Analysis
-
max time kernel
187s -
max time network
191s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
02-10-2022 15:17
Static task
static1
Behavioral task
behavioral1
Sample
b4be38b3664ef15f0af7f2950d67f98d3d0df24e2b8c773234f57e8643b18f49.exe
Resource
win7-20220812-en
General
-
Target
b4be38b3664ef15f0af7f2950d67f98d3d0df24e2b8c773234f57e8643b18f49.exe
-
Size
236KB
-
MD5
4b710b5bd28868d214cda1d833f31540
-
SHA1
07dae9211259c29e71c6d60861c835f8d394c53f
-
SHA256
b4be38b3664ef15f0af7f2950d67f98d3d0df24e2b8c773234f57e8643b18f49
-
SHA512
e051e9c3a76eadcce7d3b6e7912ae8c237e7f910a23092d1d4b9f500d38d000142ff16437458d8d56e3f5fc466e68a6f4a90ad4325ec362d4d8f33ba6ecc11b8
-
SSDEEP
6144:h2FlTbH2NlvjzQXioDEctIV2zg7vbbmsf+e:h2FRbWNiioDbtO2zg7vbbbWe
Malware Config
Extracted
darkcomet
Zombie
y29kzv93yxjfnta5.no-ip.org:10
code_war_509
-
gencode
ZwamCGdDepco
-
install
false
-
offline_keylogger
true
-
persistence
false
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of AdjustPrivilegeToken 24 IoCs
Processes:
b4be38b3664ef15f0af7f2950d67f98d3d0df24e2b8c773234f57e8643b18f49.exedescription pid process Token: SeIncreaseQuotaPrivilege 4328 b4be38b3664ef15f0af7f2950d67f98d3d0df24e2b8c773234f57e8643b18f49.exe Token: SeSecurityPrivilege 4328 b4be38b3664ef15f0af7f2950d67f98d3d0df24e2b8c773234f57e8643b18f49.exe Token: SeTakeOwnershipPrivilege 4328 b4be38b3664ef15f0af7f2950d67f98d3d0df24e2b8c773234f57e8643b18f49.exe Token: SeLoadDriverPrivilege 4328 b4be38b3664ef15f0af7f2950d67f98d3d0df24e2b8c773234f57e8643b18f49.exe Token: SeSystemProfilePrivilege 4328 b4be38b3664ef15f0af7f2950d67f98d3d0df24e2b8c773234f57e8643b18f49.exe Token: SeSystemtimePrivilege 4328 b4be38b3664ef15f0af7f2950d67f98d3d0df24e2b8c773234f57e8643b18f49.exe Token: SeProfSingleProcessPrivilege 4328 b4be38b3664ef15f0af7f2950d67f98d3d0df24e2b8c773234f57e8643b18f49.exe Token: SeIncBasePriorityPrivilege 4328 b4be38b3664ef15f0af7f2950d67f98d3d0df24e2b8c773234f57e8643b18f49.exe Token: SeCreatePagefilePrivilege 4328 b4be38b3664ef15f0af7f2950d67f98d3d0df24e2b8c773234f57e8643b18f49.exe Token: SeBackupPrivilege 4328 b4be38b3664ef15f0af7f2950d67f98d3d0df24e2b8c773234f57e8643b18f49.exe Token: SeRestorePrivilege 4328 b4be38b3664ef15f0af7f2950d67f98d3d0df24e2b8c773234f57e8643b18f49.exe Token: SeShutdownPrivilege 4328 b4be38b3664ef15f0af7f2950d67f98d3d0df24e2b8c773234f57e8643b18f49.exe Token: SeDebugPrivilege 4328 b4be38b3664ef15f0af7f2950d67f98d3d0df24e2b8c773234f57e8643b18f49.exe Token: SeSystemEnvironmentPrivilege 4328 b4be38b3664ef15f0af7f2950d67f98d3d0df24e2b8c773234f57e8643b18f49.exe Token: SeChangeNotifyPrivilege 4328 b4be38b3664ef15f0af7f2950d67f98d3d0df24e2b8c773234f57e8643b18f49.exe Token: SeRemoteShutdownPrivilege 4328 b4be38b3664ef15f0af7f2950d67f98d3d0df24e2b8c773234f57e8643b18f49.exe Token: SeUndockPrivilege 4328 b4be38b3664ef15f0af7f2950d67f98d3d0df24e2b8c773234f57e8643b18f49.exe Token: SeManageVolumePrivilege 4328 b4be38b3664ef15f0af7f2950d67f98d3d0df24e2b8c773234f57e8643b18f49.exe Token: SeImpersonatePrivilege 4328 b4be38b3664ef15f0af7f2950d67f98d3d0df24e2b8c773234f57e8643b18f49.exe Token: SeCreateGlobalPrivilege 4328 b4be38b3664ef15f0af7f2950d67f98d3d0df24e2b8c773234f57e8643b18f49.exe Token: 33 4328 b4be38b3664ef15f0af7f2950d67f98d3d0df24e2b8c773234f57e8643b18f49.exe Token: 34 4328 b4be38b3664ef15f0af7f2950d67f98d3d0df24e2b8c773234f57e8643b18f49.exe Token: 35 4328 b4be38b3664ef15f0af7f2950d67f98d3d0df24e2b8c773234f57e8643b18f49.exe Token: 36 4328 b4be38b3664ef15f0af7f2950d67f98d3d0df24e2b8c773234f57e8643b18f49.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
b4be38b3664ef15f0af7f2950d67f98d3d0df24e2b8c773234f57e8643b18f49.exepid process 4328 b4be38b3664ef15f0af7f2950d67f98d3d0df24e2b8c773234f57e8643b18f49.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\b4be38b3664ef15f0af7f2950d67f98d3d0df24e2b8c773234f57e8643b18f49.exe"C:\Users\Admin\AppData\Local\Temp\b4be38b3664ef15f0af7f2950d67f98d3d0df24e2b8c773234f57e8643b18f49.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx