Analysis
- max time kernel
153s - max time network
156s - platform
windows10-2004_x64 - resource
win10v2004-20220812-en - resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system - submitted
17/10/2022, 23:30
Behavioral task
behavioral1
Sample
cfcec6c8cf70f706967aa83596fa301a86685059869e6d5183cd1a6ebd8ef429.exe
Resource
win7-20220812-en
windows7-x64
22 signatures
150 seconds
General
- Target cfcec6c8cf70f706967aa83596fa301a86685059869e6d5183cd1a6ebd8ef429.exe
- Size 28.3MB
- Sample221017-3hhkvadhbl
- SHA256 cfcec6c8cf70f706967aa83596fa301a86685059869e6d5183cd1a6ebd8ef429
- MD5 668c94eba455cc5ff70d132c321418ec
- SHA1 02b9bc9efda3e7d1269a3c6d9dbcb04691a0416c
- SHA512 4802bdf6cce94b4fd065affc5ff9470cf9a9892a2963df2567a28390ba3603456173f2571a3ae39ce08dc26b059cea5b2ea35865f732c24230059dbd0582185a
- SSDEEP 786432:m5NgWSIq8kjHIVkNXqp5jIqsL9wMkuhVGxxGM+LePAREz+UNK/:mvp9GHIVkNap5jFC+Mkuh+GJLexTi
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Extracted
Family
-
darkcomet
Botnet
-
Sazan
C2
-
46.1.103.13:1604
Mutex
-
DC_MUTEX-LFFAWM6
Attributes
-
InstallPath
MSDCSC\msdcsc.exe
-
gencode
8mlW7yUboqwX
-
install
true
-
offline_keylogger
true
-
persistence
true
-
reg_key
MicroUpdate
Signatures
- Modifies WinLogon for persistence 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe" cfcec6c8cf70f706967aa83596fa301a86685059869e6d5183cd1a6ebd8ef429.exe - Modifies security service 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wscsvc\Start = "4" msdcsc.exe -
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" msdcsc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" msdcsc.exe - Executes dropped EXE 2 IoCs
pid Process 2960 CG_LOADER.EXE 4192 msdcsc.exe - Sets file to hidden 1 TTPs 1 IoCs
Modifies file attributes to stop it showing in Explorer etc.
pid Process 1472 attrib.exe -
resource yara_rule behavioral2/files/0x0007000000022f6d-135.dat vmprotect behavioral2/files/0x0007000000022f6d-136.dat vmprotect behavioral2/memory/2960-141-0x0000000000110000-0x0000000001C9C000-memory.dmp vmprotect - Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation cfcec6c8cf70f706967aa83596fa301a86685059869e6d5183cd1a6ebd8ef429.exe -
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" msdcsc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" msdcsc.exe - Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Windows\\system32\\MSDCSC\\msdcsc.exe" cfcec6c8cf70f706967aa83596fa301a86685059869e6d5183cd1a6ebd8ef429.exe Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Windows\\system32\\MSDCSC\\msdcsc.exe" msdcsc.exe - Drops file in System32 directory 3 IoCs
description ioc Process File created C:\Windows\SysWOW64\MSDCSC\msdcsc.exe cfcec6c8cf70f706967aa83596fa301a86685059869e6d5183cd1a6ebd8ef429.exe File opened for modification C:\Windows\SysWOW64\MSDCSC\msdcsc.exe cfcec6c8cf70f706967aa83596fa301a86685059869e6d5183cd1a6ebd8ef429.exe File opened for modification C:\Windows\SysWOW64\MSDCSC\ cfcec6c8cf70f706967aa83596fa301a86685059869e6d5183cd1a6ebd8ef429.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 2960 CG_LOADER.EXE - Suspicious use of AdjustPrivilegeToken 49 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 4932 cfcec6c8cf70f706967aa83596fa301a86685059869e6d5183cd1a6ebd8ef429.exe Token: SeSecurityPrivilege 4932 cfcec6c8cf70f706967aa83596fa301a86685059869e6d5183cd1a6ebd8ef429.exe Token: SeTakeOwnershipPrivilege 4932 cfcec6c8cf70f706967aa83596fa301a86685059869e6d5183cd1a6ebd8ef429.exe Token: SeLoadDriverPrivilege 4932 cfcec6c8cf70f706967aa83596fa301a86685059869e6d5183cd1a6ebd8ef429.exe Token: SeSystemProfilePrivilege 4932 cfcec6c8cf70f706967aa83596fa301a86685059869e6d5183cd1a6ebd8ef429.exe Token: SeSystemtimePrivilege 4932 cfcec6c8cf70f706967aa83596fa301a86685059869e6d5183cd1a6ebd8ef429.exe Token: SeProfSingleProcessPrivilege 4932 cfcec6c8cf70f706967aa83596fa301a86685059869e6d5183cd1a6ebd8ef429.exe Token: SeIncBasePriorityPrivilege 4932 cfcec6c8cf70f706967aa83596fa301a86685059869e6d5183cd1a6ebd8ef429.exe Token: SeCreatePagefilePrivilege 4932 cfcec6c8cf70f706967aa83596fa301a86685059869e6d5183cd1a6ebd8ef429.exe Token: SeBackupPrivilege 4932 cfcec6c8cf70f706967aa83596fa301a86685059869e6d5183cd1a6ebd8ef429.exe Token: SeRestorePrivilege 4932 cfcec6c8cf70f706967aa83596fa301a86685059869e6d5183cd1a6ebd8ef429.exe Token: SeShutdownPrivilege 4932 cfcec6c8cf70f706967aa83596fa301a86685059869e6d5183cd1a6ebd8ef429.exe Token: SeDebugPrivilege 4932 cfcec6c8cf70f706967aa83596fa301a86685059869e6d5183cd1a6ebd8ef429.exe Token: SeSystemEnvironmentPrivilege 4932 cfcec6c8cf70f706967aa83596fa301a86685059869e6d5183cd1a6ebd8ef429.exe Token: SeChangeNotifyPrivilege 4932 cfcec6c8cf70f706967aa83596fa301a86685059869e6d5183cd1a6ebd8ef429.exe Token: SeRemoteShutdownPrivilege 4932 cfcec6c8cf70f706967aa83596fa301a86685059869e6d5183cd1a6ebd8ef429.exe Token: SeUndockPrivilege 4932 cfcec6c8cf70f706967aa83596fa301a86685059869e6d5183cd1a6ebd8ef429.exe Token: SeManageVolumePrivilege 4932 cfcec6c8cf70f706967aa83596fa301a86685059869e6d5183cd1a6ebd8ef429.exe Token: SeImpersonatePrivilege 4932 cfcec6c8cf70f706967aa83596fa301a86685059869e6d5183cd1a6ebd8ef429.exe Token: SeCreateGlobalPrivilege 4932 cfcec6c8cf70f706967aa83596fa301a86685059869e6d5183cd1a6ebd8ef429.exe Token: 33 4932 cfcec6c8cf70f706967aa83596fa301a86685059869e6d5183cd1a6ebd8ef429.exe Token: 34 4932 cfcec6c8cf70f706967aa83596fa301a86685059869e6d5183cd1a6ebd8ef429.exe Token: 35 4932 cfcec6c8cf70f706967aa83596fa301a86685059869e6d5183cd1a6ebd8ef429.exe Token: 36 4932 cfcec6c8cf70f706967aa83596fa301a86685059869e6d5183cd1a6ebd8ef429.exe Token: SeIncreaseQuotaPrivilege 4192 msdcsc.exe Token: SeSecurityPrivilege 4192 msdcsc.exe Token: SeTakeOwnershipPrivilege 4192 msdcsc.exe Token: SeLoadDriverPrivilege 4192 msdcsc.exe Token: SeSystemProfilePrivilege 4192 msdcsc.exe Token: SeSystemtimePrivilege 4192 msdcsc.exe Token: SeProfSingleProcessPrivilege 4192 msdcsc.exe Token: SeIncBasePriorityPrivilege 4192 msdcsc.exe Token: SeCreatePagefilePrivilege 4192 msdcsc.exe Token: SeBackupPrivilege 4192 msdcsc.exe Token: SeRestorePrivilege 4192 msdcsc.exe Token: SeShutdownPrivilege 4192 msdcsc.exe Token: SeDebugPrivilege 4192 msdcsc.exe Token: SeSystemEnvironmentPrivilege 4192 msdcsc.exe Token: SeChangeNotifyPrivilege 4192 msdcsc.exe Token: SeRemoteShutdownPrivilege 4192 msdcsc.exe Token: SeUndockPrivilege 4192 msdcsc.exe Token: SeManageVolumePrivilege 4192 msdcsc.exe Token: SeImpersonatePrivilege 4192 msdcsc.exe Token: SeCreateGlobalPrivilege 4192 msdcsc.exe Token: 33 4192 msdcsc.exe Token: 34 4192 msdcsc.exe Token: 35 4192 msdcsc.exe Token: 36 4192 msdcsc.exe Token: SeDebugPrivilege 2960 CG_LOADER.EXE - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 4192 msdcsc.exe - Suspicious use of WriteProcessMemory 34 IoCs
description pid Process procid_target PID 4932 wrote to memory of 1568 4932 cfcec6c8cf70f706967aa83596fa301a86685059869e6d5183cd1a6ebd8ef429.exe 84 PID 4932 wrote to memory of 1568 4932 cfcec6c8cf70f706967aa83596fa301a86685059869e6d5183cd1a6ebd8ef429.exe 84 PID 4932 wrote to memory of 1568 4932 cfcec6c8cf70f706967aa83596fa301a86685059869e6d5183cd1a6ebd8ef429.exe 84 PID 1568 wrote to memory of 1472 1568 cmd.exe 86 PID 1568 wrote to memory of 1472 1568 cmd.exe 86 PID 1568 wrote to memory of 1472 1568 cmd.exe 86 PID 4932 wrote to memory of 2960 4932 cfcec6c8cf70f706967aa83596fa301a86685059869e6d5183cd1a6ebd8ef429.exe 87 PID 4932 wrote to memory of 2960 4932 cfcec6c8cf70f706967aa83596fa301a86685059869e6d5183cd1a6ebd8ef429.exe 87 PID 4932 wrote to memory of 2960 4932 cfcec6c8cf70f706967aa83596fa301a86685059869e6d5183cd1a6ebd8ef429.exe 87 PID 4932 wrote to memory of 4192 4932 cfcec6c8cf70f706967aa83596fa301a86685059869e6d5183cd1a6ebd8ef429.exe 88 PID 4932 wrote to memory of 4192 4932 cfcec6c8cf70f706967aa83596fa301a86685059869e6d5183cd1a6ebd8ef429.exe 88 PID 4932 wrote to memory of 4192 4932 cfcec6c8cf70f706967aa83596fa301a86685059869e6d5183cd1a6ebd8ef429.exe 88 PID 4192 wrote to memory of 364 4192 msdcsc.exe 89 PID 4192 wrote to memory of 364 4192 msdcsc.exe 89 PID 4192 wrote to memory of 364 4192 msdcsc.exe 89 PID 4192 wrote to memory of 364 4192 msdcsc.exe 89 PID 4192 wrote to memory of 364 4192 msdcsc.exe 89 PID 4192 wrote to memory of 364 4192 msdcsc.exe 89 PID 4192 wrote to memory of 364 4192 msdcsc.exe 89 PID 4192 wrote to memory of 364 4192 msdcsc.exe 89 PID 4192 wrote to memory of 364 4192 msdcsc.exe 89 PID 4192 wrote to memory of 364 4192 msdcsc.exe 89 PID 4192 wrote to memory of 364 4192 msdcsc.exe 89 PID 4192 wrote to memory of 364 4192 msdcsc.exe 89 PID 4192 wrote to memory of 364 4192 msdcsc.exe 89 PID 4192 wrote to memory of 364 4192 msdcsc.exe 89 PID 4192 wrote to memory of 364 4192 msdcsc.exe 89 PID 4192 wrote to memory of 364 4192 msdcsc.exe 89 PID 4192 wrote to memory of 364 4192 msdcsc.exe 89 PID 4192 wrote to memory of 364 4192 msdcsc.exe 89 PID 4192 wrote to memory of 364 4192 msdcsc.exe 89 PID 4192 wrote to memory of 364 4192 msdcsc.exe 89 PID 4192 wrote to memory of 364 4192 msdcsc.exe 89 PID 4192 wrote to memory of 364 4192 msdcsc.exe 89 - System policy modification 1 TTPs 3 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\CurrentVersion msdcsc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\CurrentVersion\Explorern msdcsc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\CurrentVersion\Explorern\NoControlPanel = "1" msdcsc.exe - Views/modifies file attributes 1 TTPs 1 IoCs
pid Process 1472 attrib.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\cfcec6c8cf70f706967aa83596fa301a86685059869e6d5183cd1a6ebd8ef429.exe"C:\Users\Admin\AppData\Local\Temp\cfcec6c8cf70f706967aa83596fa301a86685059869e6d5183cd1a6ebd8ef429.exe"1⤵
- Modifies WinLogon for persistence
- Checks computer location settings
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4932 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp" +s +h2⤵
- Suspicious use of WriteProcessMemory
PID:1568 -
C:\Windows\SysWOW64\attrib.exeattrib "C:\Users\Admin\AppData\Local\Temp" +s +h3⤵
- Sets file to hidden
- Views/modifies file attributes
PID:1472
-
-
-
C:\Users\Admin\AppData\Local\Temp\CG_LOADER.EXE"C:\Users\Admin\AppData\Local\Temp\CG_LOADER.EXE"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2960
-
-
C:\Windows\SysWOW64\MSDCSC\msdcsc.exe"C:\Windows\system32\MSDCSC\msdcsc.exe"2⤵
- Modifies security service
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:4192 -
C:\Windows\SysWOW64\notepad.exenotepad3⤵PID:364
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\CG_LOADER.EXE
- Size 27.6MB
- SHA256 6f956e7712bbe4387bb2d7b5028bd7cae4927cf3212b98e3a8cce127cd4e9cb0
- MD5 345fc46071de77ab039482051ef3fcff
- SHA1 e9e3ace58241d3c4531ac0093579c99a88276751
- SHA512 a6d11fab37c1e464f9a9e10324456b20da72cbb74079983919d4f27fd8b750233af03ef46677f6b85aa0a8fe7f15c4688e7883903e345da044055f3b68097081
- SSDEEP 786432:V5NgWSIq8kjHIVkNXqp5jIqsL9wMkuhVGxxGM+LePAREz+UNK:Vvp9GHIVkNap5jFC+Mkuh+GJLexT
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\CG_LOADER.EXE
- Size 27.6MB
- SHA256 6f956e7712bbe4387bb2d7b5028bd7cae4927cf3212b98e3a8cce127cd4e9cb0
- MD5 345fc46071de77ab039482051ef3fcff
- SHA1 e9e3ace58241d3c4531ac0093579c99a88276751
- SHA512 a6d11fab37c1e464f9a9e10324456b20da72cbb74079983919d4f27fd8b750233af03ef46677f6b85aa0a8fe7f15c4688e7883903e345da044055f3b68097081
- SSDEEP 786432:V5NgWSIq8kjHIVkNXqp5jIqsL9wMkuhVGxxGM+LePAREz+UNK:Vvp9GHIVkNap5jFC+Mkuh+GJLexT
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\SysWOW64\MSDCSC\msdcsc.exe
- Size 28.3MB
- SHA256 cfcec6c8cf70f706967aa83596fa301a86685059869e6d5183cd1a6ebd8ef429
- MD5 668c94eba455cc5ff70d132c321418ec
- SHA1 02b9bc9efda3e7d1269a3c6d9dbcb04691a0416c
- SHA512 4802bdf6cce94b4fd065affc5ff9470cf9a9892a2963df2567a28390ba3603456173f2571a3ae39ce08dc26b059cea5b2ea35865f732c24230059dbd0582185a
- SSDEEP 786432:m5NgWSIq8kjHIVkNXqp5jIqsL9wMkuhVGxxGM+LePAREz+UNK/:mvp9GHIVkNap5jFC+Mkuh+GJLexTi
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\SysWOW64\MSDCSC\msdcsc.exe
- Size 28.3MB
- SHA256 cfcec6c8cf70f706967aa83596fa301a86685059869e6d5183cd1a6ebd8ef429
- MD5 668c94eba455cc5ff70d132c321418ec
- SHA1 02b9bc9efda3e7d1269a3c6d9dbcb04691a0416c
- SHA512 4802bdf6cce94b4fd065affc5ff9470cf9a9892a2963df2567a28390ba3603456173f2571a3ae39ce08dc26b059cea5b2ea35865f732c24230059dbd0582185a
- SSDEEP 786432:m5NgWSIq8kjHIVkNXqp5jIqsL9wMkuhVGxxGM+LePAREz+UNK/:mvp9GHIVkNap5jFC+Mkuh+GJLexTi
- MD5 SHA1 SHA512 SSDEEP