Analysis
-
max time kernel
151s -
max time network
115s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
19/10/2022, 16:21
Static task
static1
Behavioral task
behavioral1
Sample
8097556e0e17051497344454aea95ab1570c5c32a0947e05add17aee36411134.exe
Resource
win7-20220812-en
General
-
Target
8097556e0e17051497344454aea95ab1570c5c32a0947e05add17aee36411134.exe
-
Size
349KB
-
MD5
a18f9185d5ebc3a0aa7806b19e7ff6c0
-
SHA1
c06b84b749a8e6c57651060c9f19572f4d9f5875
-
SHA256
8097556e0e17051497344454aea95ab1570c5c32a0947e05add17aee36411134
-
SHA512
98ca350ab40187bd6c764cb7a9a9e18e30a56196d0f2be1f57ca417b1b8b865fd71fbc7150933a5ddb7069f969c8c5c1861d1d8225cfb7eef27ab5eeddc16eee
-
SSDEEP
6144:CqLzGyzpKalLBQmByTIRb5K+WrxJA6AIsPSBD3FvbXB7oOdvkoOgVQKMkXIzcQj:RphltQEI+Gc6ANP0d7bv65k4zcQj
Malware Config
Extracted
darkcomet
Guest16
127.0.0.1:1604
DC_MUTEX-YTGAJF9
-
InstallPath
steam.exe
-
gencode
nTQWxdykrfam
-
install
true
-
offline_keylogger
true
-
persistence
true
-
reg_key
steam
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\steam.exe" 8097556e0e17051497344454aea95ab1570c5c32a0947e05add17aee36411134.exe -
Executes dropped EXE 2 IoCs
pid Process 932 steam.exe 2208 steam.exe -
Sets file to hidden 1 TTPs 2 IoCs
Modifies file attributes to stop it showing in Explorer etc.
pid Process 4716 attrib.exe 2544 attrib.exe -
resource yara_rule behavioral2/memory/4824-133-0x0000000000400000-0x00000000004B7000-memory.dmp upx behavioral2/memory/4824-134-0x0000000000400000-0x00000000004B7000-memory.dmp upx behavioral2/memory/4824-136-0x0000000000400000-0x00000000004B7000-memory.dmp upx behavioral2/memory/4824-137-0x0000000000400000-0x00000000004B7000-memory.dmp upx behavioral2/memory/4824-138-0x0000000000400000-0x00000000004B7000-memory.dmp upx behavioral2/memory/2208-155-0x0000000000400000-0x00000000004B7000-memory.dmp upx behavioral2/memory/4824-156-0x0000000000400000-0x00000000004B7000-memory.dmp upx behavioral2/memory/2208-157-0x0000000000400000-0x00000000004B7000-memory.dmp upx -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation 8097556e0e17051497344454aea95ab1570c5c32a0947e05add17aee36411134.exe -
Adds Run key to start application 2 TTPs 6 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\help = "C:\\Users\\Admin\\AppData\\Roaming\\InstallDir\\help.exe" 8097556e0e17051497344454aea95ab1570c5c32a0947e05add17aee36411134.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\help = "C:\\Users\\Admin\\AppData\\Roaming\\InstallDir\\help.exe" 8097556e0e17051497344454aea95ab1570c5c32a0947e05add17aee36411134.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\steam = "C:\\Windows\\system32\\steam.exe" 8097556e0e17051497344454aea95ab1570c5c32a0947e05add17aee36411134.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\help = "C:\\Users\\Admin\\AppData\\Roaming\\InstallDir\\help.exe" steam.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\help = "C:\\Users\\Admin\\AppData\\Roaming\\InstallDir\\help.exe" steam.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\steam = "C:\\Windows\\system32\\steam.exe" steam.exe -
Drops file in System32 directory 4 IoCs
description ioc Process File created C:\Windows\SysWOW64\steam.exe 8097556e0e17051497344454aea95ab1570c5c32a0947e05add17aee36411134.exe File opened for modification C:\Windows\SysWOW64\steam.exe 8097556e0e17051497344454aea95ab1570c5c32a0947e05add17aee36411134.exe File opened for modification C:\Windows\SysWOW64\ 8097556e0e17051497344454aea95ab1570c5c32a0947e05add17aee36411134.exe File opened for modification C:\Windows\SysWOW64\steam.exe steam.exe -
Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 2056 set thread context of 4824 2056 8097556e0e17051497344454aea95ab1570c5c32a0947e05add17aee36411134.exe 82 PID 932 set thread context of 2208 932 steam.exe 91 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ 8097556e0e17051497344454aea95ab1570c5c32a0947e05add17aee36411134.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 2056 8097556e0e17051497344454aea95ab1570c5c32a0947e05add17aee36411134.exe 2056 8097556e0e17051497344454aea95ab1570c5c32a0947e05add17aee36411134.exe 932 steam.exe 932 steam.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2208 steam.exe -
Suspicious use of AdjustPrivilegeToken 48 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 4824 8097556e0e17051497344454aea95ab1570c5c32a0947e05add17aee36411134.exe Token: SeSecurityPrivilege 4824 8097556e0e17051497344454aea95ab1570c5c32a0947e05add17aee36411134.exe Token: SeTakeOwnershipPrivilege 4824 8097556e0e17051497344454aea95ab1570c5c32a0947e05add17aee36411134.exe Token: SeLoadDriverPrivilege 4824 8097556e0e17051497344454aea95ab1570c5c32a0947e05add17aee36411134.exe Token: SeSystemProfilePrivilege 4824 8097556e0e17051497344454aea95ab1570c5c32a0947e05add17aee36411134.exe Token: SeSystemtimePrivilege 4824 8097556e0e17051497344454aea95ab1570c5c32a0947e05add17aee36411134.exe Token: SeProfSingleProcessPrivilege 4824 8097556e0e17051497344454aea95ab1570c5c32a0947e05add17aee36411134.exe Token: SeIncBasePriorityPrivilege 4824 8097556e0e17051497344454aea95ab1570c5c32a0947e05add17aee36411134.exe Token: SeCreatePagefilePrivilege 4824 8097556e0e17051497344454aea95ab1570c5c32a0947e05add17aee36411134.exe Token: SeBackupPrivilege 4824 8097556e0e17051497344454aea95ab1570c5c32a0947e05add17aee36411134.exe Token: SeRestorePrivilege 4824 8097556e0e17051497344454aea95ab1570c5c32a0947e05add17aee36411134.exe Token: SeShutdownPrivilege 4824 8097556e0e17051497344454aea95ab1570c5c32a0947e05add17aee36411134.exe Token: SeDebugPrivilege 4824 8097556e0e17051497344454aea95ab1570c5c32a0947e05add17aee36411134.exe Token: SeSystemEnvironmentPrivilege 4824 8097556e0e17051497344454aea95ab1570c5c32a0947e05add17aee36411134.exe Token: SeChangeNotifyPrivilege 4824 8097556e0e17051497344454aea95ab1570c5c32a0947e05add17aee36411134.exe Token: SeRemoteShutdownPrivilege 4824 8097556e0e17051497344454aea95ab1570c5c32a0947e05add17aee36411134.exe Token: SeUndockPrivilege 4824 8097556e0e17051497344454aea95ab1570c5c32a0947e05add17aee36411134.exe Token: SeManageVolumePrivilege 4824 8097556e0e17051497344454aea95ab1570c5c32a0947e05add17aee36411134.exe Token: SeImpersonatePrivilege 4824 8097556e0e17051497344454aea95ab1570c5c32a0947e05add17aee36411134.exe Token: SeCreateGlobalPrivilege 4824 8097556e0e17051497344454aea95ab1570c5c32a0947e05add17aee36411134.exe Token: 33 4824 8097556e0e17051497344454aea95ab1570c5c32a0947e05add17aee36411134.exe Token: 34 4824 8097556e0e17051497344454aea95ab1570c5c32a0947e05add17aee36411134.exe Token: 35 4824 8097556e0e17051497344454aea95ab1570c5c32a0947e05add17aee36411134.exe Token: 36 4824 8097556e0e17051497344454aea95ab1570c5c32a0947e05add17aee36411134.exe Token: SeIncreaseQuotaPrivilege 2208 steam.exe Token: SeSecurityPrivilege 2208 steam.exe Token: SeTakeOwnershipPrivilege 2208 steam.exe Token: SeLoadDriverPrivilege 2208 steam.exe Token: SeSystemProfilePrivilege 2208 steam.exe Token: SeSystemtimePrivilege 2208 steam.exe Token: SeProfSingleProcessPrivilege 2208 steam.exe Token: SeIncBasePriorityPrivilege 2208 steam.exe Token: SeCreatePagefilePrivilege 2208 steam.exe Token: SeBackupPrivilege 2208 steam.exe Token: SeRestorePrivilege 2208 steam.exe Token: SeShutdownPrivilege 2208 steam.exe Token: SeDebugPrivilege 2208 steam.exe Token: SeSystemEnvironmentPrivilege 2208 steam.exe Token: SeChangeNotifyPrivilege 2208 steam.exe Token: SeRemoteShutdownPrivilege 2208 steam.exe Token: SeUndockPrivilege 2208 steam.exe Token: SeManageVolumePrivilege 2208 steam.exe Token: SeImpersonatePrivilege 2208 steam.exe Token: SeCreateGlobalPrivilege 2208 steam.exe Token: 33 2208 steam.exe Token: 34 2208 steam.exe Token: 35 2208 steam.exe Token: 36 2208 steam.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2208 steam.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2056 wrote to memory of 4824 2056 8097556e0e17051497344454aea95ab1570c5c32a0947e05add17aee36411134.exe 82 PID 2056 wrote to memory of 4824 2056 8097556e0e17051497344454aea95ab1570c5c32a0947e05add17aee36411134.exe 82 PID 2056 wrote to memory of 4824 2056 8097556e0e17051497344454aea95ab1570c5c32a0947e05add17aee36411134.exe 82 PID 2056 wrote to memory of 4824 2056 8097556e0e17051497344454aea95ab1570c5c32a0947e05add17aee36411134.exe 82 PID 2056 wrote to memory of 4824 2056 8097556e0e17051497344454aea95ab1570c5c32a0947e05add17aee36411134.exe 82 PID 2056 wrote to memory of 4824 2056 8097556e0e17051497344454aea95ab1570c5c32a0947e05add17aee36411134.exe 82 PID 2056 wrote to memory of 4824 2056 8097556e0e17051497344454aea95ab1570c5c32a0947e05add17aee36411134.exe 82 PID 2056 wrote to memory of 4824 2056 8097556e0e17051497344454aea95ab1570c5c32a0947e05add17aee36411134.exe 82 PID 4824 wrote to memory of 2264 4824 8097556e0e17051497344454aea95ab1570c5c32a0947e05add17aee36411134.exe 83 PID 4824 wrote to memory of 2264 4824 8097556e0e17051497344454aea95ab1570c5c32a0947e05add17aee36411134.exe 83 PID 4824 wrote to memory of 2264 4824 8097556e0e17051497344454aea95ab1570c5c32a0947e05add17aee36411134.exe 83 PID 4824 wrote to memory of 3736 4824 8097556e0e17051497344454aea95ab1570c5c32a0947e05add17aee36411134.exe 85 PID 4824 wrote to memory of 3736 4824 8097556e0e17051497344454aea95ab1570c5c32a0947e05add17aee36411134.exe 85 PID 4824 wrote to memory of 3736 4824 8097556e0e17051497344454aea95ab1570c5c32a0947e05add17aee36411134.exe 85 PID 4824 wrote to memory of 2040 4824 8097556e0e17051497344454aea95ab1570c5c32a0947e05add17aee36411134.exe 86 PID 4824 wrote to memory of 2040 4824 8097556e0e17051497344454aea95ab1570c5c32a0947e05add17aee36411134.exe 86 PID 4824 wrote to memory of 2040 4824 8097556e0e17051497344454aea95ab1570c5c32a0947e05add17aee36411134.exe 86 PID 4824 wrote to memory of 2040 4824 8097556e0e17051497344454aea95ab1570c5c32a0947e05add17aee36411134.exe 86 PID 4824 wrote to memory of 2040 4824 8097556e0e17051497344454aea95ab1570c5c32a0947e05add17aee36411134.exe 86 PID 4824 wrote to memory of 2040 4824 8097556e0e17051497344454aea95ab1570c5c32a0947e05add17aee36411134.exe 86 PID 4824 wrote to memory of 2040 4824 8097556e0e17051497344454aea95ab1570c5c32a0947e05add17aee36411134.exe 86 PID 4824 wrote to memory of 2040 4824 8097556e0e17051497344454aea95ab1570c5c32a0947e05add17aee36411134.exe 86 PID 4824 wrote to memory of 2040 4824 8097556e0e17051497344454aea95ab1570c5c32a0947e05add17aee36411134.exe 86 PID 4824 wrote to memory of 2040 4824 8097556e0e17051497344454aea95ab1570c5c32a0947e05add17aee36411134.exe 86 PID 4824 wrote to memory of 2040 4824 8097556e0e17051497344454aea95ab1570c5c32a0947e05add17aee36411134.exe 86 PID 4824 wrote to memory of 2040 4824 8097556e0e17051497344454aea95ab1570c5c32a0947e05add17aee36411134.exe 86 PID 4824 wrote to memory of 2040 4824 8097556e0e17051497344454aea95ab1570c5c32a0947e05add17aee36411134.exe 86 PID 4824 wrote to memory of 2040 4824 8097556e0e17051497344454aea95ab1570c5c32a0947e05add17aee36411134.exe 86 PID 4824 wrote to memory of 2040 4824 8097556e0e17051497344454aea95ab1570c5c32a0947e05add17aee36411134.exe 86 PID 4824 wrote to memory of 2040 4824 8097556e0e17051497344454aea95ab1570c5c32a0947e05add17aee36411134.exe 86 PID 4824 wrote to memory of 2040 4824 8097556e0e17051497344454aea95ab1570c5c32a0947e05add17aee36411134.exe 86 PID 2264 wrote to memory of 2544 2264 cmd.exe 88 PID 2264 wrote to memory of 2544 2264 cmd.exe 88 PID 2264 wrote to memory of 2544 2264 cmd.exe 88 PID 3736 wrote to memory of 4716 3736 cmd.exe 89 PID 3736 wrote to memory of 4716 3736 cmd.exe 89 PID 3736 wrote to memory of 4716 3736 cmd.exe 89 PID 4824 wrote to memory of 932 4824 8097556e0e17051497344454aea95ab1570c5c32a0947e05add17aee36411134.exe 90 PID 4824 wrote to memory of 932 4824 8097556e0e17051497344454aea95ab1570c5c32a0947e05add17aee36411134.exe 90 PID 4824 wrote to memory of 932 4824 8097556e0e17051497344454aea95ab1570c5c32a0947e05add17aee36411134.exe 90 PID 932 wrote to memory of 2208 932 steam.exe 91 PID 932 wrote to memory of 2208 932 steam.exe 91 PID 932 wrote to memory of 2208 932 steam.exe 91 PID 932 wrote to memory of 2208 932 steam.exe 91 PID 932 wrote to memory of 2208 932 steam.exe 91 PID 932 wrote to memory of 2208 932 steam.exe 91 PID 932 wrote to memory of 2208 932 steam.exe 91 PID 932 wrote to memory of 2208 932 steam.exe 91 PID 2208 wrote to memory of 404 2208 steam.exe 92 PID 2208 wrote to memory of 404 2208 steam.exe 92 PID 2208 wrote to memory of 404 2208 steam.exe 92 PID 2208 wrote to memory of 404 2208 steam.exe 92 PID 2208 wrote to memory of 404 2208 steam.exe 92 PID 2208 wrote to memory of 404 2208 steam.exe 92 PID 2208 wrote to memory of 404 2208 steam.exe 92 PID 2208 wrote to memory of 404 2208 steam.exe 92 PID 2208 wrote to memory of 404 2208 steam.exe 92 PID 2208 wrote to memory of 404 2208 steam.exe 92 PID 2208 wrote to memory of 404 2208 steam.exe 92 PID 2208 wrote to memory of 404 2208 steam.exe 92 PID 2208 wrote to memory of 404 2208 steam.exe 92 PID 2208 wrote to memory of 404 2208 steam.exe 92 PID 2208 wrote to memory of 404 2208 steam.exe 92 PID 2208 wrote to memory of 404 2208 steam.exe 92 -
Views/modifies file attributes 1 TTPs 2 IoCs
pid Process 2544 attrib.exe 4716 attrib.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\8097556e0e17051497344454aea95ab1570c5c32a0947e05add17aee36411134.exe"C:\Users\Admin\AppData\Local\Temp\8097556e0e17051497344454aea95ab1570c5c32a0947e05add17aee36411134.exe"1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2056 -
C:\Users\Admin\AppData\Local\Temp\8097556e0e17051497344454aea95ab1570c5c32a0947e05add17aee36411134.exeC:\Users\Admin\AppData\Local\Temp\8097556e0e17051497344454aea95ab1570c5c32a0947e05add17aee36411134.exe2⤵
- Modifies WinLogon for persistence
- Checks computer location settings
- Adds Run key to start application
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4824 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp\8097556e0e17051497344454aea95ab1570c5c32a0947e05add17aee36411134.exe" +s +h3⤵
- Suspicious use of WriteProcessMemory
PID:2264 -
C:\Windows\SysWOW64\attrib.exeattrib "C:\Users\Admin\AppData\Local\Temp\8097556e0e17051497344454aea95ab1570c5c32a0947e05add17aee36411134.exe" +s +h4⤵
- Sets file to hidden
- Views/modifies file attributes
PID:2544
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp" +s +h3⤵
- Suspicious use of WriteProcessMemory
PID:3736 -
C:\Windows\SysWOW64\attrib.exeattrib "C:\Users\Admin\AppData\Local\Temp" +s +h4⤵
- Sets file to hidden
- Views/modifies file attributes
PID:4716
-
-
-
C:\Windows\SysWOW64\notepad.exenotepad3⤵PID:2040
-
-
C:\Windows\SysWOW64\steam.exe"C:\Windows\system32\steam.exe"3⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:932 -
C:\Windows\SysWOW64\steam.exeC:\Windows\SysWOW64\steam.exe4⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2208 -
C:\Windows\SysWOW64\notepad.exenotepad5⤵PID:404
-
-
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
349KB
MD5a18f9185d5ebc3a0aa7806b19e7ff6c0
SHA1c06b84b749a8e6c57651060c9f19572f4d9f5875
SHA2568097556e0e17051497344454aea95ab1570c5c32a0947e05add17aee36411134
SHA51298ca350ab40187bd6c764cb7a9a9e18e30a56196d0f2be1f57ca417b1b8b865fd71fbc7150933a5ddb7069f969c8c5c1861d1d8225cfb7eef27ab5eeddc16eee
-
Filesize
349KB
MD5a18f9185d5ebc3a0aa7806b19e7ff6c0
SHA1c06b84b749a8e6c57651060c9f19572f4d9f5875
SHA2568097556e0e17051497344454aea95ab1570c5c32a0947e05add17aee36411134
SHA51298ca350ab40187bd6c764cb7a9a9e18e30a56196d0f2be1f57ca417b1b8b865fd71fbc7150933a5ddb7069f969c8c5c1861d1d8225cfb7eef27ab5eeddc16eee
-
Filesize
349KB
MD5a18f9185d5ebc3a0aa7806b19e7ff6c0
SHA1c06b84b749a8e6c57651060c9f19572f4d9f5875
SHA2568097556e0e17051497344454aea95ab1570c5c32a0947e05add17aee36411134
SHA51298ca350ab40187bd6c764cb7a9a9e18e30a56196d0f2be1f57ca417b1b8b865fd71fbc7150933a5ddb7069f969c8c5c1861d1d8225cfb7eef27ab5eeddc16eee