Analysis
- max time kernel
152s - max time network
152s - platform
windows10-2004_x64 - resource
win10v2004-20220901-en - resource tags
arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system - submitted
14/10/2022, 02:08
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
c5b562bd08a630debd8ac08101149a50ec4df043e008eac591a3e5bc93848741.exe
Resource
win7-20220812-en
windows7-x64
11 signatures
150 seconds
General
- Target c5b562bd08a630debd8ac08101149a50ec4df043e008eac591a3e5bc93848741.exe
- Size 1002KB
- Sample221014-ckh2aacdaj
- SHA256 c5b562bd08a630debd8ac08101149a50ec4df043e008eac591a3e5bc93848741
- MD5 615a8a118959da36339fcaf5eb3ab980
- SHA1 d3da9eef0f567f60d60da9424f04610b9d74546d
- SHA512 527c41929d2deecc6cb7c01d3128b4512f662c8fa087ca4637a3e71b44fb32591c4963e04681d0eabbf77e22289cb8969e7862290fe0914a6e9f029cef3f2139
- SSDEEP 12288:ahkDgouVA2nxKkorvdRgQriDwOIxmxiZnYQE7PJcE4aCjKWinb5z8l7njrYBOjos:aRmJkcoQricOIQxiZY1iaCjrgUZ
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Extracted
Family
-
darkcomet
Botnet
-
bobo
C2
-
78.250.123.241 :1604
-
cailloux.no-ip.org:1604
Mutex
-
DC_MUTEX-UMGE5Z9
Attributes
-
gencode
znrg1zCcYDsA
-
install
false
-
offline_keylogger
true
-
persistence
false
Signatures
- Modifies WinLogon for persistence 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "%APPDATA%\\Microsoft\\source.exe,explorer.exe" c5b562bd08a630debd8ac08101149a50ec4df043e008eac591a3e5bc93848741.exe - Adds policy Run key to start application 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run c5b562bd08a630debd8ac08101149a50ec4df043e008eac591a3e5bc93848741.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Crystaline = "%APPDATA%\\Microsoft\\source.exe" c5b562bd08a630debd8ac08101149a50ec4df043e008eac591a3e5bc93848741.exe -
resource yara_rule behavioral2/memory/4248-133-0x0000000000400000-0x00000000004B7000-memory.dmp upx behavioral2/memory/4248-134-0x0000000000400000-0x00000000004B7000-memory.dmp upx behavioral2/memory/4248-135-0x0000000000400000-0x00000000004B7000-memory.dmp upx behavioral2/memory/4248-136-0x0000000000400000-0x00000000004B7000-memory.dmp upx behavioral2/memory/4248-138-0x0000000000400000-0x00000000004B7000-memory.dmp upx - Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\windows.lnk c5b562bd08a630debd8ac08101149a50ec4df043e008eac591a3e5bc93848741.exe - Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Crystaline = "%APPDATA%\\Microsoft\\source.exe" c5b562bd08a630debd8ac08101149a50ec4df043e008eac591a3e5bc93848741.exe Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Windows\CurrentVersion\Run c5b562bd08a630debd8ac08101149a50ec4df043e008eac591a3e5bc93848741.exe - Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2168 set thread context of 4248 2168 c5b562bd08a630debd8ac08101149a50ec4df043e008eac591a3e5bc93848741.exe 83 - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Suspicious behavior: RenamesItself 1 IoCs
pid Process 2168 c5b562bd08a630debd8ac08101149a50ec4df043e008eac591a3e5bc93848741.exe - Suspicious use of AdjustPrivilegeToken 24 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 4248 c5b562bd08a630debd8ac08101149a50ec4df043e008eac591a3e5bc93848741.exe Token: SeSecurityPrivilege 4248 c5b562bd08a630debd8ac08101149a50ec4df043e008eac591a3e5bc93848741.exe Token: SeTakeOwnershipPrivilege 4248 c5b562bd08a630debd8ac08101149a50ec4df043e008eac591a3e5bc93848741.exe Token: SeLoadDriverPrivilege 4248 c5b562bd08a630debd8ac08101149a50ec4df043e008eac591a3e5bc93848741.exe Token: SeSystemProfilePrivilege 4248 c5b562bd08a630debd8ac08101149a50ec4df043e008eac591a3e5bc93848741.exe Token: SeSystemtimePrivilege 4248 c5b562bd08a630debd8ac08101149a50ec4df043e008eac591a3e5bc93848741.exe Token: SeProfSingleProcessPrivilege 4248 c5b562bd08a630debd8ac08101149a50ec4df043e008eac591a3e5bc93848741.exe Token: SeIncBasePriorityPrivilege 4248 c5b562bd08a630debd8ac08101149a50ec4df043e008eac591a3e5bc93848741.exe Token: SeCreatePagefilePrivilege 4248 c5b562bd08a630debd8ac08101149a50ec4df043e008eac591a3e5bc93848741.exe Token: SeBackupPrivilege 4248 c5b562bd08a630debd8ac08101149a50ec4df043e008eac591a3e5bc93848741.exe Token: SeRestorePrivilege 4248 c5b562bd08a630debd8ac08101149a50ec4df043e008eac591a3e5bc93848741.exe Token: SeShutdownPrivilege 4248 c5b562bd08a630debd8ac08101149a50ec4df043e008eac591a3e5bc93848741.exe Token: SeDebugPrivilege 4248 c5b562bd08a630debd8ac08101149a50ec4df043e008eac591a3e5bc93848741.exe Token: SeSystemEnvironmentPrivilege 4248 c5b562bd08a630debd8ac08101149a50ec4df043e008eac591a3e5bc93848741.exe Token: SeChangeNotifyPrivilege 4248 c5b562bd08a630debd8ac08101149a50ec4df043e008eac591a3e5bc93848741.exe Token: SeRemoteShutdownPrivilege 4248 c5b562bd08a630debd8ac08101149a50ec4df043e008eac591a3e5bc93848741.exe Token: SeUndockPrivilege 4248 c5b562bd08a630debd8ac08101149a50ec4df043e008eac591a3e5bc93848741.exe Token: SeManageVolumePrivilege 4248 c5b562bd08a630debd8ac08101149a50ec4df043e008eac591a3e5bc93848741.exe Token: SeImpersonatePrivilege 4248 c5b562bd08a630debd8ac08101149a50ec4df043e008eac591a3e5bc93848741.exe Token: SeCreateGlobalPrivilege 4248 c5b562bd08a630debd8ac08101149a50ec4df043e008eac591a3e5bc93848741.exe Token: 33 4248 c5b562bd08a630debd8ac08101149a50ec4df043e008eac591a3e5bc93848741.exe Token: 34 4248 c5b562bd08a630debd8ac08101149a50ec4df043e008eac591a3e5bc93848741.exe Token: 35 4248 c5b562bd08a630debd8ac08101149a50ec4df043e008eac591a3e5bc93848741.exe Token: 36 4248 c5b562bd08a630debd8ac08101149a50ec4df043e008eac591a3e5bc93848741.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 4248 c5b562bd08a630debd8ac08101149a50ec4df043e008eac591a3e5bc93848741.exe - Suspicious use of WriteProcessMemory 28 IoCs
description pid Process procid_target PID 2168 wrote to memory of 4248 2168 c5b562bd08a630debd8ac08101149a50ec4df043e008eac591a3e5bc93848741.exe 83 PID 2168 wrote to memory of 4248 2168 c5b562bd08a630debd8ac08101149a50ec4df043e008eac591a3e5bc93848741.exe 83 PID 2168 wrote to memory of 4248 2168 c5b562bd08a630debd8ac08101149a50ec4df043e008eac591a3e5bc93848741.exe 83 PID 2168 wrote to memory of 4248 2168 c5b562bd08a630debd8ac08101149a50ec4df043e008eac591a3e5bc93848741.exe 83 PID 2168 wrote to memory of 4248 2168 c5b562bd08a630debd8ac08101149a50ec4df043e008eac591a3e5bc93848741.exe 83 PID 2168 wrote to memory of 4248 2168 c5b562bd08a630debd8ac08101149a50ec4df043e008eac591a3e5bc93848741.exe 83 PID 4248 wrote to memory of 3976 4248 c5b562bd08a630debd8ac08101149a50ec4df043e008eac591a3e5bc93848741.exe 84 PID 4248 wrote to memory of 3976 4248 c5b562bd08a630debd8ac08101149a50ec4df043e008eac591a3e5bc93848741.exe 84 PID 4248 wrote to memory of 3976 4248 c5b562bd08a630debd8ac08101149a50ec4df043e008eac591a3e5bc93848741.exe 84 PID 4248 wrote to memory of 3976 4248 c5b562bd08a630debd8ac08101149a50ec4df043e008eac591a3e5bc93848741.exe 84 PID 4248 wrote to memory of 3976 4248 c5b562bd08a630debd8ac08101149a50ec4df043e008eac591a3e5bc93848741.exe 84 PID 4248 wrote to memory of 3976 4248 c5b562bd08a630debd8ac08101149a50ec4df043e008eac591a3e5bc93848741.exe 84 PID 4248 wrote to memory of 3976 4248 c5b562bd08a630debd8ac08101149a50ec4df043e008eac591a3e5bc93848741.exe 84 PID 4248 wrote to memory of 3976 4248 c5b562bd08a630debd8ac08101149a50ec4df043e008eac591a3e5bc93848741.exe 84 PID 4248 wrote to memory of 3976 4248 c5b562bd08a630debd8ac08101149a50ec4df043e008eac591a3e5bc93848741.exe 84 PID 4248 wrote to memory of 3976 4248 c5b562bd08a630debd8ac08101149a50ec4df043e008eac591a3e5bc93848741.exe 84 PID 4248 wrote to memory of 3976 4248 c5b562bd08a630debd8ac08101149a50ec4df043e008eac591a3e5bc93848741.exe 84 PID 4248 wrote to memory of 3976 4248 c5b562bd08a630debd8ac08101149a50ec4df043e008eac591a3e5bc93848741.exe 84 PID 4248 wrote to memory of 3976 4248 c5b562bd08a630debd8ac08101149a50ec4df043e008eac591a3e5bc93848741.exe 84 PID 4248 wrote to memory of 3976 4248 c5b562bd08a630debd8ac08101149a50ec4df043e008eac591a3e5bc93848741.exe 84 PID 4248 wrote to memory of 3976 4248 c5b562bd08a630debd8ac08101149a50ec4df043e008eac591a3e5bc93848741.exe 84 PID 4248 wrote to memory of 3976 4248 c5b562bd08a630debd8ac08101149a50ec4df043e008eac591a3e5bc93848741.exe 84 PID 4248 wrote to memory of 3976 4248 c5b562bd08a630debd8ac08101149a50ec4df043e008eac591a3e5bc93848741.exe 84 PID 4248 wrote to memory of 3976 4248 c5b562bd08a630debd8ac08101149a50ec4df043e008eac591a3e5bc93848741.exe 84 PID 4248 wrote to memory of 3976 4248 c5b562bd08a630debd8ac08101149a50ec4df043e008eac591a3e5bc93848741.exe 84 PID 4248 wrote to memory of 3976 4248 c5b562bd08a630debd8ac08101149a50ec4df043e008eac591a3e5bc93848741.exe 84 PID 4248 wrote to memory of 3976 4248 c5b562bd08a630debd8ac08101149a50ec4df043e008eac591a3e5bc93848741.exe 84 PID 4248 wrote to memory of 3976 4248 c5b562bd08a630debd8ac08101149a50ec4df043e008eac591a3e5bc93848741.exe 84
Processes
-
C:\Users\Admin\AppData\Local\Temp\c5b562bd08a630debd8ac08101149a50ec4df043e008eac591a3e5bc93848741.exe"C:\Users\Admin\AppData\Local\Temp\c5b562bd08a630debd8ac08101149a50ec4df043e008eac591a3e5bc93848741.exe"1⤵
- Modifies WinLogon for persistence
- Adds policy Run key to start application
- Drops startup file
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:2168 -
C:\Users\Admin\AppData\Local\Temp\c5b562bd08a630debd8ac08101149a50ec4df043e008eac591a3e5bc93848741.exe"C:\Users\Admin\AppData\Local\Temp\c5b562bd08a630debd8ac08101149a50ec4df043e008eac591a3e5bc93848741.exe"2⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4248 -
C:\Windows\SysWOW64\notepad.exenotepad3⤵PID:3976
-
-