Analysis
-
max time kernel
150s -
max time network
44s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
03-10-2022 02:27
Static task
static1
Behavioral task
behavioral1
Sample
0d0aad71f4f36d995cc2e100b855f9eca73cfd0bd70106b1edba8806a4e8857b.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
0d0aad71f4f36d995cc2e100b855f9eca73cfd0bd70106b1edba8806a4e8857b.exe
Resource
win10v2004-20220812-en
General
-
Target
0d0aad71f4f36d995cc2e100b855f9eca73cfd0bd70106b1edba8806a4e8857b.exe
-
Size
479KB
-
MD5
48ed10e52dc849bd40d90c8731ccb4c1
-
SHA1
54ddf9778d9931e85c494c09013e114e2928e952
-
SHA256
0d0aad71f4f36d995cc2e100b855f9eca73cfd0bd70106b1edba8806a4e8857b
-
SHA512
b6f62c5c90cba15be639db0e03c3db2a5da4c935e693eee58c39390784453a5afe0c1abb46116cf32b0cfb7135c79d731ca895a74c87f982429101efc3ab70f3
-
SSDEEP
12288:9xzJHcadhEq/0HrGcLmq4Ake8U//dpR46GGQXVf0rJoE2:b9HcmAHP54686dsQ1i
Malware Config
Extracted
darkcomet
Guest16
ratinyacomplawl.zapto.org:1604
DC_MUTEX-GL7RQ54
-
gencode
iccMZ3YEojkw
-
install
false
-
offline_keylogger
false
-
persistence
false
Signatures
-
Executes dropped EXE 2 IoCs
Processes:
winini.execvtres.exepid process 1104 winini.exe 1784 cvtres.exe -
Loads dropped DLL 3 IoCs
Processes:
0d0aad71f4f36d995cc2e100b855f9eca73cfd0bd70106b1edba8806a4e8857b.exewinini.exepid process 112 0d0aad71f4f36d995cc2e100b855f9eca73cfd0bd70106b1edba8806a4e8857b.exe 112 0d0aad71f4f36d995cc2e100b855f9eca73cfd0bd70106b1edba8806a4e8857b.exe 1104 winini.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
winini.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\Windows Live = "C:\\Users\\Admin\\AppData\\Local\\Temp\\winini.exe" winini.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
winini.exedescription pid process target process PID 1104 set thread context of 1784 1104 winini.exe cvtres.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of AdjustPrivilegeToken 23 IoCs
Processes:
cvtres.exedescription pid process Token: SeIncreaseQuotaPrivilege 1784 cvtres.exe Token: SeSecurityPrivilege 1784 cvtres.exe Token: SeTakeOwnershipPrivilege 1784 cvtres.exe Token: SeLoadDriverPrivilege 1784 cvtres.exe Token: SeSystemProfilePrivilege 1784 cvtres.exe Token: SeSystemtimePrivilege 1784 cvtres.exe Token: SeProfSingleProcessPrivilege 1784 cvtres.exe Token: SeIncBasePriorityPrivilege 1784 cvtres.exe Token: SeCreatePagefilePrivilege 1784 cvtres.exe Token: SeBackupPrivilege 1784 cvtres.exe Token: SeRestorePrivilege 1784 cvtres.exe Token: SeShutdownPrivilege 1784 cvtres.exe Token: SeDebugPrivilege 1784 cvtres.exe Token: SeSystemEnvironmentPrivilege 1784 cvtres.exe Token: SeChangeNotifyPrivilege 1784 cvtres.exe Token: SeRemoteShutdownPrivilege 1784 cvtres.exe Token: SeUndockPrivilege 1784 cvtres.exe Token: SeManageVolumePrivilege 1784 cvtres.exe Token: SeImpersonatePrivilege 1784 cvtres.exe Token: SeCreateGlobalPrivilege 1784 cvtres.exe Token: 33 1784 cvtres.exe Token: 34 1784 cvtres.exe Token: 35 1784 cvtres.exe -
Suspicious use of WriteProcessMemory 17 IoCs
Processes:
0d0aad71f4f36d995cc2e100b855f9eca73cfd0bd70106b1edba8806a4e8857b.exewinini.exedescription pid process target process PID 112 wrote to memory of 1104 112 0d0aad71f4f36d995cc2e100b855f9eca73cfd0bd70106b1edba8806a4e8857b.exe winini.exe PID 112 wrote to memory of 1104 112 0d0aad71f4f36d995cc2e100b855f9eca73cfd0bd70106b1edba8806a4e8857b.exe winini.exe PID 112 wrote to memory of 1104 112 0d0aad71f4f36d995cc2e100b855f9eca73cfd0bd70106b1edba8806a4e8857b.exe winini.exe PID 112 wrote to memory of 1104 112 0d0aad71f4f36d995cc2e100b855f9eca73cfd0bd70106b1edba8806a4e8857b.exe winini.exe PID 1104 wrote to memory of 1784 1104 winini.exe cvtres.exe PID 1104 wrote to memory of 1784 1104 winini.exe cvtres.exe PID 1104 wrote to memory of 1784 1104 winini.exe cvtres.exe PID 1104 wrote to memory of 1784 1104 winini.exe cvtres.exe PID 1104 wrote to memory of 1784 1104 winini.exe cvtres.exe PID 1104 wrote to memory of 1784 1104 winini.exe cvtres.exe PID 1104 wrote to memory of 1784 1104 winini.exe cvtres.exe PID 1104 wrote to memory of 1784 1104 winini.exe cvtres.exe PID 1104 wrote to memory of 1784 1104 winini.exe cvtres.exe PID 1104 wrote to memory of 1784 1104 winini.exe cvtres.exe PID 1104 wrote to memory of 1784 1104 winini.exe cvtres.exe PID 1104 wrote to memory of 1784 1104 winini.exe cvtres.exe PID 1104 wrote to memory of 1784 1104 winini.exe cvtres.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\0d0aad71f4f36d995cc2e100b855f9eca73cfd0bd70106b1edba8806a4e8857b.exe"C:\Users\Admin\AppData\Local\Temp\0d0aad71f4f36d995cc2e100b855f9eca73cfd0bd70106b1edba8806a4e8857b.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\winini.exe"C:\Users\Admin\AppData\Local\Temp\winini.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\cvtres.exeC:\Users\Admin\AppData\Local\Temp\\cvtres.exe3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\cvtres.exeFilesize
31KB
MD5ed797d8dc2c92401985d162e42ffa450
SHA10f02fc517c7facc4baefde4fe9467fb6488ebabe
SHA256b746362010a101cb5931bc066f0f4d3fc740c02a68c1f37fc3c8e6c87fd7cb1e
SHA512e831a6ff987f3ef29982da16afad06938b68eddd43c234ba88d1c96a1b5547f2284baf35cbb3a5bfd75e7f0445d14daa014e0ba00b4db72c67f83f0a314c80c2
-
C:\Users\Admin\AppData\Local\Temp\cvtres.exeFilesize
31KB
MD5ed797d8dc2c92401985d162e42ffa450
SHA10f02fc517c7facc4baefde4fe9467fb6488ebabe
SHA256b746362010a101cb5931bc066f0f4d3fc740c02a68c1f37fc3c8e6c87fd7cb1e
SHA512e831a6ff987f3ef29982da16afad06938b68eddd43c234ba88d1c96a1b5547f2284baf35cbb3a5bfd75e7f0445d14daa014e0ba00b4db72c67f83f0a314c80c2
-
C:\Users\Admin\AppData\Local\Temp\winini.exeFilesize
429KB
MD5770b1e40323abdeafb3678e708f8cd00
SHA1cd63628d0f42593990e5cf809ea454b6c33df867
SHA2567ac755950ee2faedb12365aa9af22560697b250d974228ced7eab948d5231d5e
SHA5124e236f71924e92efa260f14c6c3c70ae6315f7163356c1fa9d6e9a30f2f35a4d620c6a4c5ddfbc1bdc1c9787fe30c2887c7335e218338e5b9884bac989f83a7a
-
C:\Users\Admin\AppData\Local\Temp\winini.exeFilesize
429KB
MD5770b1e40323abdeafb3678e708f8cd00
SHA1cd63628d0f42593990e5cf809ea454b6c33df867
SHA2567ac755950ee2faedb12365aa9af22560697b250d974228ced7eab948d5231d5e
SHA5124e236f71924e92efa260f14c6c3c70ae6315f7163356c1fa9d6e9a30f2f35a4d620c6a4c5ddfbc1bdc1c9787fe30c2887c7335e218338e5b9884bac989f83a7a
-
\Users\Admin\AppData\Local\Temp\cvtres.exeFilesize
31KB
MD5ed797d8dc2c92401985d162e42ffa450
SHA10f02fc517c7facc4baefde4fe9467fb6488ebabe
SHA256b746362010a101cb5931bc066f0f4d3fc740c02a68c1f37fc3c8e6c87fd7cb1e
SHA512e831a6ff987f3ef29982da16afad06938b68eddd43c234ba88d1c96a1b5547f2284baf35cbb3a5bfd75e7f0445d14daa014e0ba00b4db72c67f83f0a314c80c2
-
\Users\Admin\AppData\Local\Temp\winini.exeFilesize
429KB
MD5770b1e40323abdeafb3678e708f8cd00
SHA1cd63628d0f42593990e5cf809ea454b6c33df867
SHA2567ac755950ee2faedb12365aa9af22560697b250d974228ced7eab948d5231d5e
SHA5124e236f71924e92efa260f14c6c3c70ae6315f7163356c1fa9d6e9a30f2f35a4d620c6a4c5ddfbc1bdc1c9787fe30c2887c7335e218338e5b9884bac989f83a7a
-
\Users\Admin\AppData\Local\Temp\winini.exeFilesize
429KB
MD5770b1e40323abdeafb3678e708f8cd00
SHA1cd63628d0f42593990e5cf809ea454b6c33df867
SHA2567ac755950ee2faedb12365aa9af22560697b250d974228ced7eab948d5231d5e
SHA5124e236f71924e92efa260f14c6c3c70ae6315f7163356c1fa9d6e9a30f2f35a4d620c6a4c5ddfbc1bdc1c9787fe30c2887c7335e218338e5b9884bac989f83a7a
-
memory/112-54-0x0000000074C11000-0x0000000074C13000-memory.dmpFilesize
8KB
-
memory/112-62-0x0000000073EB0000-0x000000007445B000-memory.dmpFilesize
5.7MB
-
memory/112-55-0x0000000073EB0000-0x000000007445B000-memory.dmpFilesize
5.7MB
-
memory/1104-58-0x0000000000000000-mapping.dmp
-
memory/1104-63-0x0000000073EB0000-0x000000007445B000-memory.dmpFilesize
5.7MB
-
memory/1104-84-0x0000000073EB0000-0x000000007445B000-memory.dmpFilesize
5.7MB
-
memory/1784-72-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/1784-80-0x000000000048F888-mapping.dmp
-
memory/1784-74-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/1784-75-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/1784-77-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/1784-70-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/1784-79-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/1784-68-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/1784-82-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/1784-66-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/1784-85-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/1784-86-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/1784-65-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/1784-88-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB