Analysis
-
max time kernel
62s -
max time network
139s -
platform
windows10-2004_x64 -
resource
win10v2004-20220901-en -
resource tags
arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system -
submitted
11/10/2022, 07:06
Static task
static1
Behavioral task
behavioral1
Sample
a0c68d73c01a70d1ed9b984d7a92d7a33d2b6b76fb48774137443c538b9a1035.exe
Resource
win7-20220812-en
General
-
Target
a0c68d73c01a70d1ed9b984d7a92d7a33d2b6b76fb48774137443c538b9a1035.exe
-
Size
1022KB
-
MD5
71aa732bc440747865b80aa4ae6b7964
-
SHA1
3fcee2da11b8c942ba2029f074e3452ca74d5d47
-
SHA256
a0c68d73c01a70d1ed9b984d7a92d7a33d2b6b76fb48774137443c538b9a1035
-
SHA512
58ca1d67623fa73dec810467a22842c6c761f843b6eae7d1da27b060db1c39b919bc98284ff2d94602aa4a8a929cff2d3126d82acd1d2464ecdd7e2674c8e6b8
-
SSDEEP
24576:6vOTggIRfmQX3zRYC6FVZPv+FWe4Ys/EWc:KjYlDZ3+UT/EW
Malware Config
Extracted
darkcomet
Guest16
86.19.152.61:1604
DC_MUTEX-3SXRNQA
-
InstallPath
MSDCSC\msdcsc.exe
-
gencode
25DXBoo5LzAj
-
install
true
-
offline_keylogger
true
-
persistence
true
-
reg_key
MicroUpdate
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\MSDCSC\\msdcsc.exe" svchost.exe -
Executes dropped EXE 2 IoCs
pid Process 2108 svchost.exe 224 msdcsc.exe -
Sets file to hidden 1 TTPs 2 IoCs
Modifies file attributes to stop it showing in Explorer etc.
pid Process 3972 attrib.exe 552 attrib.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation svchost.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\1 = "C:\\Users\\Admin\\AppData\\Roaming\\a0c68d73c01a70d1ed9b984d7a92d7a33d2b6b76fb48774137443c538b9a1035.exe" a0c68d73c01a70d1ed9b984d7a92d7a33d2b6b76fb48774137443c538b9a1035.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\MSDCSC\\msdcsc.exe" svchost.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 4628 set thread context of 2108 4628 a0c68d73c01a70d1ed9b984d7a92d7a33d2b6b76fb48774137443c538b9a1035.exe 84 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of AdjustPrivilegeToken 24 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 2108 svchost.exe Token: SeSecurityPrivilege 2108 svchost.exe Token: SeTakeOwnershipPrivilege 2108 svchost.exe Token: SeLoadDriverPrivilege 2108 svchost.exe Token: SeSystemProfilePrivilege 2108 svchost.exe Token: SeSystemtimePrivilege 2108 svchost.exe Token: SeProfSingleProcessPrivilege 2108 svchost.exe Token: SeIncBasePriorityPrivilege 2108 svchost.exe Token: SeCreatePagefilePrivilege 2108 svchost.exe Token: SeBackupPrivilege 2108 svchost.exe Token: SeRestorePrivilege 2108 svchost.exe Token: SeShutdownPrivilege 2108 svchost.exe Token: SeDebugPrivilege 2108 svchost.exe Token: SeSystemEnvironmentPrivilege 2108 svchost.exe Token: SeChangeNotifyPrivilege 2108 svchost.exe Token: SeRemoteShutdownPrivilege 2108 svchost.exe Token: SeUndockPrivilege 2108 svchost.exe Token: SeManageVolumePrivilege 2108 svchost.exe Token: SeImpersonatePrivilege 2108 svchost.exe Token: SeCreateGlobalPrivilege 2108 svchost.exe Token: 33 2108 svchost.exe Token: 34 2108 svchost.exe Token: 35 2108 svchost.exe Token: 36 2108 svchost.exe -
Suspicious use of WriteProcessMemory 46 IoCs
description pid Process procid_target PID 4628 wrote to memory of 2108 4628 a0c68d73c01a70d1ed9b984d7a92d7a33d2b6b76fb48774137443c538b9a1035.exe 84 PID 4628 wrote to memory of 2108 4628 a0c68d73c01a70d1ed9b984d7a92d7a33d2b6b76fb48774137443c538b9a1035.exe 84 PID 4628 wrote to memory of 2108 4628 a0c68d73c01a70d1ed9b984d7a92d7a33d2b6b76fb48774137443c538b9a1035.exe 84 PID 4628 wrote to memory of 2108 4628 a0c68d73c01a70d1ed9b984d7a92d7a33d2b6b76fb48774137443c538b9a1035.exe 84 PID 4628 wrote to memory of 2108 4628 a0c68d73c01a70d1ed9b984d7a92d7a33d2b6b76fb48774137443c538b9a1035.exe 84 PID 4628 wrote to memory of 2108 4628 a0c68d73c01a70d1ed9b984d7a92d7a33d2b6b76fb48774137443c538b9a1035.exe 84 PID 4628 wrote to memory of 2108 4628 a0c68d73c01a70d1ed9b984d7a92d7a33d2b6b76fb48774137443c538b9a1035.exe 84 PID 4628 wrote to memory of 2108 4628 a0c68d73c01a70d1ed9b984d7a92d7a33d2b6b76fb48774137443c538b9a1035.exe 84 PID 4628 wrote to memory of 2108 4628 a0c68d73c01a70d1ed9b984d7a92d7a33d2b6b76fb48774137443c538b9a1035.exe 84 PID 4628 wrote to memory of 2108 4628 a0c68d73c01a70d1ed9b984d7a92d7a33d2b6b76fb48774137443c538b9a1035.exe 84 PID 4628 wrote to memory of 2108 4628 a0c68d73c01a70d1ed9b984d7a92d7a33d2b6b76fb48774137443c538b9a1035.exe 84 PID 4628 wrote to memory of 2108 4628 a0c68d73c01a70d1ed9b984d7a92d7a33d2b6b76fb48774137443c538b9a1035.exe 84 PID 4628 wrote to memory of 2108 4628 a0c68d73c01a70d1ed9b984d7a92d7a33d2b6b76fb48774137443c538b9a1035.exe 84 PID 4628 wrote to memory of 2108 4628 a0c68d73c01a70d1ed9b984d7a92d7a33d2b6b76fb48774137443c538b9a1035.exe 84 PID 2108 wrote to memory of 3552 2108 svchost.exe 86 PID 2108 wrote to memory of 3552 2108 svchost.exe 86 PID 2108 wrote to memory of 3552 2108 svchost.exe 86 PID 2108 wrote to memory of 3944 2108 svchost.exe 88 PID 2108 wrote to memory of 3944 2108 svchost.exe 88 PID 2108 wrote to memory of 3944 2108 svchost.exe 88 PID 2108 wrote to memory of 1844 2108 svchost.exe 90 PID 2108 wrote to memory of 1844 2108 svchost.exe 90 PID 2108 wrote to memory of 1844 2108 svchost.exe 90 PID 2108 wrote to memory of 1844 2108 svchost.exe 90 PID 2108 wrote to memory of 1844 2108 svchost.exe 90 PID 2108 wrote to memory of 1844 2108 svchost.exe 90 PID 2108 wrote to memory of 1844 2108 svchost.exe 90 PID 2108 wrote to memory of 1844 2108 svchost.exe 90 PID 2108 wrote to memory of 1844 2108 svchost.exe 90 PID 2108 wrote to memory of 1844 2108 svchost.exe 90 PID 2108 wrote to memory of 1844 2108 svchost.exe 90 PID 2108 wrote to memory of 1844 2108 svchost.exe 90 PID 2108 wrote to memory of 1844 2108 svchost.exe 90 PID 2108 wrote to memory of 1844 2108 svchost.exe 90 PID 2108 wrote to memory of 1844 2108 svchost.exe 90 PID 2108 wrote to memory of 1844 2108 svchost.exe 90 PID 2108 wrote to memory of 1844 2108 svchost.exe 90 PID 2108 wrote to memory of 224 2108 svchost.exe 91 PID 2108 wrote to memory of 224 2108 svchost.exe 91 PID 2108 wrote to memory of 224 2108 svchost.exe 91 PID 3552 wrote to memory of 3972 3552 cmd.exe 93 PID 3552 wrote to memory of 3972 3552 cmd.exe 93 PID 3552 wrote to memory of 3972 3552 cmd.exe 93 PID 3944 wrote to memory of 552 3944 cmd.exe 94 PID 3944 wrote to memory of 552 3944 cmd.exe 94 PID 3944 wrote to memory of 552 3944 cmd.exe 94 -
Views/modifies file attributes 1 TTPs 2 IoCs
pid Process 3972 attrib.exe 552 attrib.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\a0c68d73c01a70d1ed9b984d7a92d7a33d2b6b76fb48774137443c538b9a1035.exe"C:\Users\Admin\AppData\Local\Temp\a0c68d73c01a70d1ed9b984d7a92d7a33d2b6b76fb48774137443c538b9a1035.exe"1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4628 -
C:\Users\Admin\AppData\Local\Temp\svchost.exeC:\Users\Admin\AppData\Local\Temp\svchost.exe2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Checks computer location settings
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2108 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp\svchost.exe" +s +h3⤵
- Suspicious use of WriteProcessMemory
PID:3552 -
C:\Windows\SysWOW64\attrib.exeattrib "C:\Users\Admin\AppData\Local\Temp\svchost.exe" +s +h4⤵
- Sets file to hidden
- Views/modifies file attributes
PID:3972
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp" +s +h3⤵
- Suspicious use of WriteProcessMemory
PID:3944 -
C:\Windows\SysWOW64\attrib.exeattrib "C:\Users\Admin\AppData\Local\Temp" +s +h4⤵
- Sets file to hidden
- Views/modifies file attributes
PID:552
-
-
-
C:\Windows\SysWOW64\notepad.exenotepad3⤵PID:1844
-
-
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\MSDCSC\msdcsc.exe"C:\ProgramData\Microsoft\Windows\Start Menu\Programs\MSDCSC\msdcsc.exe"3⤵
- Executes dropped EXE
PID:224
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.1MB
MD5d881de17aa8f2e2c08cbb7b265f928f9
SHA108936aebc87decf0af6e8eada191062b5e65ac2a
SHA256b3a37093609f9a20ad60b85a9fa9de2ba674cba9b5bd687729440c70ba619ca0
SHA5125f23bfb1b8740247b36ed0ab741738c7d4c949736129e767213e321607d1ccd3e3a8428e4ba44bd28a275b5e3f6206285b1a522514b7ef7ea5e698d90a713d34
-
Filesize
1.1MB
MD5d881de17aa8f2e2c08cbb7b265f928f9
SHA108936aebc87decf0af6e8eada191062b5e65ac2a
SHA256b3a37093609f9a20ad60b85a9fa9de2ba674cba9b5bd687729440c70ba619ca0
SHA5125f23bfb1b8740247b36ed0ab741738c7d4c949736129e767213e321607d1ccd3e3a8428e4ba44bd28a275b5e3f6206285b1a522514b7ef7ea5e698d90a713d34
-
Filesize
1.1MB
MD5d881de17aa8f2e2c08cbb7b265f928f9
SHA108936aebc87decf0af6e8eada191062b5e65ac2a
SHA256b3a37093609f9a20ad60b85a9fa9de2ba674cba9b5bd687729440c70ba619ca0
SHA5125f23bfb1b8740247b36ed0ab741738c7d4c949736129e767213e321607d1ccd3e3a8428e4ba44bd28a275b5e3f6206285b1a522514b7ef7ea5e698d90a713d34
-
Filesize
1.1MB
MD5d881de17aa8f2e2c08cbb7b265f928f9
SHA108936aebc87decf0af6e8eada191062b5e65ac2a
SHA256b3a37093609f9a20ad60b85a9fa9de2ba674cba9b5bd687729440c70ba619ca0
SHA5125f23bfb1b8740247b36ed0ab741738c7d4c949736129e767213e321607d1ccd3e3a8428e4ba44bd28a275b5e3f6206285b1a522514b7ef7ea5e698d90a713d34