Analysis
-
max time kernel
150s -
max time network
142s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
17-10-2022 23:40
Behavioral task
behavioral1
Sample
b6e8f0a74f60902d4704b8ffc1809eef7d8a6b84b3115567d279ce05d2b94408.exe
Resource
win7-20220812-en
General
-
Target
b6e8f0a74f60902d4704b8ffc1809eef7d8a6b84b3115567d279ce05d2b94408.exe
-
Size
28.3MB
-
MD5
a8c3d088e1c5ca58a0f31a08138fac05
-
SHA1
efc36b45cf34404dcab19e2e4d4d7073432ff546
-
SHA256
b6e8f0a74f60902d4704b8ffc1809eef7d8a6b84b3115567d279ce05d2b94408
-
SHA512
e722588f9bdf7a3319b67c09316c10f8368d99f414194cfa914fefd7fbc628dd3500fd1d86169f216baf1840a4cc52b759324a82cd00f4d052a20f0fe60fc4d1
-
SSDEEP
786432:Y5NgWSIq8kjHIVkNXqp5jIqsL9wMkuhVGxxGM+LePAREz+UNKf:Yvp9GHIVkNap5jFC+Mkuh+GJLexTm
Malware Config
Extracted
darkcomet
Sazan
46.1.103.13:1604
DC_MUTEX-78WFCKJ
-
InstallPath
MSDCSC\msdcsc.exe
-
gencode
9znNAlkh1dw0
-
install
true
-
offline_keylogger
true
-
persistence
true
-
reg_key
MicroUpdate
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
Processes:
b6e8f0a74f60902d4704b8ffc1809eef7d8a6b84b3115567d279ce05d2b94408.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe" b6e8f0a74f60902d4704b8ffc1809eef7d8a6b84b3115567d279ce05d2b94408.exe -
Modifies security service 2 TTPs 1 IoCs
Processes:
msdcsc.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wscsvc\Start = "4" msdcsc.exe -
Processes:
msdcsc.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" msdcsc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" msdcsc.exe -
Executes dropped EXE 3 IoCs
Processes:
CG_LOADER.EXEmsdcsc.exeCG_LOADER.EXEpid process 1952 CG_LOADER.EXE 4968 msdcsc.exe 4740 CG_LOADER.EXE -
Sets file to hidden 1 TTPs 1 IoCs
Modifies file attributes to stop it showing in Explorer etc.
-
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\CG_LOADER.EXE vmprotect C:\Users\Admin\AppData\Local\Temp\CG_LOADER.EXE vmprotect behavioral2/memory/1952-140-0x00000000009D0000-0x000000000255C000-memory.dmp vmprotect C:\Users\Admin\AppData\Local\Temp\CG_LOADER.EXE vmprotect -
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
b6e8f0a74f60902d4704b8ffc1809eef7d8a6b84b3115567d279ce05d2b94408.exemsdcsc.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation b6e8f0a74f60902d4704b8ffc1809eef7d8a6b84b3115567d279ce05d2b94408.exe Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation msdcsc.exe -
Processes:
msdcsc.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" msdcsc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" msdcsc.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
b6e8f0a74f60902d4704b8ffc1809eef7d8a6b84b3115567d279ce05d2b94408.exemsdcsc.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Windows\\system32\\MSDCSC\\msdcsc.exe" b6e8f0a74f60902d4704b8ffc1809eef7d8a6b84b3115567d279ce05d2b94408.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Windows\\system32\\MSDCSC\\msdcsc.exe" msdcsc.exe -
Drops file in System32 directory 3 IoCs
Processes:
b6e8f0a74f60902d4704b8ffc1809eef7d8a6b84b3115567d279ce05d2b94408.exedescription ioc process File created C:\Windows\SysWOW64\MSDCSC\msdcsc.exe b6e8f0a74f60902d4704b8ffc1809eef7d8a6b84b3115567d279ce05d2b94408.exe File opened for modification C:\Windows\SysWOW64\MSDCSC\msdcsc.exe b6e8f0a74f60902d4704b8ffc1809eef7d8a6b84b3115567d279ce05d2b94408.exe File opened for modification C:\Windows\SysWOW64\MSDCSC\ b6e8f0a74f60902d4704b8ffc1809eef7d8a6b84b3115567d279ce05d2b94408.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
CG_LOADER.EXECG_LOADER.EXEpid process 1952 CG_LOADER.EXE 4740 CG_LOADER.EXE -
Suspicious use of AdjustPrivilegeToken 50 IoCs
Processes:
b6e8f0a74f60902d4704b8ffc1809eef7d8a6b84b3115567d279ce05d2b94408.exemsdcsc.exeCG_LOADER.EXECG_LOADER.EXEdescription pid process Token: SeIncreaseQuotaPrivilege 4408 b6e8f0a74f60902d4704b8ffc1809eef7d8a6b84b3115567d279ce05d2b94408.exe Token: SeSecurityPrivilege 4408 b6e8f0a74f60902d4704b8ffc1809eef7d8a6b84b3115567d279ce05d2b94408.exe Token: SeTakeOwnershipPrivilege 4408 b6e8f0a74f60902d4704b8ffc1809eef7d8a6b84b3115567d279ce05d2b94408.exe Token: SeLoadDriverPrivilege 4408 b6e8f0a74f60902d4704b8ffc1809eef7d8a6b84b3115567d279ce05d2b94408.exe Token: SeSystemProfilePrivilege 4408 b6e8f0a74f60902d4704b8ffc1809eef7d8a6b84b3115567d279ce05d2b94408.exe Token: SeSystemtimePrivilege 4408 b6e8f0a74f60902d4704b8ffc1809eef7d8a6b84b3115567d279ce05d2b94408.exe Token: SeProfSingleProcessPrivilege 4408 b6e8f0a74f60902d4704b8ffc1809eef7d8a6b84b3115567d279ce05d2b94408.exe Token: SeIncBasePriorityPrivilege 4408 b6e8f0a74f60902d4704b8ffc1809eef7d8a6b84b3115567d279ce05d2b94408.exe Token: SeCreatePagefilePrivilege 4408 b6e8f0a74f60902d4704b8ffc1809eef7d8a6b84b3115567d279ce05d2b94408.exe Token: SeBackupPrivilege 4408 b6e8f0a74f60902d4704b8ffc1809eef7d8a6b84b3115567d279ce05d2b94408.exe Token: SeRestorePrivilege 4408 b6e8f0a74f60902d4704b8ffc1809eef7d8a6b84b3115567d279ce05d2b94408.exe Token: SeShutdownPrivilege 4408 b6e8f0a74f60902d4704b8ffc1809eef7d8a6b84b3115567d279ce05d2b94408.exe Token: SeDebugPrivilege 4408 b6e8f0a74f60902d4704b8ffc1809eef7d8a6b84b3115567d279ce05d2b94408.exe Token: SeSystemEnvironmentPrivilege 4408 b6e8f0a74f60902d4704b8ffc1809eef7d8a6b84b3115567d279ce05d2b94408.exe Token: SeChangeNotifyPrivilege 4408 b6e8f0a74f60902d4704b8ffc1809eef7d8a6b84b3115567d279ce05d2b94408.exe Token: SeRemoteShutdownPrivilege 4408 b6e8f0a74f60902d4704b8ffc1809eef7d8a6b84b3115567d279ce05d2b94408.exe Token: SeUndockPrivilege 4408 b6e8f0a74f60902d4704b8ffc1809eef7d8a6b84b3115567d279ce05d2b94408.exe Token: SeManageVolumePrivilege 4408 b6e8f0a74f60902d4704b8ffc1809eef7d8a6b84b3115567d279ce05d2b94408.exe Token: SeImpersonatePrivilege 4408 b6e8f0a74f60902d4704b8ffc1809eef7d8a6b84b3115567d279ce05d2b94408.exe Token: SeCreateGlobalPrivilege 4408 b6e8f0a74f60902d4704b8ffc1809eef7d8a6b84b3115567d279ce05d2b94408.exe Token: 33 4408 b6e8f0a74f60902d4704b8ffc1809eef7d8a6b84b3115567d279ce05d2b94408.exe Token: 34 4408 b6e8f0a74f60902d4704b8ffc1809eef7d8a6b84b3115567d279ce05d2b94408.exe Token: 35 4408 b6e8f0a74f60902d4704b8ffc1809eef7d8a6b84b3115567d279ce05d2b94408.exe Token: 36 4408 b6e8f0a74f60902d4704b8ffc1809eef7d8a6b84b3115567d279ce05d2b94408.exe Token: SeIncreaseQuotaPrivilege 4968 msdcsc.exe Token: SeSecurityPrivilege 4968 msdcsc.exe Token: SeTakeOwnershipPrivilege 4968 msdcsc.exe Token: SeLoadDriverPrivilege 4968 msdcsc.exe Token: SeSystemProfilePrivilege 4968 msdcsc.exe Token: SeSystemtimePrivilege 4968 msdcsc.exe Token: SeProfSingleProcessPrivilege 4968 msdcsc.exe Token: SeIncBasePriorityPrivilege 4968 msdcsc.exe Token: SeCreatePagefilePrivilege 4968 msdcsc.exe Token: SeBackupPrivilege 4968 msdcsc.exe Token: SeRestorePrivilege 4968 msdcsc.exe Token: SeShutdownPrivilege 4968 msdcsc.exe Token: SeDebugPrivilege 4968 msdcsc.exe Token: SeSystemEnvironmentPrivilege 4968 msdcsc.exe Token: SeChangeNotifyPrivilege 4968 msdcsc.exe Token: SeRemoteShutdownPrivilege 4968 msdcsc.exe Token: SeUndockPrivilege 4968 msdcsc.exe Token: SeManageVolumePrivilege 4968 msdcsc.exe Token: SeImpersonatePrivilege 4968 msdcsc.exe Token: SeCreateGlobalPrivilege 4968 msdcsc.exe Token: 33 4968 msdcsc.exe Token: 34 4968 msdcsc.exe Token: 35 4968 msdcsc.exe Token: 36 4968 msdcsc.exe Token: SeDebugPrivilege 1952 CG_LOADER.EXE Token: SeDebugPrivilege 4740 CG_LOADER.EXE -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
msdcsc.exepid process 4968 msdcsc.exe -
Suspicious use of WriteProcessMemory 37 IoCs
Processes:
b6e8f0a74f60902d4704b8ffc1809eef7d8a6b84b3115567d279ce05d2b94408.execmd.exemsdcsc.exedescription pid process target process PID 4408 wrote to memory of 4524 4408 b6e8f0a74f60902d4704b8ffc1809eef7d8a6b84b3115567d279ce05d2b94408.exe cmd.exe PID 4408 wrote to memory of 4524 4408 b6e8f0a74f60902d4704b8ffc1809eef7d8a6b84b3115567d279ce05d2b94408.exe cmd.exe PID 4408 wrote to memory of 4524 4408 b6e8f0a74f60902d4704b8ffc1809eef7d8a6b84b3115567d279ce05d2b94408.exe cmd.exe PID 4524 wrote to memory of 3464 4524 cmd.exe attrib.exe PID 4524 wrote to memory of 3464 4524 cmd.exe attrib.exe PID 4524 wrote to memory of 3464 4524 cmd.exe attrib.exe PID 4408 wrote to memory of 1952 4408 b6e8f0a74f60902d4704b8ffc1809eef7d8a6b84b3115567d279ce05d2b94408.exe CG_LOADER.EXE PID 4408 wrote to memory of 1952 4408 b6e8f0a74f60902d4704b8ffc1809eef7d8a6b84b3115567d279ce05d2b94408.exe CG_LOADER.EXE PID 4408 wrote to memory of 1952 4408 b6e8f0a74f60902d4704b8ffc1809eef7d8a6b84b3115567d279ce05d2b94408.exe CG_LOADER.EXE PID 4408 wrote to memory of 4968 4408 b6e8f0a74f60902d4704b8ffc1809eef7d8a6b84b3115567d279ce05d2b94408.exe msdcsc.exe PID 4408 wrote to memory of 4968 4408 b6e8f0a74f60902d4704b8ffc1809eef7d8a6b84b3115567d279ce05d2b94408.exe msdcsc.exe PID 4408 wrote to memory of 4968 4408 b6e8f0a74f60902d4704b8ffc1809eef7d8a6b84b3115567d279ce05d2b94408.exe msdcsc.exe PID 4968 wrote to memory of 4740 4968 msdcsc.exe CG_LOADER.EXE PID 4968 wrote to memory of 4740 4968 msdcsc.exe CG_LOADER.EXE PID 4968 wrote to memory of 4740 4968 msdcsc.exe CG_LOADER.EXE PID 4968 wrote to memory of 3776 4968 msdcsc.exe notepad.exe PID 4968 wrote to memory of 3776 4968 msdcsc.exe notepad.exe PID 4968 wrote to memory of 3776 4968 msdcsc.exe notepad.exe PID 4968 wrote to memory of 3776 4968 msdcsc.exe notepad.exe PID 4968 wrote to memory of 3776 4968 msdcsc.exe notepad.exe PID 4968 wrote to memory of 3776 4968 msdcsc.exe notepad.exe PID 4968 wrote to memory of 3776 4968 msdcsc.exe notepad.exe PID 4968 wrote to memory of 3776 4968 msdcsc.exe notepad.exe PID 4968 wrote to memory of 3776 4968 msdcsc.exe notepad.exe PID 4968 wrote to memory of 3776 4968 msdcsc.exe notepad.exe PID 4968 wrote to memory of 3776 4968 msdcsc.exe notepad.exe PID 4968 wrote to memory of 3776 4968 msdcsc.exe notepad.exe PID 4968 wrote to memory of 3776 4968 msdcsc.exe notepad.exe PID 4968 wrote to memory of 3776 4968 msdcsc.exe notepad.exe PID 4968 wrote to memory of 3776 4968 msdcsc.exe notepad.exe PID 4968 wrote to memory of 3776 4968 msdcsc.exe notepad.exe PID 4968 wrote to memory of 3776 4968 msdcsc.exe notepad.exe PID 4968 wrote to memory of 3776 4968 msdcsc.exe notepad.exe PID 4968 wrote to memory of 3776 4968 msdcsc.exe notepad.exe PID 4968 wrote to memory of 3776 4968 msdcsc.exe notepad.exe PID 4968 wrote to memory of 3776 4968 msdcsc.exe notepad.exe PID 4968 wrote to memory of 3776 4968 msdcsc.exe notepad.exe -
System policy modification 1 TTPs 3 IoCs
Processes:
msdcsc.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\CurrentVersion msdcsc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\CurrentVersion\Explorern msdcsc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\CurrentVersion\Explorern\NoControlPanel = "1" msdcsc.exe -
Views/modifies file attributes 1 TTPs 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\b6e8f0a74f60902d4704b8ffc1809eef7d8a6b84b3115567d279ce05d2b94408.exe"C:\Users\Admin\AppData\Local\Temp\b6e8f0a74f60902d4704b8ffc1809eef7d8a6b84b3115567d279ce05d2b94408.exe"1⤵
- Modifies WinLogon for persistence
- Checks computer location settings
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp" +s +h2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Users\Admin\AppData\Local\Temp" +s +h3⤵
- Sets file to hidden
- Views/modifies file attributes
-
C:\Users\Admin\AppData\Local\Temp\CG_LOADER.EXE"C:\Users\Admin\AppData\Local\Temp\CG_LOADER.EXE"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\MSDCSC\msdcsc.exe"C:\Windows\system32\MSDCSC\msdcsc.exe"2⤵
- Modifies security service
- Windows security bypass
- Executes dropped EXE
- Checks computer location settings
- Windows security modification
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Users\Admin\AppData\Local\Temp\CG_LOADER.EXE"C:\Users\Admin\AppData\Local\Temp\CG_LOADER.EXE"3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\notepad.exenotepad3⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\CG_LOADER.EXE.logFilesize
1KB
MD5d3640412243c020be8722b058490cb8a
SHA11eb3070a3e11e812d9c6ea909162b80219bc1d3f
SHA256f494314d3bfc5eb670c6a998a9839ee09a243de8a256814b84d306ed5c1d522d
SHA512565b69be118f0af17bda6be19ecd5b2c04c283d48344d78d805ad331234c5e59df3b0771f8ebd7b3aad2d7e0ef54aef7adcc89d076c0c7fad75f48efc0fa5d87
-
C:\Users\Admin\AppData\Local\Temp\CG_LOADER.EXEFilesize
27.6MB
MD5345fc46071de77ab039482051ef3fcff
SHA1e9e3ace58241d3c4531ac0093579c99a88276751
SHA2566f956e7712bbe4387bb2d7b5028bd7cae4927cf3212b98e3a8cce127cd4e9cb0
SHA512a6d11fab37c1e464f9a9e10324456b20da72cbb74079983919d4f27fd8b750233af03ef46677f6b85aa0a8fe7f15c4688e7883903e345da044055f3b68097081
-
C:\Users\Admin\AppData\Local\Temp\CG_LOADER.EXEFilesize
27.6MB
MD5345fc46071de77ab039482051ef3fcff
SHA1e9e3ace58241d3c4531ac0093579c99a88276751
SHA2566f956e7712bbe4387bb2d7b5028bd7cae4927cf3212b98e3a8cce127cd4e9cb0
SHA512a6d11fab37c1e464f9a9e10324456b20da72cbb74079983919d4f27fd8b750233af03ef46677f6b85aa0a8fe7f15c4688e7883903e345da044055f3b68097081
-
C:\Users\Admin\AppData\Local\Temp\CG_LOADER.EXEFilesize
27.6MB
MD5345fc46071de77ab039482051ef3fcff
SHA1e9e3ace58241d3c4531ac0093579c99a88276751
SHA2566f956e7712bbe4387bb2d7b5028bd7cae4927cf3212b98e3a8cce127cd4e9cb0
SHA512a6d11fab37c1e464f9a9e10324456b20da72cbb74079983919d4f27fd8b750233af03ef46677f6b85aa0a8fe7f15c4688e7883903e345da044055f3b68097081
-
C:\Windows\SysWOW64\MSDCSC\msdcsc.exeFilesize
28.3MB
MD5a8c3d088e1c5ca58a0f31a08138fac05
SHA1efc36b45cf34404dcab19e2e4d4d7073432ff546
SHA256b6e8f0a74f60902d4704b8ffc1809eef7d8a6b84b3115567d279ce05d2b94408
SHA512e722588f9bdf7a3319b67c09316c10f8368d99f414194cfa914fefd7fbc628dd3500fd1d86169f216baf1840a4cc52b759324a82cd00f4d052a20f0fe60fc4d1
-
C:\Windows\SysWOW64\MSDCSC\msdcsc.exeFilesize
28.3MB
MD5a8c3d088e1c5ca58a0f31a08138fac05
SHA1efc36b45cf34404dcab19e2e4d4d7073432ff546
SHA256b6e8f0a74f60902d4704b8ffc1809eef7d8a6b84b3115567d279ce05d2b94408
SHA512e722588f9bdf7a3319b67c09316c10f8368d99f414194cfa914fefd7fbc628dd3500fd1d86169f216baf1840a4cc52b759324a82cd00f4d052a20f0fe60fc4d1
-
memory/1952-140-0x00000000009D0000-0x000000000255C000-memory.dmpFilesize
27.5MB
-
memory/1952-134-0x0000000000000000-mapping.dmp
-
memory/1952-144-0x000000000B080000-0x000000000B11C000-memory.dmpFilesize
624KB
-
memory/1952-146-0x000000000B1C0000-0x000000000B252000-memory.dmpFilesize
584KB
-
memory/1952-147-0x000000000B160000-0x000000000B16A000-memory.dmpFilesize
40KB
-
memory/1952-149-0x000000000D530000-0x000000000D6F2000-memory.dmpFilesize
1.8MB
-
memory/3464-133-0x0000000000000000-mapping.dmp
-
memory/3776-143-0x0000000000000000-mapping.dmp
-
memory/4524-132-0x0000000000000000-mapping.dmp
-
memory/4740-141-0x0000000000000000-mapping.dmp
-
memory/4740-145-0x000000000B670000-0x000000000BC14000-memory.dmpFilesize
5.6MB
-
memory/4740-148-0x000000000B310000-0x000000000B366000-memory.dmpFilesize
344KB
-
memory/4968-137-0x0000000000000000-mapping.dmp