp
-
memory/4680-134-0x0000000000000000-mapping.dmp
-
memory/4764-138-0x0000000000000000-mapping.dmp
-
memory/4772-137-0x0000000000000000-mapping.dmp