Analysis
-
max time kernel
151s -
max time network
48s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
03-10-2022 02:17
Static task
static1
Behavioral task
behavioral1
Sample
3ddb383a5af8acedb8eda67932633d85a881739fbf9a87b10f664fe743b48c58.exe
Resource
win7-20220812-en
General
-
Target
3ddb383a5af8acedb8eda67932633d85a881739fbf9a87b10f664fe743b48c58.exe
-
Size
546KB
-
MD5
3ed968b2400a5eca52fcf8dc1422ece0
-
SHA1
10cc685424f274c7b42d26cacf7ad2319fe56000
-
SHA256
3ddb383a5af8acedb8eda67932633d85a881739fbf9a87b10f664fe743b48c58
-
SHA512
e4260b501b476c613a121940de346e9d3d120329404b19a0d6d15862051358698de5528715369c8094b8934661d11afda4176fbf01fed318280f66e04591e92d
-
SSDEEP
6144:yJanGOkb7CaMWBe/IMr0yRu7ZcUBpofb71/cJlClb:y+G2WBqxgN7ZcUBGfb5/cJlCh
Malware Config
Extracted
darkcomet
Guest16
nonalova.no-ip.org:82
DC_MUTEX-Q0QWMJU
-
InstallPath
adobe\adobeARM.exe
-
gencode
GNFv06aHFX6N
-
install
true
-
offline_keylogger
true
-
persistence
false
-
reg_key
adobeARM
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
Processes:
3ddb383a5af8acedb8eda67932633d85a881739fbf9a87b10f664fe743b48c58.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Users\\Admin\\AppData\\Roaming\\adobe\\adobeARM.exe" 3ddb383a5af8acedb8eda67932633d85a881739fbf9a87b10f664fe743b48c58.exe -
Executes dropped EXE 2 IoCs
Processes:
adobeARM.exeadobeARM.exepid process 980 adobeARM.exe 2016 adobeARM.exe -
Processes:
resource yara_rule behavioral1/memory/1684-55-0x0000000000400000-0x00000000004B7000-memory.dmp upx behavioral1/memory/1684-57-0x0000000000400000-0x00000000004B7000-memory.dmp upx behavioral1/memory/1684-60-0x0000000000400000-0x00000000004B7000-memory.dmp upx behavioral1/memory/1684-58-0x0000000000400000-0x00000000004B7000-memory.dmp upx behavioral1/memory/1684-62-0x0000000000400000-0x00000000004B7000-memory.dmp upx behavioral1/memory/1684-64-0x0000000000400000-0x00000000004B7000-memory.dmp upx behavioral1/memory/1684-65-0x0000000000400000-0x00000000004B7000-memory.dmp upx behavioral1/memory/2016-86-0x0000000000400000-0x00000000004B7000-memory.dmp upx behavioral1/memory/2016-87-0x0000000000400000-0x00000000004B7000-memory.dmp upx -
Loads dropped DLL 5 IoCs
Processes:
3ddb383a5af8acedb8eda67932633d85a881739fbf9a87b10f664fe743b48c58.exeWerFault.exepid process 1684 3ddb383a5af8acedb8eda67932633d85a881739fbf9a87b10f664fe743b48c58.exe 1684 3ddb383a5af8acedb8eda67932633d85a881739fbf9a87b10f664fe743b48c58.exe 1692 WerFault.exe 1692 WerFault.exe 1692 WerFault.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
3ddb383a5af8acedb8eda67932633d85a881739fbf9a87b10f664fe743b48c58.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\adobeARM = "C:\\Users\\Admin\\AppData\\Roaming\\adobe\\adobeARM.exe" 3ddb383a5af8acedb8eda67932633d85a881739fbf9a87b10f664fe743b48c58.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
3ddb383a5af8acedb8eda67932633d85a881739fbf9a87b10f664fe743b48c58.exeadobeARM.exedescription pid process target process PID 288 set thread context of 1684 288 3ddb383a5af8acedb8eda67932633d85a881739fbf9a87b10f664fe743b48c58.exe 3ddb383a5af8acedb8eda67932633d85a881739fbf9a87b10f664fe743b48c58.exe PID 980 set thread context of 2016 980 adobeARM.exe adobeARM.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 2 IoCs
Processes:
WerFault.exeWerFault.exepid pid_target process target process 1236 288 WerFault.exe 3ddb383a5af8acedb8eda67932633d85a881739fbf9a87b10f664fe743b48c58.exe 1692 980 WerFault.exe adobeARM.exe -
Suspicious use of AdjustPrivilegeToken 46 IoCs
Processes:
3ddb383a5af8acedb8eda67932633d85a881739fbf9a87b10f664fe743b48c58.exeadobeARM.exedescription pid process Token: SeIncreaseQuotaPrivilege 1684 3ddb383a5af8acedb8eda67932633d85a881739fbf9a87b10f664fe743b48c58.exe Token: SeSecurityPrivilege 1684 3ddb383a5af8acedb8eda67932633d85a881739fbf9a87b10f664fe743b48c58.exe Token: SeTakeOwnershipPrivilege 1684 3ddb383a5af8acedb8eda67932633d85a881739fbf9a87b10f664fe743b48c58.exe Token: SeLoadDriverPrivilege 1684 3ddb383a5af8acedb8eda67932633d85a881739fbf9a87b10f664fe743b48c58.exe Token: SeSystemProfilePrivilege 1684 3ddb383a5af8acedb8eda67932633d85a881739fbf9a87b10f664fe743b48c58.exe Token: SeSystemtimePrivilege 1684 3ddb383a5af8acedb8eda67932633d85a881739fbf9a87b10f664fe743b48c58.exe Token: SeProfSingleProcessPrivilege 1684 3ddb383a5af8acedb8eda67932633d85a881739fbf9a87b10f664fe743b48c58.exe Token: SeIncBasePriorityPrivilege 1684 3ddb383a5af8acedb8eda67932633d85a881739fbf9a87b10f664fe743b48c58.exe Token: SeCreatePagefilePrivilege 1684 3ddb383a5af8acedb8eda67932633d85a881739fbf9a87b10f664fe743b48c58.exe Token: SeBackupPrivilege 1684 3ddb383a5af8acedb8eda67932633d85a881739fbf9a87b10f664fe743b48c58.exe Token: SeRestorePrivilege 1684 3ddb383a5af8acedb8eda67932633d85a881739fbf9a87b10f664fe743b48c58.exe Token: SeShutdownPrivilege 1684 3ddb383a5af8acedb8eda67932633d85a881739fbf9a87b10f664fe743b48c58.exe Token: SeDebugPrivilege 1684 3ddb383a5af8acedb8eda67932633d85a881739fbf9a87b10f664fe743b48c58.exe Token: SeSystemEnvironmentPrivilege 1684 3ddb383a5af8acedb8eda67932633d85a881739fbf9a87b10f664fe743b48c58.exe Token: SeChangeNotifyPrivilege 1684 3ddb383a5af8acedb8eda67932633d85a881739fbf9a87b10f664fe743b48c58.exe Token: SeRemoteShutdownPrivilege 1684 3ddb383a5af8acedb8eda67932633d85a881739fbf9a87b10f664fe743b48c58.exe Token: SeUndockPrivilege 1684 3ddb383a5af8acedb8eda67932633d85a881739fbf9a87b10f664fe743b48c58.exe Token: SeManageVolumePrivilege 1684 3ddb383a5af8acedb8eda67932633d85a881739fbf9a87b10f664fe743b48c58.exe Token: SeImpersonatePrivilege 1684 3ddb383a5af8acedb8eda67932633d85a881739fbf9a87b10f664fe743b48c58.exe Token: SeCreateGlobalPrivilege 1684 3ddb383a5af8acedb8eda67932633d85a881739fbf9a87b10f664fe743b48c58.exe Token: 33 1684 3ddb383a5af8acedb8eda67932633d85a881739fbf9a87b10f664fe743b48c58.exe Token: 34 1684 3ddb383a5af8acedb8eda67932633d85a881739fbf9a87b10f664fe743b48c58.exe Token: 35 1684 3ddb383a5af8acedb8eda67932633d85a881739fbf9a87b10f664fe743b48c58.exe Token: SeIncreaseQuotaPrivilege 2016 adobeARM.exe Token: SeSecurityPrivilege 2016 adobeARM.exe Token: SeTakeOwnershipPrivilege 2016 adobeARM.exe Token: SeLoadDriverPrivilege 2016 adobeARM.exe Token: SeSystemProfilePrivilege 2016 adobeARM.exe Token: SeSystemtimePrivilege 2016 adobeARM.exe Token: SeProfSingleProcessPrivilege 2016 adobeARM.exe Token: SeIncBasePriorityPrivilege 2016 adobeARM.exe Token: SeCreatePagefilePrivilege 2016 adobeARM.exe Token: SeBackupPrivilege 2016 adobeARM.exe Token: SeRestorePrivilege 2016 adobeARM.exe Token: SeShutdownPrivilege 2016 adobeARM.exe Token: SeDebugPrivilege 2016 adobeARM.exe Token: SeSystemEnvironmentPrivilege 2016 adobeARM.exe Token: SeChangeNotifyPrivilege 2016 adobeARM.exe Token: SeRemoteShutdownPrivilege 2016 adobeARM.exe Token: SeUndockPrivilege 2016 adobeARM.exe Token: SeManageVolumePrivilege 2016 adobeARM.exe Token: SeImpersonatePrivilege 2016 adobeARM.exe Token: SeCreateGlobalPrivilege 2016 adobeARM.exe Token: 33 2016 adobeARM.exe Token: 34 2016 adobeARM.exe Token: 35 2016 adobeARM.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
adobeARM.exepid process 2016 adobeARM.exe -
Suspicious use of WriteProcessMemory 28 IoCs
Processes:
3ddb383a5af8acedb8eda67932633d85a881739fbf9a87b10f664fe743b48c58.exe3ddb383a5af8acedb8eda67932633d85a881739fbf9a87b10f664fe743b48c58.exeadobeARM.exedescription pid process target process PID 288 wrote to memory of 1684 288 3ddb383a5af8acedb8eda67932633d85a881739fbf9a87b10f664fe743b48c58.exe 3ddb383a5af8acedb8eda67932633d85a881739fbf9a87b10f664fe743b48c58.exe PID 288 wrote to memory of 1684 288 3ddb383a5af8acedb8eda67932633d85a881739fbf9a87b10f664fe743b48c58.exe 3ddb383a5af8acedb8eda67932633d85a881739fbf9a87b10f664fe743b48c58.exe PID 288 wrote to memory of 1684 288 3ddb383a5af8acedb8eda67932633d85a881739fbf9a87b10f664fe743b48c58.exe 3ddb383a5af8acedb8eda67932633d85a881739fbf9a87b10f664fe743b48c58.exe PID 288 wrote to memory of 1684 288 3ddb383a5af8acedb8eda67932633d85a881739fbf9a87b10f664fe743b48c58.exe 3ddb383a5af8acedb8eda67932633d85a881739fbf9a87b10f664fe743b48c58.exe PID 288 wrote to memory of 1684 288 3ddb383a5af8acedb8eda67932633d85a881739fbf9a87b10f664fe743b48c58.exe 3ddb383a5af8acedb8eda67932633d85a881739fbf9a87b10f664fe743b48c58.exe PID 288 wrote to memory of 1684 288 3ddb383a5af8acedb8eda67932633d85a881739fbf9a87b10f664fe743b48c58.exe 3ddb383a5af8acedb8eda67932633d85a881739fbf9a87b10f664fe743b48c58.exe PID 288 wrote to memory of 1684 288 3ddb383a5af8acedb8eda67932633d85a881739fbf9a87b10f664fe743b48c58.exe 3ddb383a5af8acedb8eda67932633d85a881739fbf9a87b10f664fe743b48c58.exe PID 288 wrote to memory of 1684 288 3ddb383a5af8acedb8eda67932633d85a881739fbf9a87b10f664fe743b48c58.exe 3ddb383a5af8acedb8eda67932633d85a881739fbf9a87b10f664fe743b48c58.exe PID 288 wrote to memory of 1236 288 3ddb383a5af8acedb8eda67932633d85a881739fbf9a87b10f664fe743b48c58.exe WerFault.exe PID 288 wrote to memory of 1236 288 3ddb383a5af8acedb8eda67932633d85a881739fbf9a87b10f664fe743b48c58.exe WerFault.exe PID 288 wrote to memory of 1236 288 3ddb383a5af8acedb8eda67932633d85a881739fbf9a87b10f664fe743b48c58.exe WerFault.exe PID 288 wrote to memory of 1236 288 3ddb383a5af8acedb8eda67932633d85a881739fbf9a87b10f664fe743b48c58.exe WerFault.exe PID 1684 wrote to memory of 980 1684 3ddb383a5af8acedb8eda67932633d85a881739fbf9a87b10f664fe743b48c58.exe adobeARM.exe PID 1684 wrote to memory of 980 1684 3ddb383a5af8acedb8eda67932633d85a881739fbf9a87b10f664fe743b48c58.exe adobeARM.exe PID 1684 wrote to memory of 980 1684 3ddb383a5af8acedb8eda67932633d85a881739fbf9a87b10f664fe743b48c58.exe adobeARM.exe PID 1684 wrote to memory of 980 1684 3ddb383a5af8acedb8eda67932633d85a881739fbf9a87b10f664fe743b48c58.exe adobeARM.exe PID 980 wrote to memory of 2016 980 adobeARM.exe adobeARM.exe PID 980 wrote to memory of 2016 980 adobeARM.exe adobeARM.exe PID 980 wrote to memory of 2016 980 adobeARM.exe adobeARM.exe PID 980 wrote to memory of 2016 980 adobeARM.exe adobeARM.exe PID 980 wrote to memory of 2016 980 adobeARM.exe adobeARM.exe PID 980 wrote to memory of 2016 980 adobeARM.exe adobeARM.exe PID 980 wrote to memory of 2016 980 adobeARM.exe adobeARM.exe PID 980 wrote to memory of 2016 980 adobeARM.exe adobeARM.exe PID 980 wrote to memory of 1692 980 adobeARM.exe WerFault.exe PID 980 wrote to memory of 1692 980 adobeARM.exe WerFault.exe PID 980 wrote to memory of 1692 980 adobeARM.exe WerFault.exe PID 980 wrote to memory of 1692 980 adobeARM.exe WerFault.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\3ddb383a5af8acedb8eda67932633d85a881739fbf9a87b10f664fe743b48c58.exe"C:\Users\Admin\AppData\Local\Temp\3ddb383a5af8acedb8eda67932633d85a881739fbf9a87b10f664fe743b48c58.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\3ddb383a5af8acedb8eda67932633d85a881739fbf9a87b10f664fe743b48c58.exeC:\Users\Admin\AppData\Local\Temp\3ddb383a5af8acedb8eda67932633d85a881739fbf9a87b10f664fe743b48c58.exe2⤵
- Modifies WinLogon for persistence
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\adobe\adobeARM.exe"C:\Users\Admin\AppData\Roaming\adobe\adobeARM.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 980 -s 924⤵
- Loads dropped DLL
- Program crash
-
C:\Users\Admin\AppData\Roaming\adobe\adobeARM.exeC:\Users\Admin\AppData\Roaming\adobe\adobeARM.exe4⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 288 -s 922⤵
- Program crash
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\Adobe\adobeARM.exeFilesize
546KB
MD53ed968b2400a5eca52fcf8dc1422ece0
SHA110cc685424f274c7b42d26cacf7ad2319fe56000
SHA2563ddb383a5af8acedb8eda67932633d85a881739fbf9a87b10f664fe743b48c58
SHA512e4260b501b476c613a121940de346e9d3d120329404b19a0d6d15862051358698de5528715369c8094b8934661d11afda4176fbf01fed318280f66e04591e92d
-
C:\Users\Admin\AppData\Roaming\Adobe\adobeARM.exeFilesize
546KB
MD53ed968b2400a5eca52fcf8dc1422ece0
SHA110cc685424f274c7b42d26cacf7ad2319fe56000
SHA2563ddb383a5af8acedb8eda67932633d85a881739fbf9a87b10f664fe743b48c58
SHA512e4260b501b476c613a121940de346e9d3d120329404b19a0d6d15862051358698de5528715369c8094b8934661d11afda4176fbf01fed318280f66e04591e92d
-
C:\Users\Admin\AppData\Roaming\adobe\adobeARM.exeFilesize
546KB
MD53ed968b2400a5eca52fcf8dc1422ece0
SHA110cc685424f274c7b42d26cacf7ad2319fe56000
SHA2563ddb383a5af8acedb8eda67932633d85a881739fbf9a87b10f664fe743b48c58
SHA512e4260b501b476c613a121940de346e9d3d120329404b19a0d6d15862051358698de5528715369c8094b8934661d11afda4176fbf01fed318280f66e04591e92d
-
\Users\Admin\AppData\Roaming\Adobe\adobeARM.exeFilesize
546KB
MD53ed968b2400a5eca52fcf8dc1422ece0
SHA110cc685424f274c7b42d26cacf7ad2319fe56000
SHA2563ddb383a5af8acedb8eda67932633d85a881739fbf9a87b10f664fe743b48c58
SHA512e4260b501b476c613a121940de346e9d3d120329404b19a0d6d15862051358698de5528715369c8094b8934661d11afda4176fbf01fed318280f66e04591e92d
-
\Users\Admin\AppData\Roaming\Adobe\adobeARM.exeFilesize
546KB
MD53ed968b2400a5eca52fcf8dc1422ece0
SHA110cc685424f274c7b42d26cacf7ad2319fe56000
SHA2563ddb383a5af8acedb8eda67932633d85a881739fbf9a87b10f664fe743b48c58
SHA512e4260b501b476c613a121940de346e9d3d120329404b19a0d6d15862051358698de5528715369c8094b8934661d11afda4176fbf01fed318280f66e04591e92d
-
\Users\Admin\AppData\Roaming\Adobe\adobeARM.exeFilesize
546KB
MD53ed968b2400a5eca52fcf8dc1422ece0
SHA110cc685424f274c7b42d26cacf7ad2319fe56000
SHA2563ddb383a5af8acedb8eda67932633d85a881739fbf9a87b10f664fe743b48c58
SHA512e4260b501b476c613a121940de346e9d3d120329404b19a0d6d15862051358698de5528715369c8094b8934661d11afda4176fbf01fed318280f66e04591e92d
-
\Users\Admin\AppData\Roaming\Adobe\adobeARM.exeFilesize
546KB
MD53ed968b2400a5eca52fcf8dc1422ece0
SHA110cc685424f274c7b42d26cacf7ad2319fe56000
SHA2563ddb383a5af8acedb8eda67932633d85a881739fbf9a87b10f664fe743b48c58
SHA512e4260b501b476c613a121940de346e9d3d120329404b19a0d6d15862051358698de5528715369c8094b8934661d11afda4176fbf01fed318280f66e04591e92d
-
\Users\Admin\AppData\Roaming\Adobe\adobeARM.exeFilesize
546KB
MD53ed968b2400a5eca52fcf8dc1422ece0
SHA110cc685424f274c7b42d26cacf7ad2319fe56000
SHA2563ddb383a5af8acedb8eda67932633d85a881739fbf9a87b10f664fe743b48c58
SHA512e4260b501b476c613a121940de346e9d3d120329404b19a0d6d15862051358698de5528715369c8094b8934661d11afda4176fbf01fed318280f66e04591e92d
-
memory/980-68-0x0000000000000000-mapping.dmp
-
memory/1236-63-0x0000000000000000-mapping.dmp
-
memory/1684-59-0x00000000004B5770-mapping.dmp
-
memory/1684-57-0x0000000000400000-0x00000000004B7000-memory.dmpFilesize
732KB
-
memory/1684-54-0x0000000000400000-0x00000000004B7000-memory.dmpFilesize
732KB
-
memory/1684-62-0x0000000000400000-0x00000000004B7000-memory.dmpFilesize
732KB
-
memory/1684-58-0x0000000000400000-0x00000000004B7000-memory.dmpFilesize
732KB
-
memory/1684-64-0x0000000000400000-0x00000000004B7000-memory.dmpFilesize
732KB
-
memory/1684-55-0x0000000000400000-0x00000000004B7000-memory.dmpFilesize
732KB
-
memory/1684-65-0x0000000000400000-0x00000000004B7000-memory.dmpFilesize
732KB
-
memory/1684-60-0x0000000000400000-0x00000000004B7000-memory.dmpFilesize
732KB
-
memory/1684-61-0x0000000075B11000-0x0000000075B13000-memory.dmpFilesize
8KB
-
memory/1692-78-0x0000000000000000-mapping.dmp
-
memory/2016-76-0x00000000004B5770-mapping.dmp
-
memory/2016-86-0x0000000000400000-0x00000000004B7000-memory.dmpFilesize
732KB
-
memory/2016-87-0x0000000000400000-0x00000000004B7000-memory.dmpFilesize
732KB