Analysis
- max time kernel
151s - max time network
144s - platform
windows10-2004_x64 - resource
win10v2004-20220812-en - resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system - submitted
19/10/2022, 13:59
Static task
static1
Behavioral task
behavioral1
Sample
b31ed8fbfb5cb3d7cbbd6ed6833612d58dc2f8134dba21abfbf52cebabc6b6cc.exe
Resource
win7-20220901-en
windows7-x64
2 signatures
150 seconds
General
- Target b31ed8fbfb5cb3d7cbbd6ed6833612d58dc2f8134dba21abfbf52cebabc6b6cc.exe
- Size 982KB
- Sample221019-ranlcaagc5
- SHA256 b31ed8fbfb5cb3d7cbbd6ed6833612d58dc2f8134dba21abfbf52cebabc6b6cc
- MD5 a0c1fbfec528254387068c5a471c78c0
- SHA1 7a63a729e66f99cecf03a325574730a6e0f04ea9
- SHA512 34702fa5bcc0f96da787e2afb28379fbe96aa2aba824d15c9d0b5737acb7d9e2e42c96cd3df5c77c0c28fe63d5adb287b3030234580e7a64adca3a70534be31b
- SSDEEP 24576:LF0YIvvlHlnU6QBDB1FNYV/rO7h5lz+wKJ:GYUzmvYV/rUf6wU
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Extracted
Family
-
darkcomet
Botnet
-
Guest16
C2
-
127.0.0.1:1604
Mutex
-
DC_MUTEX-J6W1DYN
Attributes
-
gencode
aCvj1G0UCC75
-
install
false
-
offline_keylogger
true
-
persistence
false
Signatures
- Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 1368 set thread context of 2332 1368 b31ed8fbfb5cb3d7cbbd6ed6833612d58dc2f8134dba21abfbf52cebabc6b6cc.exe 84 PID 1368 set thread context of 5092 1368 b31ed8fbfb5cb3d7cbbd6ed6833612d58dc2f8134dba21abfbf52cebabc6b6cc.exe 86 - Runs net.exe
- Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 1368 b31ed8fbfb5cb3d7cbbd6ed6833612d58dc2f8134dba21abfbf52cebabc6b6cc.exe 1368 b31ed8fbfb5cb3d7cbbd6ed6833612d58dc2f8134dba21abfbf52cebabc6b6cc.exe 1368 b31ed8fbfb5cb3d7cbbd6ed6833612d58dc2f8134dba21abfbf52cebabc6b6cc.exe 1368 b31ed8fbfb5cb3d7cbbd6ed6833612d58dc2f8134dba21abfbf52cebabc6b6cc.exe - Suspicious use of AdjustPrivilegeToken 48 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 5092 b31ed8fbfb5cb3d7cbbd6ed6833612d58dc2f8134dba21abfbf52cebabc6b6cc.exe Token: SeIncreaseQuotaPrivilege 2332 iexplore.exe Token: SeSecurityPrivilege 5092 b31ed8fbfb5cb3d7cbbd6ed6833612d58dc2f8134dba21abfbf52cebabc6b6cc.exe Token: SeTakeOwnershipPrivilege 5092 b31ed8fbfb5cb3d7cbbd6ed6833612d58dc2f8134dba21abfbf52cebabc6b6cc.exe Token: SeSecurityPrivilege 2332 iexplore.exe Token: SeTakeOwnershipPrivilege 2332 iexplore.exe Token: SeLoadDriverPrivilege 5092 b31ed8fbfb5cb3d7cbbd6ed6833612d58dc2f8134dba21abfbf52cebabc6b6cc.exe Token: SeLoadDriverPrivilege 2332 iexplore.exe Token: SeSystemProfilePrivilege 2332 iexplore.exe Token: SeSystemtimePrivilege 2332 iexplore.exe Token: SeProfSingleProcessPrivilege 2332 iexplore.exe Token: SeSystemProfilePrivilege 5092 b31ed8fbfb5cb3d7cbbd6ed6833612d58dc2f8134dba21abfbf52cebabc6b6cc.exe Token: SeIncBasePriorityPrivilege 2332 iexplore.exe Token: SeSystemtimePrivilege 5092 b31ed8fbfb5cb3d7cbbd6ed6833612d58dc2f8134dba21abfbf52cebabc6b6cc.exe Token: SeCreatePagefilePrivilege 2332 iexplore.exe Token: SeBackupPrivilege 2332 iexplore.exe Token: SeProfSingleProcessPrivilege 5092 b31ed8fbfb5cb3d7cbbd6ed6833612d58dc2f8134dba21abfbf52cebabc6b6cc.exe Token: SeRestorePrivilege 2332 iexplore.exe Token: SeIncBasePriorityPrivilege 5092 b31ed8fbfb5cb3d7cbbd6ed6833612d58dc2f8134dba21abfbf52cebabc6b6cc.exe Token: SeShutdownPrivilege 2332 iexplore.exe Token: SeCreatePagefilePrivilege 5092 b31ed8fbfb5cb3d7cbbd6ed6833612d58dc2f8134dba21abfbf52cebabc6b6cc.exe Token: SeDebugPrivilege 2332 iexplore.exe Token: SeBackupPrivilege 5092 b31ed8fbfb5cb3d7cbbd6ed6833612d58dc2f8134dba21abfbf52cebabc6b6cc.exe Token: SeRestorePrivilege 5092 b31ed8fbfb5cb3d7cbbd6ed6833612d58dc2f8134dba21abfbf52cebabc6b6cc.exe Token: SeSystemEnvironmentPrivilege 2332 iexplore.exe Token: SeShutdownPrivilege 5092 b31ed8fbfb5cb3d7cbbd6ed6833612d58dc2f8134dba21abfbf52cebabc6b6cc.exe Token: SeDebugPrivilege 5092 b31ed8fbfb5cb3d7cbbd6ed6833612d58dc2f8134dba21abfbf52cebabc6b6cc.exe Token: SeChangeNotifyPrivilege 2332 iexplore.exe Token: SeSystemEnvironmentPrivilege 5092 b31ed8fbfb5cb3d7cbbd6ed6833612d58dc2f8134dba21abfbf52cebabc6b6cc.exe Token: SeChangeNotifyPrivilege 5092 b31ed8fbfb5cb3d7cbbd6ed6833612d58dc2f8134dba21abfbf52cebabc6b6cc.exe Token: SeRemoteShutdownPrivilege 2332 iexplore.exe Token: SeRemoteShutdownPrivilege 5092 b31ed8fbfb5cb3d7cbbd6ed6833612d58dc2f8134dba21abfbf52cebabc6b6cc.exe Token: SeUndockPrivilege 5092 b31ed8fbfb5cb3d7cbbd6ed6833612d58dc2f8134dba21abfbf52cebabc6b6cc.exe Token: SeManageVolumePrivilege 5092 b31ed8fbfb5cb3d7cbbd6ed6833612d58dc2f8134dba21abfbf52cebabc6b6cc.exe Token: SeUndockPrivilege 2332 iexplore.exe Token: SeImpersonatePrivilege 5092 b31ed8fbfb5cb3d7cbbd6ed6833612d58dc2f8134dba21abfbf52cebabc6b6cc.exe Token: SeManageVolumePrivilege 2332 iexplore.exe Token: SeCreateGlobalPrivilege 5092 b31ed8fbfb5cb3d7cbbd6ed6833612d58dc2f8134dba21abfbf52cebabc6b6cc.exe Token: SeImpersonatePrivilege 2332 iexplore.exe Token: 33 5092 b31ed8fbfb5cb3d7cbbd6ed6833612d58dc2f8134dba21abfbf52cebabc6b6cc.exe Token: SeCreateGlobalPrivilege 2332 iexplore.exe Token: 34 5092 b31ed8fbfb5cb3d7cbbd6ed6833612d58dc2f8134dba21abfbf52cebabc6b6cc.exe Token: 33 2332 iexplore.exe Token: 35 5092 b31ed8fbfb5cb3d7cbbd6ed6833612d58dc2f8134dba21abfbf52cebabc6b6cc.exe Token: 34 2332 iexplore.exe Token: 36 5092 b31ed8fbfb5cb3d7cbbd6ed6833612d58dc2f8134dba21abfbf52cebabc6b6cc.exe Token: 35 2332 iexplore.exe Token: 36 2332 iexplore.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 1368 b31ed8fbfb5cb3d7cbbd6ed6833612d58dc2f8134dba21abfbf52cebabc6b6cc.exe 2332 iexplore.exe - Suspicious use of WriteProcessMemory 37 IoCs
description pid Process procid_target PID 1368 wrote to memory of 2496 1368 b31ed8fbfb5cb3d7cbbd6ed6833612d58dc2f8134dba21abfbf52cebabc6b6cc.exe 83 PID 1368 wrote to memory of 2496 1368 b31ed8fbfb5cb3d7cbbd6ed6833612d58dc2f8134dba21abfbf52cebabc6b6cc.exe 83 PID 1368 wrote to memory of 2496 1368 b31ed8fbfb5cb3d7cbbd6ed6833612d58dc2f8134dba21abfbf52cebabc6b6cc.exe 83 PID 1368 wrote to memory of 2332 1368 b31ed8fbfb5cb3d7cbbd6ed6833612d58dc2f8134dba21abfbf52cebabc6b6cc.exe 84 PID 1368 wrote to memory of 2332 1368 b31ed8fbfb5cb3d7cbbd6ed6833612d58dc2f8134dba21abfbf52cebabc6b6cc.exe 84 PID 1368 wrote to memory of 2332 1368 b31ed8fbfb5cb3d7cbbd6ed6833612d58dc2f8134dba21abfbf52cebabc6b6cc.exe 84 PID 1368 wrote to memory of 2332 1368 b31ed8fbfb5cb3d7cbbd6ed6833612d58dc2f8134dba21abfbf52cebabc6b6cc.exe 84 PID 1368 wrote to memory of 2332 1368 b31ed8fbfb5cb3d7cbbd6ed6833612d58dc2f8134dba21abfbf52cebabc6b6cc.exe 84 PID 1368 wrote to memory of 2332 1368 b31ed8fbfb5cb3d7cbbd6ed6833612d58dc2f8134dba21abfbf52cebabc6b6cc.exe 84 PID 1368 wrote to memory of 2332 1368 b31ed8fbfb5cb3d7cbbd6ed6833612d58dc2f8134dba21abfbf52cebabc6b6cc.exe 84 PID 1368 wrote to memory of 2332 1368 b31ed8fbfb5cb3d7cbbd6ed6833612d58dc2f8134dba21abfbf52cebabc6b6cc.exe 84 PID 1368 wrote to memory of 2332 1368 b31ed8fbfb5cb3d7cbbd6ed6833612d58dc2f8134dba21abfbf52cebabc6b6cc.exe 84 PID 1368 wrote to memory of 2332 1368 b31ed8fbfb5cb3d7cbbd6ed6833612d58dc2f8134dba21abfbf52cebabc6b6cc.exe 84 PID 1368 wrote to memory of 2332 1368 b31ed8fbfb5cb3d7cbbd6ed6833612d58dc2f8134dba21abfbf52cebabc6b6cc.exe 84 PID 1368 wrote to memory of 2332 1368 b31ed8fbfb5cb3d7cbbd6ed6833612d58dc2f8134dba21abfbf52cebabc6b6cc.exe 84 PID 1368 wrote to memory of 2332 1368 b31ed8fbfb5cb3d7cbbd6ed6833612d58dc2f8134dba21abfbf52cebabc6b6cc.exe 84 PID 1368 wrote to memory of 2332 1368 b31ed8fbfb5cb3d7cbbd6ed6833612d58dc2f8134dba21abfbf52cebabc6b6cc.exe 84 PID 1368 wrote to memory of 5092 1368 b31ed8fbfb5cb3d7cbbd6ed6833612d58dc2f8134dba21abfbf52cebabc6b6cc.exe 86 PID 1368 wrote to memory of 5092 1368 b31ed8fbfb5cb3d7cbbd6ed6833612d58dc2f8134dba21abfbf52cebabc6b6cc.exe 86 PID 1368 wrote to memory of 5092 1368 b31ed8fbfb5cb3d7cbbd6ed6833612d58dc2f8134dba21abfbf52cebabc6b6cc.exe 86 PID 1368 wrote to memory of 5092 1368 b31ed8fbfb5cb3d7cbbd6ed6833612d58dc2f8134dba21abfbf52cebabc6b6cc.exe 86 PID 1368 wrote to memory of 5092 1368 b31ed8fbfb5cb3d7cbbd6ed6833612d58dc2f8134dba21abfbf52cebabc6b6cc.exe 86 PID 1368 wrote to memory of 5092 1368 b31ed8fbfb5cb3d7cbbd6ed6833612d58dc2f8134dba21abfbf52cebabc6b6cc.exe 86 PID 1368 wrote to memory of 5092 1368 b31ed8fbfb5cb3d7cbbd6ed6833612d58dc2f8134dba21abfbf52cebabc6b6cc.exe 86 PID 1368 wrote to memory of 5092 1368 b31ed8fbfb5cb3d7cbbd6ed6833612d58dc2f8134dba21abfbf52cebabc6b6cc.exe 86 PID 1368 wrote to memory of 5092 1368 b31ed8fbfb5cb3d7cbbd6ed6833612d58dc2f8134dba21abfbf52cebabc6b6cc.exe 86 PID 1368 wrote to memory of 5092 1368 b31ed8fbfb5cb3d7cbbd6ed6833612d58dc2f8134dba21abfbf52cebabc6b6cc.exe 86 PID 1368 wrote to memory of 5092 1368 b31ed8fbfb5cb3d7cbbd6ed6833612d58dc2f8134dba21abfbf52cebabc6b6cc.exe 86 PID 1368 wrote to memory of 5092 1368 b31ed8fbfb5cb3d7cbbd6ed6833612d58dc2f8134dba21abfbf52cebabc6b6cc.exe 86 PID 1368 wrote to memory of 5092 1368 b31ed8fbfb5cb3d7cbbd6ed6833612d58dc2f8134dba21abfbf52cebabc6b6cc.exe 86 PID 1368 wrote to memory of 5092 1368 b31ed8fbfb5cb3d7cbbd6ed6833612d58dc2f8134dba21abfbf52cebabc6b6cc.exe 86 PID 2496 wrote to memory of 4644 2496 cmd.exe 87 PID 2496 wrote to memory of 4644 2496 cmd.exe 87 PID 2496 wrote to memory of 4644 2496 cmd.exe 87 PID 4644 wrote to memory of 5032 4644 net.exe 88 PID 4644 wrote to memory of 5032 4644 net.exe 88 PID 4644 wrote to memory of 5032 4644 net.exe 88
Processes
-
C:\Users\Admin\AppData\Local\Temp\b31ed8fbfb5cb3d7cbbd6ed6833612d58dc2f8134dba21abfbf52cebabc6b6cc.exe"C:\Users\Admin\AppData\Local\Temp\b31ed8fbfb5cb3d7cbbd6ed6833612d58dc2f8134dba21abfbf52cebabc6b6cc.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1368 -
C:\Windows\SysWOW64\cmd.exe/c net stop MpsSvc2⤵
- Suspicious use of WriteProcessMemory
PID:2496 -
C:\Windows\SysWOW64\net.exenet stop MpsSvc3⤵
- Suspicious use of WriteProcessMemory
PID:4644 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MpsSvc4⤵PID:5032
-
-
-
-
C:\Program Files (x86)\Internet Explorer\iexplore.exe"C:\Program Files (x86)\Internet Explorer\iexplore.exe"2⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2332
-
-
C:\Users\Admin\AppData\Local\Temp\b31ed8fbfb5cb3d7cbbd6ed6833612d58dc2f8134dba21abfbf52cebabc6b6cc.exeC:\Users\Admin\AppData\Local\Temp\b31ed8fbfb5cb3d7cbbd6ed6833612d58dc2f8134dba21abfbf52cebabc6b6cc.exe2⤵
- Suspicious use of AdjustPrivilegeToken
PID:5092
-