Analysis
-
max time kernel
155s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
03-10-2022 02:17
Static task
static1
Behavioral task
behavioral1
Sample
3ddb383a5af8acedb8eda67932633d85a881739fbf9a87b10f664fe743b48c58.exe
Resource
win7-20220812-en
General
-
Target
3ddb383a5af8acedb8eda67932633d85a881739fbf9a87b10f664fe743b48c58.exe
-
Size
546KB
-
MD5
3ed968b2400a5eca52fcf8dc1422ece0
-
SHA1
10cc685424f274c7b42d26cacf7ad2319fe56000
-
SHA256
3ddb383a5af8acedb8eda67932633d85a881739fbf9a87b10f664fe743b48c58
-
SHA512
e4260b501b476c613a121940de346e9d3d120329404b19a0d6d15862051358698de5528715369c8094b8934661d11afda4176fbf01fed318280f66e04591e92d
-
SSDEEP
6144:yJanGOkb7CaMWBe/IMr0yRu7ZcUBpofb71/cJlClb:y+G2WBqxgN7ZcUBGfb5/cJlCh
Malware Config
Extracted
darkcomet
Guest16
nonalova.no-ip.org:82
DC_MUTEX-Q0QWMJU
-
InstallPath
adobe\adobeARM.exe
-
gencode
GNFv06aHFX6N
-
install
true
-
offline_keylogger
true
-
persistence
false
-
reg_key
adobeARM
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
Processes:
3ddb383a5af8acedb8eda67932633d85a881739fbf9a87b10f664fe743b48c58.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Users\\Admin\\AppData\\Roaming\\adobe\\adobeARM.exe" 3ddb383a5af8acedb8eda67932633d85a881739fbf9a87b10f664fe743b48c58.exe -
Executes dropped EXE 2 IoCs
Processes:
adobeARM.exeadobeARM.exepid process 3044 adobeARM.exe 4052 adobeARM.exe -
Processes:
resource yara_rule behavioral2/memory/3340-133-0x0000000000400000-0x00000000004B7000-memory.dmp upx behavioral2/memory/3340-134-0x0000000000400000-0x00000000004B7000-memory.dmp upx behavioral2/memory/3340-135-0x0000000000400000-0x00000000004B7000-memory.dmp upx behavioral2/memory/3340-136-0x0000000000400000-0x00000000004B7000-memory.dmp upx behavioral2/memory/3340-137-0x0000000000400000-0x00000000004B7000-memory.dmp upx behavioral2/memory/3340-138-0x0000000000400000-0x00000000004B7000-memory.dmp upx behavioral2/memory/3340-148-0x0000000000400000-0x00000000004B7000-memory.dmp upx behavioral2/memory/4052-149-0x0000000000400000-0x00000000004B7000-memory.dmp upx behavioral2/memory/4052-150-0x0000000000400000-0x00000000004B7000-memory.dmp upx -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
3ddb383a5af8acedb8eda67932633d85a881739fbf9a87b10f664fe743b48c58.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation 3ddb383a5af8acedb8eda67932633d85a881739fbf9a87b10f664fe743b48c58.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
3ddb383a5af8acedb8eda67932633d85a881739fbf9a87b10f664fe743b48c58.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\adobeARM = "C:\\Users\\Admin\\AppData\\Roaming\\adobe\\adobeARM.exe" 3ddb383a5af8acedb8eda67932633d85a881739fbf9a87b10f664fe743b48c58.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
3ddb383a5af8acedb8eda67932633d85a881739fbf9a87b10f664fe743b48c58.exeadobeARM.exedescription pid process target process PID 4072 set thread context of 3340 4072 3ddb383a5af8acedb8eda67932633d85a881739fbf9a87b10f664fe743b48c58.exe 3ddb383a5af8acedb8eda67932633d85a881739fbf9a87b10f664fe743b48c58.exe PID 3044 set thread context of 4052 3044 adobeARM.exe adobeARM.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 2 IoCs
Processes:
WerFault.exeWerFault.exepid pid_target process target process 3432 4072 WerFault.exe 3ddb383a5af8acedb8eda67932633d85a881739fbf9a87b10f664fe743b48c58.exe 5084 3044 WerFault.exe adobeARM.exe -
Suspicious use of AdjustPrivilegeToken 48 IoCs
Processes:
3ddb383a5af8acedb8eda67932633d85a881739fbf9a87b10f664fe743b48c58.exeadobeARM.exedescription pid process Token: SeIncreaseQuotaPrivilege 3340 3ddb383a5af8acedb8eda67932633d85a881739fbf9a87b10f664fe743b48c58.exe Token: SeSecurityPrivilege 3340 3ddb383a5af8acedb8eda67932633d85a881739fbf9a87b10f664fe743b48c58.exe Token: SeTakeOwnershipPrivilege 3340 3ddb383a5af8acedb8eda67932633d85a881739fbf9a87b10f664fe743b48c58.exe Token: SeLoadDriverPrivilege 3340 3ddb383a5af8acedb8eda67932633d85a881739fbf9a87b10f664fe743b48c58.exe Token: SeSystemProfilePrivilege 3340 3ddb383a5af8acedb8eda67932633d85a881739fbf9a87b10f664fe743b48c58.exe Token: SeSystemtimePrivilege 3340 3ddb383a5af8acedb8eda67932633d85a881739fbf9a87b10f664fe743b48c58.exe Token: SeProfSingleProcessPrivilege 3340 3ddb383a5af8acedb8eda67932633d85a881739fbf9a87b10f664fe743b48c58.exe Token: SeIncBasePriorityPrivilege 3340 3ddb383a5af8acedb8eda67932633d85a881739fbf9a87b10f664fe743b48c58.exe Token: SeCreatePagefilePrivilege 3340 3ddb383a5af8acedb8eda67932633d85a881739fbf9a87b10f664fe743b48c58.exe Token: SeBackupPrivilege 3340 3ddb383a5af8acedb8eda67932633d85a881739fbf9a87b10f664fe743b48c58.exe Token: SeRestorePrivilege 3340 3ddb383a5af8acedb8eda67932633d85a881739fbf9a87b10f664fe743b48c58.exe Token: SeShutdownPrivilege 3340 3ddb383a5af8acedb8eda67932633d85a881739fbf9a87b10f664fe743b48c58.exe Token: SeDebugPrivilege 3340 3ddb383a5af8acedb8eda67932633d85a881739fbf9a87b10f664fe743b48c58.exe Token: SeSystemEnvironmentPrivilege 3340 3ddb383a5af8acedb8eda67932633d85a881739fbf9a87b10f664fe743b48c58.exe Token: SeChangeNotifyPrivilege 3340 3ddb383a5af8acedb8eda67932633d85a881739fbf9a87b10f664fe743b48c58.exe Token: SeRemoteShutdownPrivilege 3340 3ddb383a5af8acedb8eda67932633d85a881739fbf9a87b10f664fe743b48c58.exe Token: SeUndockPrivilege 3340 3ddb383a5af8acedb8eda67932633d85a881739fbf9a87b10f664fe743b48c58.exe Token: SeManageVolumePrivilege 3340 3ddb383a5af8acedb8eda67932633d85a881739fbf9a87b10f664fe743b48c58.exe Token: SeImpersonatePrivilege 3340 3ddb383a5af8acedb8eda67932633d85a881739fbf9a87b10f664fe743b48c58.exe Token: SeCreateGlobalPrivilege 3340 3ddb383a5af8acedb8eda67932633d85a881739fbf9a87b10f664fe743b48c58.exe Token: 33 3340 3ddb383a5af8acedb8eda67932633d85a881739fbf9a87b10f664fe743b48c58.exe Token: 34 3340 3ddb383a5af8acedb8eda67932633d85a881739fbf9a87b10f664fe743b48c58.exe Token: 35 3340 3ddb383a5af8acedb8eda67932633d85a881739fbf9a87b10f664fe743b48c58.exe Token: 36 3340 3ddb383a5af8acedb8eda67932633d85a881739fbf9a87b10f664fe743b48c58.exe Token: SeIncreaseQuotaPrivilege 4052 adobeARM.exe Token: SeSecurityPrivilege 4052 adobeARM.exe Token: SeTakeOwnershipPrivilege 4052 adobeARM.exe Token: SeLoadDriverPrivilege 4052 adobeARM.exe Token: SeSystemProfilePrivilege 4052 adobeARM.exe Token: SeSystemtimePrivilege 4052 adobeARM.exe Token: SeProfSingleProcessPrivilege 4052 adobeARM.exe Token: SeIncBasePriorityPrivilege 4052 adobeARM.exe Token: SeCreatePagefilePrivilege 4052 adobeARM.exe Token: SeBackupPrivilege 4052 adobeARM.exe Token: SeRestorePrivilege 4052 adobeARM.exe Token: SeShutdownPrivilege 4052 adobeARM.exe Token: SeDebugPrivilege 4052 adobeARM.exe Token: SeSystemEnvironmentPrivilege 4052 adobeARM.exe Token: SeChangeNotifyPrivilege 4052 adobeARM.exe Token: SeRemoteShutdownPrivilege 4052 adobeARM.exe Token: SeUndockPrivilege 4052 adobeARM.exe Token: SeManageVolumePrivilege 4052 adobeARM.exe Token: SeImpersonatePrivilege 4052 adobeARM.exe Token: SeCreateGlobalPrivilege 4052 adobeARM.exe Token: 33 4052 adobeARM.exe Token: 34 4052 adobeARM.exe Token: 35 4052 adobeARM.exe Token: 36 4052 adobeARM.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
adobeARM.exepid process 4052 adobeARM.exe -
Suspicious use of WriteProcessMemory 19 IoCs
Processes:
3ddb383a5af8acedb8eda67932633d85a881739fbf9a87b10f664fe743b48c58.exe3ddb383a5af8acedb8eda67932633d85a881739fbf9a87b10f664fe743b48c58.exeadobeARM.exedescription pid process target process PID 4072 wrote to memory of 3340 4072 3ddb383a5af8acedb8eda67932633d85a881739fbf9a87b10f664fe743b48c58.exe 3ddb383a5af8acedb8eda67932633d85a881739fbf9a87b10f664fe743b48c58.exe PID 4072 wrote to memory of 3340 4072 3ddb383a5af8acedb8eda67932633d85a881739fbf9a87b10f664fe743b48c58.exe 3ddb383a5af8acedb8eda67932633d85a881739fbf9a87b10f664fe743b48c58.exe PID 4072 wrote to memory of 3340 4072 3ddb383a5af8acedb8eda67932633d85a881739fbf9a87b10f664fe743b48c58.exe 3ddb383a5af8acedb8eda67932633d85a881739fbf9a87b10f664fe743b48c58.exe PID 4072 wrote to memory of 3340 4072 3ddb383a5af8acedb8eda67932633d85a881739fbf9a87b10f664fe743b48c58.exe 3ddb383a5af8acedb8eda67932633d85a881739fbf9a87b10f664fe743b48c58.exe PID 4072 wrote to memory of 3340 4072 3ddb383a5af8acedb8eda67932633d85a881739fbf9a87b10f664fe743b48c58.exe 3ddb383a5af8acedb8eda67932633d85a881739fbf9a87b10f664fe743b48c58.exe PID 4072 wrote to memory of 3340 4072 3ddb383a5af8acedb8eda67932633d85a881739fbf9a87b10f664fe743b48c58.exe 3ddb383a5af8acedb8eda67932633d85a881739fbf9a87b10f664fe743b48c58.exe PID 4072 wrote to memory of 3340 4072 3ddb383a5af8acedb8eda67932633d85a881739fbf9a87b10f664fe743b48c58.exe 3ddb383a5af8acedb8eda67932633d85a881739fbf9a87b10f664fe743b48c58.exe PID 4072 wrote to memory of 3340 4072 3ddb383a5af8acedb8eda67932633d85a881739fbf9a87b10f664fe743b48c58.exe 3ddb383a5af8acedb8eda67932633d85a881739fbf9a87b10f664fe743b48c58.exe PID 3340 wrote to memory of 3044 3340 3ddb383a5af8acedb8eda67932633d85a881739fbf9a87b10f664fe743b48c58.exe adobeARM.exe PID 3340 wrote to memory of 3044 3340 3ddb383a5af8acedb8eda67932633d85a881739fbf9a87b10f664fe743b48c58.exe adobeARM.exe PID 3340 wrote to memory of 3044 3340 3ddb383a5af8acedb8eda67932633d85a881739fbf9a87b10f664fe743b48c58.exe adobeARM.exe PID 3044 wrote to memory of 4052 3044 adobeARM.exe adobeARM.exe PID 3044 wrote to memory of 4052 3044 adobeARM.exe adobeARM.exe PID 3044 wrote to memory of 4052 3044 adobeARM.exe adobeARM.exe PID 3044 wrote to memory of 4052 3044 adobeARM.exe adobeARM.exe PID 3044 wrote to memory of 4052 3044 adobeARM.exe adobeARM.exe PID 3044 wrote to memory of 4052 3044 adobeARM.exe adobeARM.exe PID 3044 wrote to memory of 4052 3044 adobeARM.exe adobeARM.exe PID 3044 wrote to memory of 4052 3044 adobeARM.exe adobeARM.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\3ddb383a5af8acedb8eda67932633d85a881739fbf9a87b10f664fe743b48c58.exe"C:\Users\Admin\AppData\Local\Temp\3ddb383a5af8acedb8eda67932633d85a881739fbf9a87b10f664fe743b48c58.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\3ddb383a5af8acedb8eda67932633d85a881739fbf9a87b10f664fe743b48c58.exeC:\Users\Admin\AppData\Local\Temp\3ddb383a5af8acedb8eda67932633d85a881739fbf9a87b10f664fe743b48c58.exe2⤵
- Modifies WinLogon for persistence
- Checks computer location settings
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\adobe\adobeARM.exe"C:\Users\Admin\AppData\Roaming\adobe\adobeARM.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\adobe\adobeARM.exeC:\Users\Admin\AppData\Roaming\adobe\adobeARM.exe4⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3044 -s 2564⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4072 -s 2762⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4072 -ip 40721⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 3044 -ip 30441⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\Adobe\adobeARM.exeFilesize
546KB
MD53ed968b2400a5eca52fcf8dc1422ece0
SHA110cc685424f274c7b42d26cacf7ad2319fe56000
SHA2563ddb383a5af8acedb8eda67932633d85a881739fbf9a87b10f664fe743b48c58
SHA512e4260b501b476c613a121940de346e9d3d120329404b19a0d6d15862051358698de5528715369c8094b8934661d11afda4176fbf01fed318280f66e04591e92d
-
C:\Users\Admin\AppData\Roaming\Adobe\adobeARM.exeFilesize
546KB
MD53ed968b2400a5eca52fcf8dc1422ece0
SHA110cc685424f274c7b42d26cacf7ad2319fe56000
SHA2563ddb383a5af8acedb8eda67932633d85a881739fbf9a87b10f664fe743b48c58
SHA512e4260b501b476c613a121940de346e9d3d120329404b19a0d6d15862051358698de5528715369c8094b8934661d11afda4176fbf01fed318280f66e04591e92d
-
C:\Users\Admin\AppData\Roaming\adobe\adobeARM.exeFilesize
546KB
MD53ed968b2400a5eca52fcf8dc1422ece0
SHA110cc685424f274c7b42d26cacf7ad2319fe56000
SHA2563ddb383a5af8acedb8eda67932633d85a881739fbf9a87b10f664fe743b48c58
SHA512e4260b501b476c613a121940de346e9d3d120329404b19a0d6d15862051358698de5528715369c8094b8934661d11afda4176fbf01fed318280f66e04591e92d
-
memory/3044-139-0x0000000000000000-mapping.dmp
-
memory/3340-135-0x0000000000400000-0x00000000004B7000-memory.dmpFilesize
732KB
-
memory/3340-137-0x0000000000400000-0x00000000004B7000-memory.dmpFilesize
732KB
-
memory/3340-138-0x0000000000400000-0x00000000004B7000-memory.dmpFilesize
732KB
-
memory/3340-136-0x0000000000400000-0x00000000004B7000-memory.dmpFilesize
732KB
-
memory/3340-132-0x0000000000000000-mapping.dmp
-
memory/3340-134-0x0000000000400000-0x00000000004B7000-memory.dmpFilesize
732KB
-
memory/3340-133-0x0000000000400000-0x00000000004B7000-memory.dmpFilesize
732KB
-
memory/3340-148-0x0000000000400000-0x00000000004B7000-memory.dmpFilesize
732KB
-
memory/4052-142-0x0000000000000000-mapping.dmp
-
memory/4052-149-0x0000000000400000-0x00000000004B7000-memory.dmpFilesize
732KB
-
memory/4052-150-0x0000000000400000-0x00000000004B7000-memory.dmpFilesize
732KB