Analysis
-
max time kernel
194s -
max time network
165s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
19/10/2022, 14:31
Static task
static1
Behavioral task
behavioral1
Sample
e74683db42e7c00c2e164ef61ae7ddfe7f42d918c10fec596236501a5e7202dc.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
e74683db42e7c00c2e164ef61ae7ddfe7f42d918c10fec596236501a5e7202dc.exe
Resource
win10v2004-20220812-en
General
-
Target
e74683db42e7c00c2e164ef61ae7ddfe7f42d918c10fec596236501a5e7202dc.exe
-
Size
1.4MB
-
MD5
90f96d2e7e53a7bbd78dfdf2d57969f9
-
SHA1
86a613e2862ffe86ec8b1a705a1fb1da68a3bcec
-
SHA256
e74683db42e7c00c2e164ef61ae7ddfe7f42d918c10fec596236501a5e7202dc
-
SHA512
ebf61845dfa5d27497ae0ab834ff000240b58efc291c390fdc2cc7b7c6d0a3d92836167e2b43d53039051787d05876d3fe1dcc543e827af73339a5c6b43ee722
-
SSDEEP
24576:uRmJkcoQricOIQxiZY1iaC7xsr2CzXDkTqrPVT6HFy5+uLLRggBjTHfe2LwRlx22:7JZoQrbTFZY1iaC7xkoTaT4y5+ELRzRo
Malware Config
Extracted
darkcomet
carbonchoke
carbonchoke.no-ip.biz:1194
DC_MUTEX-LUZUPVL
-
gencode
zaQaTy15nhwb
-
install
false
-
offline_keylogger
true
-
persistence
false
Signatures
-
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run e74683db42e7c00c2e164ef61ae7ddfe7f42d918c10fec596236501a5e7202dc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\MicroSoftUpdate = "C:\\Users\\Admin\\AppData\\Local\\Temp\\CKG\\svshost.exe" e74683db42e7c00c2e164ef61ae7ddfe7f42d918c10fec596236501a5e7202dc.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 1372 set thread context of 1284 1372 e74683db42e7c00c2e164ef61ae7ddfe7f42d918c10fec596236501a5e7202dc.exe 27 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of AdjustPrivilegeToken 23 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 1284 e74683db42e7c00c2e164ef61ae7ddfe7f42d918c10fec596236501a5e7202dc.exe Token: SeSecurityPrivilege 1284 e74683db42e7c00c2e164ef61ae7ddfe7f42d918c10fec596236501a5e7202dc.exe Token: SeTakeOwnershipPrivilege 1284 e74683db42e7c00c2e164ef61ae7ddfe7f42d918c10fec596236501a5e7202dc.exe Token: SeLoadDriverPrivilege 1284 e74683db42e7c00c2e164ef61ae7ddfe7f42d918c10fec596236501a5e7202dc.exe Token: SeSystemProfilePrivilege 1284 e74683db42e7c00c2e164ef61ae7ddfe7f42d918c10fec596236501a5e7202dc.exe Token: SeSystemtimePrivilege 1284 e74683db42e7c00c2e164ef61ae7ddfe7f42d918c10fec596236501a5e7202dc.exe Token: SeProfSingleProcessPrivilege 1284 e74683db42e7c00c2e164ef61ae7ddfe7f42d918c10fec596236501a5e7202dc.exe Token: SeIncBasePriorityPrivilege 1284 e74683db42e7c00c2e164ef61ae7ddfe7f42d918c10fec596236501a5e7202dc.exe Token: SeCreatePagefilePrivilege 1284 e74683db42e7c00c2e164ef61ae7ddfe7f42d918c10fec596236501a5e7202dc.exe Token: SeBackupPrivilege 1284 e74683db42e7c00c2e164ef61ae7ddfe7f42d918c10fec596236501a5e7202dc.exe Token: SeRestorePrivilege 1284 e74683db42e7c00c2e164ef61ae7ddfe7f42d918c10fec596236501a5e7202dc.exe Token: SeShutdownPrivilege 1284 e74683db42e7c00c2e164ef61ae7ddfe7f42d918c10fec596236501a5e7202dc.exe Token: SeDebugPrivilege 1284 e74683db42e7c00c2e164ef61ae7ddfe7f42d918c10fec596236501a5e7202dc.exe Token: SeSystemEnvironmentPrivilege 1284 e74683db42e7c00c2e164ef61ae7ddfe7f42d918c10fec596236501a5e7202dc.exe Token: SeChangeNotifyPrivilege 1284 e74683db42e7c00c2e164ef61ae7ddfe7f42d918c10fec596236501a5e7202dc.exe Token: SeRemoteShutdownPrivilege 1284 e74683db42e7c00c2e164ef61ae7ddfe7f42d918c10fec596236501a5e7202dc.exe Token: SeUndockPrivilege 1284 e74683db42e7c00c2e164ef61ae7ddfe7f42d918c10fec596236501a5e7202dc.exe Token: SeManageVolumePrivilege 1284 e74683db42e7c00c2e164ef61ae7ddfe7f42d918c10fec596236501a5e7202dc.exe Token: SeImpersonatePrivilege 1284 e74683db42e7c00c2e164ef61ae7ddfe7f42d918c10fec596236501a5e7202dc.exe Token: SeCreateGlobalPrivilege 1284 e74683db42e7c00c2e164ef61ae7ddfe7f42d918c10fec596236501a5e7202dc.exe Token: 33 1284 e74683db42e7c00c2e164ef61ae7ddfe7f42d918c10fec596236501a5e7202dc.exe Token: 34 1284 e74683db42e7c00c2e164ef61ae7ddfe7f42d918c10fec596236501a5e7202dc.exe Token: 35 1284 e74683db42e7c00c2e164ef61ae7ddfe7f42d918c10fec596236501a5e7202dc.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 1284 e74683db42e7c00c2e164ef61ae7ddfe7f42d918c10fec596236501a5e7202dc.exe -
Suspicious use of WriteProcessMemory 13 IoCs
description pid Process procid_target PID 1372 wrote to memory of 1284 1372 e74683db42e7c00c2e164ef61ae7ddfe7f42d918c10fec596236501a5e7202dc.exe 27 PID 1372 wrote to memory of 1284 1372 e74683db42e7c00c2e164ef61ae7ddfe7f42d918c10fec596236501a5e7202dc.exe 27 PID 1372 wrote to memory of 1284 1372 e74683db42e7c00c2e164ef61ae7ddfe7f42d918c10fec596236501a5e7202dc.exe 27 PID 1372 wrote to memory of 1284 1372 e74683db42e7c00c2e164ef61ae7ddfe7f42d918c10fec596236501a5e7202dc.exe 27 PID 1372 wrote to memory of 1284 1372 e74683db42e7c00c2e164ef61ae7ddfe7f42d918c10fec596236501a5e7202dc.exe 27 PID 1372 wrote to memory of 1284 1372 e74683db42e7c00c2e164ef61ae7ddfe7f42d918c10fec596236501a5e7202dc.exe 27 PID 1372 wrote to memory of 1284 1372 e74683db42e7c00c2e164ef61ae7ddfe7f42d918c10fec596236501a5e7202dc.exe 27 PID 1372 wrote to memory of 1284 1372 e74683db42e7c00c2e164ef61ae7ddfe7f42d918c10fec596236501a5e7202dc.exe 27 PID 1372 wrote to memory of 1284 1372 e74683db42e7c00c2e164ef61ae7ddfe7f42d918c10fec596236501a5e7202dc.exe 27 PID 1372 wrote to memory of 1284 1372 e74683db42e7c00c2e164ef61ae7ddfe7f42d918c10fec596236501a5e7202dc.exe 27 PID 1372 wrote to memory of 1284 1372 e74683db42e7c00c2e164ef61ae7ddfe7f42d918c10fec596236501a5e7202dc.exe 27 PID 1372 wrote to memory of 1284 1372 e74683db42e7c00c2e164ef61ae7ddfe7f42d918c10fec596236501a5e7202dc.exe 27 PID 1372 wrote to memory of 1284 1372 e74683db42e7c00c2e164ef61ae7ddfe7f42d918c10fec596236501a5e7202dc.exe 27
Processes
-
C:\Users\Admin\AppData\Local\Temp\e74683db42e7c00c2e164ef61ae7ddfe7f42d918c10fec596236501a5e7202dc.exe"C:\Users\Admin\AppData\Local\Temp\e74683db42e7c00c2e164ef61ae7ddfe7f42d918c10fec596236501a5e7202dc.exe"1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1372 -
C:\Users\Admin\AppData\Local\Temp\e74683db42e7c00c2e164ef61ae7ddfe7f42d918c10fec596236501a5e7202dc.exe"C:\Users\Admin\AppData\Local\Temp\e74683db42e7c00c2e164ef61ae7ddfe7f42d918c10fec596236501a5e7202dc.exe"2⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1284
-