Analysis
-
max time kernel
151s -
max time network
44s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
03/10/2022, 16:10
Behavioral task
behavioral1
Sample
0f0b1650c9f50ada21f103a256f1ea916fafacec0b6f37eb58e1b93275f80f67.exe
Resource
win7-20220812-en
windows7-x64
21 signatures
150 seconds
General
-
Target
0f0b1650c9f50ada21f103a256f1ea916fafacec0b6f37eb58e1b93275f80f67.exe
-
Size
252KB
-
MD5
5cb41d5644b7fbcc80696ca93a7f8db0
-
SHA1
50b84025fb13434eb6215dfd37ea4f0a2e605dcf
-
SHA256
0f0b1650c9f50ada21f103a256f1ea916fafacec0b6f37eb58e1b93275f80f67
-
SHA512
e067d8036c4695d11326d17c3e7592f04d4b48a03075883f19003455d0b4a461ac6d1db2c2cfe6cf5e26fedccda71e84022dccb247c7eca8b58cad0fce3988c2
-
SSDEEP
6144:9cNYS996KFifeVjBpeExgVTFSXFoMc5RhCaL37:9cW7KEZlPzCy37
Malware Config
Extracted
Family
darkcomet
Botnet
Guest16
C2
davidbre.noip.me:1604
Mutex
DC_MUTEX-C2MMFJV
Attributes
-
InstallPath
MSDCSC\msdcsc.exe
-
gencode
8hBR0eRJKy3N
-
install
true
-
offline_keylogger
true
-
persistence
false
-
reg_key
MicroUpdate
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Users\\Admin\\Documents\\MSDCSC\\msdcsc.exe" 0f0b1650c9f50ada21f103a256f1ea916fafacec0b6f37eb58e1b93275f80f67.exe -
Modifies firewall policy service 2 TTPs 3 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" msdcsc.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "0" msdcsc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile msdcsc.exe -
Modifies security service 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wscsvc\Start = "4" msdcsc.exe -
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" msdcsc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" msdcsc.exe -
Disables RegEdit via registry modification 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" msdcsc.exe -
Disables Task Manager via registry modification
-
Executes dropped EXE 1 IoCs
pid Process 2032 msdcsc.exe -
Sets file to hidden 1 TTPs 2 IoCs
Modifies file attributes to stop it showing in Explorer etc.
pid Process 1992 attrib.exe 1692 attrib.exe -
resource yara_rule behavioral1/memory/2000-55-0x0000000000400000-0x00000000004B7000-memory.dmp upx behavioral1/files/0x000a00000001313e-62.dat upx behavioral1/files/0x000a00000001313e-63.dat upx behavioral1/files/0x000a00000001313e-65.dat upx behavioral1/files/0x000a00000001313e-67.dat upx behavioral1/memory/2032-71-0x0000000000400000-0x00000000004B7000-memory.dmp upx behavioral1/memory/2000-72-0x0000000000400000-0x00000000004B7000-memory.dmp upx behavioral1/memory/2032-73-0x0000000000400000-0x00000000004B7000-memory.dmp upx -
Deletes itself 1 IoCs
pid Process 1368 notepad.exe -
Loads dropped DLL 2 IoCs
pid Process 2000 0f0b1650c9f50ada21f103a256f1ea916fafacec0b6f37eb58e1b93275f80f67.exe 2000 0f0b1650c9f50ada21f103a256f1ea916fafacec0b6f37eb58e1b93275f80f67.exe -
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" msdcsc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" msdcsc.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Users\\Admin\\Documents\\MSDCSC\\msdcsc.exe" 0f0b1650c9f50ada21f103a256f1ea916fafacec0b6f37eb58e1b93275f80f67.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2032 msdcsc.exe -
Suspicious use of AdjustPrivilegeToken 46 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 2000 0f0b1650c9f50ada21f103a256f1ea916fafacec0b6f37eb58e1b93275f80f67.exe Token: SeSecurityPrivilege 2000 0f0b1650c9f50ada21f103a256f1ea916fafacec0b6f37eb58e1b93275f80f67.exe Token: SeTakeOwnershipPrivilege 2000 0f0b1650c9f50ada21f103a256f1ea916fafacec0b6f37eb58e1b93275f80f67.exe Token: SeLoadDriverPrivilege 2000 0f0b1650c9f50ada21f103a256f1ea916fafacec0b6f37eb58e1b93275f80f67.exe Token: SeSystemProfilePrivilege 2000 0f0b1650c9f50ada21f103a256f1ea916fafacec0b6f37eb58e1b93275f80f67.exe Token: SeSystemtimePrivilege 2000 0f0b1650c9f50ada21f103a256f1ea916fafacec0b6f37eb58e1b93275f80f67.exe Token: SeProfSingleProcessPrivilege 2000 0f0b1650c9f50ada21f103a256f1ea916fafacec0b6f37eb58e1b93275f80f67.exe Token: SeIncBasePriorityPrivilege 2000 0f0b1650c9f50ada21f103a256f1ea916fafacec0b6f37eb58e1b93275f80f67.exe Token: SeCreatePagefilePrivilege 2000 0f0b1650c9f50ada21f103a256f1ea916fafacec0b6f37eb58e1b93275f80f67.exe Token: SeBackupPrivilege 2000 0f0b1650c9f50ada21f103a256f1ea916fafacec0b6f37eb58e1b93275f80f67.exe Token: SeRestorePrivilege 2000 0f0b1650c9f50ada21f103a256f1ea916fafacec0b6f37eb58e1b93275f80f67.exe Token: SeShutdownPrivilege 2000 0f0b1650c9f50ada21f103a256f1ea916fafacec0b6f37eb58e1b93275f80f67.exe Token: SeDebugPrivilege 2000 0f0b1650c9f50ada21f103a256f1ea916fafacec0b6f37eb58e1b93275f80f67.exe Token: SeSystemEnvironmentPrivilege 2000 0f0b1650c9f50ada21f103a256f1ea916fafacec0b6f37eb58e1b93275f80f67.exe Token: SeChangeNotifyPrivilege 2000 0f0b1650c9f50ada21f103a256f1ea916fafacec0b6f37eb58e1b93275f80f67.exe Token: SeRemoteShutdownPrivilege 2000 0f0b1650c9f50ada21f103a256f1ea916fafacec0b6f37eb58e1b93275f80f67.exe Token: SeUndockPrivilege 2000 0f0b1650c9f50ada21f103a256f1ea916fafacec0b6f37eb58e1b93275f80f67.exe Token: SeManageVolumePrivilege 2000 0f0b1650c9f50ada21f103a256f1ea916fafacec0b6f37eb58e1b93275f80f67.exe Token: SeImpersonatePrivilege 2000 0f0b1650c9f50ada21f103a256f1ea916fafacec0b6f37eb58e1b93275f80f67.exe Token: SeCreateGlobalPrivilege 2000 0f0b1650c9f50ada21f103a256f1ea916fafacec0b6f37eb58e1b93275f80f67.exe Token: 33 2000 0f0b1650c9f50ada21f103a256f1ea916fafacec0b6f37eb58e1b93275f80f67.exe Token: 34 2000 0f0b1650c9f50ada21f103a256f1ea916fafacec0b6f37eb58e1b93275f80f67.exe Token: 35 2000 0f0b1650c9f50ada21f103a256f1ea916fafacec0b6f37eb58e1b93275f80f67.exe Token: SeIncreaseQuotaPrivilege 2032 msdcsc.exe Token: SeSecurityPrivilege 2032 msdcsc.exe Token: SeTakeOwnershipPrivilege 2032 msdcsc.exe Token: SeLoadDriverPrivilege 2032 msdcsc.exe Token: SeSystemProfilePrivilege 2032 msdcsc.exe Token: SeSystemtimePrivilege 2032 msdcsc.exe Token: SeProfSingleProcessPrivilege 2032 msdcsc.exe Token: SeIncBasePriorityPrivilege 2032 msdcsc.exe Token: SeCreatePagefilePrivilege 2032 msdcsc.exe Token: SeBackupPrivilege 2032 msdcsc.exe Token: SeRestorePrivilege 2032 msdcsc.exe Token: SeShutdownPrivilege 2032 msdcsc.exe Token: SeDebugPrivilege 2032 msdcsc.exe Token: SeSystemEnvironmentPrivilege 2032 msdcsc.exe Token: SeChangeNotifyPrivilege 2032 msdcsc.exe Token: SeRemoteShutdownPrivilege 2032 msdcsc.exe Token: SeUndockPrivilege 2032 msdcsc.exe Token: SeManageVolumePrivilege 2032 msdcsc.exe Token: SeImpersonatePrivilege 2032 msdcsc.exe Token: SeCreateGlobalPrivilege 2032 msdcsc.exe Token: 33 2032 msdcsc.exe Token: 34 2032 msdcsc.exe Token: 35 2032 msdcsc.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2032 msdcsc.exe -
Suspicious use of WriteProcessMemory 61 IoCs
description pid Process procid_target PID 2000 wrote to memory of 1364 2000 0f0b1650c9f50ada21f103a256f1ea916fafacec0b6f37eb58e1b93275f80f67.exe 27 PID 2000 wrote to memory of 1364 2000 0f0b1650c9f50ada21f103a256f1ea916fafacec0b6f37eb58e1b93275f80f67.exe 27 PID 2000 wrote to memory of 1364 2000 0f0b1650c9f50ada21f103a256f1ea916fafacec0b6f37eb58e1b93275f80f67.exe 27 PID 2000 wrote to memory of 1364 2000 0f0b1650c9f50ada21f103a256f1ea916fafacec0b6f37eb58e1b93275f80f67.exe 27 PID 2000 wrote to memory of 616 2000 0f0b1650c9f50ada21f103a256f1ea916fafacec0b6f37eb58e1b93275f80f67.exe 29 PID 2000 wrote to memory of 616 2000 0f0b1650c9f50ada21f103a256f1ea916fafacec0b6f37eb58e1b93275f80f67.exe 29 PID 2000 wrote to memory of 616 2000 0f0b1650c9f50ada21f103a256f1ea916fafacec0b6f37eb58e1b93275f80f67.exe 29 PID 2000 wrote to memory of 616 2000 0f0b1650c9f50ada21f103a256f1ea916fafacec0b6f37eb58e1b93275f80f67.exe 29 PID 2000 wrote to memory of 1368 2000 0f0b1650c9f50ada21f103a256f1ea916fafacec0b6f37eb58e1b93275f80f67.exe 30 PID 2000 wrote to memory of 1368 2000 0f0b1650c9f50ada21f103a256f1ea916fafacec0b6f37eb58e1b93275f80f67.exe 30 PID 2000 wrote to memory of 1368 2000 0f0b1650c9f50ada21f103a256f1ea916fafacec0b6f37eb58e1b93275f80f67.exe 30 PID 2000 wrote to memory of 1368 2000 0f0b1650c9f50ada21f103a256f1ea916fafacec0b6f37eb58e1b93275f80f67.exe 30 PID 2000 wrote to memory of 1368 2000 0f0b1650c9f50ada21f103a256f1ea916fafacec0b6f37eb58e1b93275f80f67.exe 30 PID 2000 wrote to memory of 1368 2000 0f0b1650c9f50ada21f103a256f1ea916fafacec0b6f37eb58e1b93275f80f67.exe 30 PID 2000 wrote to memory of 1368 2000 0f0b1650c9f50ada21f103a256f1ea916fafacec0b6f37eb58e1b93275f80f67.exe 30 PID 2000 wrote to memory of 1368 2000 0f0b1650c9f50ada21f103a256f1ea916fafacec0b6f37eb58e1b93275f80f67.exe 30 PID 2000 wrote to memory of 1368 2000 0f0b1650c9f50ada21f103a256f1ea916fafacec0b6f37eb58e1b93275f80f67.exe 30 PID 2000 wrote to memory of 1368 2000 0f0b1650c9f50ada21f103a256f1ea916fafacec0b6f37eb58e1b93275f80f67.exe 30 PID 2000 wrote to memory of 1368 2000 0f0b1650c9f50ada21f103a256f1ea916fafacec0b6f37eb58e1b93275f80f67.exe 30 PID 2000 wrote to memory of 1368 2000 0f0b1650c9f50ada21f103a256f1ea916fafacec0b6f37eb58e1b93275f80f67.exe 30 PID 2000 wrote to memory of 1368 2000 0f0b1650c9f50ada21f103a256f1ea916fafacec0b6f37eb58e1b93275f80f67.exe 30 PID 2000 wrote to memory of 1368 2000 0f0b1650c9f50ada21f103a256f1ea916fafacec0b6f37eb58e1b93275f80f67.exe 30 PID 2000 wrote to memory of 1368 2000 0f0b1650c9f50ada21f103a256f1ea916fafacec0b6f37eb58e1b93275f80f67.exe 30 PID 2000 wrote to memory of 1368 2000 0f0b1650c9f50ada21f103a256f1ea916fafacec0b6f37eb58e1b93275f80f67.exe 30 PID 2000 wrote to memory of 1368 2000 0f0b1650c9f50ada21f103a256f1ea916fafacec0b6f37eb58e1b93275f80f67.exe 30 PID 2000 wrote to memory of 1368 2000 0f0b1650c9f50ada21f103a256f1ea916fafacec0b6f37eb58e1b93275f80f67.exe 30 PID 1364 wrote to memory of 1992 1364 cmd.exe 32 PID 1364 wrote to memory of 1992 1364 cmd.exe 32 PID 1364 wrote to memory of 1992 1364 cmd.exe 32 PID 1364 wrote to memory of 1992 1364 cmd.exe 32 PID 616 wrote to memory of 1692 616 cmd.exe 33 PID 616 wrote to memory of 1692 616 cmd.exe 33 PID 616 wrote to memory of 1692 616 cmd.exe 33 PID 616 wrote to memory of 1692 616 cmd.exe 33 PID 2000 wrote to memory of 2032 2000 0f0b1650c9f50ada21f103a256f1ea916fafacec0b6f37eb58e1b93275f80f67.exe 34 PID 2000 wrote to memory of 2032 2000 0f0b1650c9f50ada21f103a256f1ea916fafacec0b6f37eb58e1b93275f80f67.exe 34 PID 2000 wrote to memory of 2032 2000 0f0b1650c9f50ada21f103a256f1ea916fafacec0b6f37eb58e1b93275f80f67.exe 34 PID 2000 wrote to memory of 2032 2000 0f0b1650c9f50ada21f103a256f1ea916fafacec0b6f37eb58e1b93275f80f67.exe 34 PID 2032 wrote to memory of 2016 2032 msdcsc.exe 35 PID 2032 wrote to memory of 2016 2032 msdcsc.exe 35 PID 2032 wrote to memory of 2016 2032 msdcsc.exe 35 PID 2032 wrote to memory of 2016 2032 msdcsc.exe 35 PID 2032 wrote to memory of 2016 2032 msdcsc.exe 35 PID 2032 wrote to memory of 2016 2032 msdcsc.exe 35 PID 2032 wrote to memory of 2016 2032 msdcsc.exe 35 PID 2032 wrote to memory of 2016 2032 msdcsc.exe 35 PID 2032 wrote to memory of 2016 2032 msdcsc.exe 35 PID 2032 wrote to memory of 2016 2032 msdcsc.exe 35 PID 2032 wrote to memory of 2016 2032 msdcsc.exe 35 PID 2032 wrote to memory of 2016 2032 msdcsc.exe 35 PID 2032 wrote to memory of 2016 2032 msdcsc.exe 35 PID 2032 wrote to memory of 2016 2032 msdcsc.exe 35 PID 2032 wrote to memory of 2016 2032 msdcsc.exe 35 PID 2032 wrote to memory of 2016 2032 msdcsc.exe 35 PID 2032 wrote to memory of 2016 2032 msdcsc.exe 35 PID 2032 wrote to memory of 2016 2032 msdcsc.exe 35 PID 2032 wrote to memory of 2016 2032 msdcsc.exe 35 PID 2032 wrote to memory of 2016 2032 msdcsc.exe 35 PID 2032 wrote to memory of 2016 2032 msdcsc.exe 35 PID 2032 wrote to memory of 2016 2032 msdcsc.exe 35 PID 2032 wrote to memory of 2016 2032 msdcsc.exe 35 -
System policy modification 1 TTPs 3 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\CurrentVersion msdcsc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\CurrentVersion\Explorern msdcsc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\CurrentVersion\Explorern\NoControlPanel = "1" msdcsc.exe -
Views/modifies file attributes 1 TTPs 2 IoCs
pid Process 1992 attrib.exe 1692 attrib.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\0f0b1650c9f50ada21f103a256f1ea916fafacec0b6f37eb58e1b93275f80f67.exe"C:\Users\Admin\AppData\Local\Temp\0f0b1650c9f50ada21f103a256f1ea916fafacec0b6f37eb58e1b93275f80f67.exe"1⤵
- Modifies WinLogon for persistence
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2000 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp\0f0b1650c9f50ada21f103a256f1ea916fafacec0b6f37eb58e1b93275f80f67.exe" +s +h2⤵
- Suspicious use of WriteProcessMemory
PID:1364 -
C:\Windows\SysWOW64\attrib.exeattrib "C:\Users\Admin\AppData\Local\Temp\0f0b1650c9f50ada21f103a256f1ea916fafacec0b6f37eb58e1b93275f80f67.exe" +s +h3⤵
- Sets file to hidden
- Views/modifies file attributes
PID:1992
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp" +s +h2⤵
- Suspicious use of WriteProcessMemory
PID:616 -
C:\Windows\SysWOW64\attrib.exeattrib "C:\Users\Admin\AppData\Local\Temp" +s +h3⤵
- Sets file to hidden
- Views/modifies file attributes
PID:1692
-
-
-
C:\Windows\SysWOW64\notepad.exenotepad2⤵
- Deletes itself
PID:1368
-
-
C:\Users\Admin\Documents\MSDCSC\msdcsc.exe"C:\Users\Admin\Documents\MSDCSC\msdcsc.exe"2⤵
- Modifies firewall policy service
- Modifies security service
- Windows security bypass
- Disables RegEdit via registry modification
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2032 -
C:\Windows\SysWOW64\notepad.exenotepad3⤵PID:2016
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
252KB
MD55cb41d5644b7fbcc80696ca93a7f8db0
SHA150b84025fb13434eb6215dfd37ea4f0a2e605dcf
SHA2560f0b1650c9f50ada21f103a256f1ea916fafacec0b6f37eb58e1b93275f80f67
SHA512e067d8036c4695d11326d17c3e7592f04d4b48a03075883f19003455d0b4a461ac6d1db2c2cfe6cf5e26fedccda71e84022dccb247c7eca8b58cad0fce3988c2
-
Filesize
252KB
MD55cb41d5644b7fbcc80696ca93a7f8db0
SHA150b84025fb13434eb6215dfd37ea4f0a2e605dcf
SHA2560f0b1650c9f50ada21f103a256f1ea916fafacec0b6f37eb58e1b93275f80f67
SHA512e067d8036c4695d11326d17c3e7592f04d4b48a03075883f19003455d0b4a461ac6d1db2c2cfe6cf5e26fedccda71e84022dccb247c7eca8b58cad0fce3988c2
-
Filesize
252KB
MD55cb41d5644b7fbcc80696ca93a7f8db0
SHA150b84025fb13434eb6215dfd37ea4f0a2e605dcf
SHA2560f0b1650c9f50ada21f103a256f1ea916fafacec0b6f37eb58e1b93275f80f67
SHA512e067d8036c4695d11326d17c3e7592f04d4b48a03075883f19003455d0b4a461ac6d1db2c2cfe6cf5e26fedccda71e84022dccb247c7eca8b58cad0fce3988c2
-
Filesize
252KB
MD55cb41d5644b7fbcc80696ca93a7f8db0
SHA150b84025fb13434eb6215dfd37ea4f0a2e605dcf
SHA2560f0b1650c9f50ada21f103a256f1ea916fafacec0b6f37eb58e1b93275f80f67
SHA512e067d8036c4695d11326d17c3e7592f04d4b48a03075883f19003455d0b4a461ac6d1db2c2cfe6cf5e26fedccda71e84022dccb247c7eca8b58cad0fce3988c2