Analysis
-
max time kernel
152s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20220901-en -
resource tags
arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system -
submitted
19/10/2022, 16:21
Static task
static1
Behavioral task
behavioral1
Sample
36f8422a4c2d465ac8adced544708603ae5fcf680fe15af563a4eb45b287c0c3.exe
Resource
win7-20220812-en
General
-
Target
36f8422a4c2d465ac8adced544708603ae5fcf680fe15af563a4eb45b287c0c3.exe
-
Size
818KB
-
MD5
a2325f08d58dba788f3ab58f89e4a0b0
-
SHA1
60057894fe68b30e15ae4b14740db897012f9a69
-
SHA256
36f8422a4c2d465ac8adced544708603ae5fcf680fe15af563a4eb45b287c0c3
-
SHA512
bad9a11c6021cf7d93b251d9321edcb57a2c007e45ef3a042b7a34c360dbc0e0e4bf48601612890101925f030b3a993da6c5b1848cb090e114b514d4e61b5c3d
-
SSDEEP
12288:ZphltQSgqI39cn/vkFQbYbv7Q1nLpsEiyrqx518NCXUo1z16Sl3C5FiduwlU:GqIOnkFQekLpsZyrI18N4Ff6Sl3mIuL
Malware Config
Extracted
darkcomet
Slave
ghost1997.no-ip.biz:1337
DC_MUTEX-J3WWY9F
-
gencode
tdtxd3ezaYVU
-
install
false
-
offline_keylogger
true
-
persistence
false
Signatures
-
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" 36f8422a4c2d465ac8adced544708603ae5fcf680fe15af563a4eb45b287c0c3.exe -
Executes dropped EXE 1 IoCs
pid Process 2236 36f8422a4c2d465ac8adced544708603ae5fcf680fe15af563a4eb45b287c0c3.exe -
Sets file to hidden 1 TTPs 2 IoCs
Modifies file attributes to stop it showing in Explorer etc.
pid Process 3784 attrib.exe 3856 attrib.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation 36f8422a4c2d465ac8adced544708603ae5fcf680fe15af563a4eb45b287c0c3.exe -
Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\system.pif 36f8422a4c2d465ac8adced544708603ae5fcf680fe15af563a4eb45b287c0c3.exe -
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" 36f8422a4c2d465ac8adced544708603ae5fcf680fe15af563a4eb45b287c0c3.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\help = "C:\\Users\\Admin\\AppData\\Roaming\\InstallDir\\help.exe" 36f8422a4c2d465ac8adced544708603ae5fcf680fe15af563a4eb45b287c0c3.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\help = "C:\\Users\\Admin\\AppData\\Roaming\\InstallDir\\help.exe" 36f8422a4c2d465ac8adced544708603ae5fcf680fe15af563a4eb45b287c0c3.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 4280 set thread context of 2236 4280 36f8422a4c2d465ac8adced544708603ae5fcf680fe15af563a4eb45b287c0c3.exe 85 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Runs net.exe
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 4280 36f8422a4c2d465ac8adced544708603ae5fcf680fe15af563a4eb45b287c0c3.exe 4280 36f8422a4c2d465ac8adced544708603ae5fcf680fe15af563a4eb45b287c0c3.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2236 36f8422a4c2d465ac8adced544708603ae5fcf680fe15af563a4eb45b287c0c3.exe -
Suspicious use of AdjustPrivilegeToken 24 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 2236 36f8422a4c2d465ac8adced544708603ae5fcf680fe15af563a4eb45b287c0c3.exe Token: SeSecurityPrivilege 2236 36f8422a4c2d465ac8adced544708603ae5fcf680fe15af563a4eb45b287c0c3.exe Token: SeTakeOwnershipPrivilege 2236 36f8422a4c2d465ac8adced544708603ae5fcf680fe15af563a4eb45b287c0c3.exe Token: SeLoadDriverPrivilege 2236 36f8422a4c2d465ac8adced544708603ae5fcf680fe15af563a4eb45b287c0c3.exe Token: SeSystemProfilePrivilege 2236 36f8422a4c2d465ac8adced544708603ae5fcf680fe15af563a4eb45b287c0c3.exe Token: SeSystemtimePrivilege 2236 36f8422a4c2d465ac8adced544708603ae5fcf680fe15af563a4eb45b287c0c3.exe Token: SeProfSingleProcessPrivilege 2236 36f8422a4c2d465ac8adced544708603ae5fcf680fe15af563a4eb45b287c0c3.exe Token: SeIncBasePriorityPrivilege 2236 36f8422a4c2d465ac8adced544708603ae5fcf680fe15af563a4eb45b287c0c3.exe Token: SeCreatePagefilePrivilege 2236 36f8422a4c2d465ac8adced544708603ae5fcf680fe15af563a4eb45b287c0c3.exe Token: SeBackupPrivilege 2236 36f8422a4c2d465ac8adced544708603ae5fcf680fe15af563a4eb45b287c0c3.exe Token: SeRestorePrivilege 2236 36f8422a4c2d465ac8adced544708603ae5fcf680fe15af563a4eb45b287c0c3.exe Token: SeShutdownPrivilege 2236 36f8422a4c2d465ac8adced544708603ae5fcf680fe15af563a4eb45b287c0c3.exe Token: SeDebugPrivilege 2236 36f8422a4c2d465ac8adced544708603ae5fcf680fe15af563a4eb45b287c0c3.exe Token: SeSystemEnvironmentPrivilege 2236 36f8422a4c2d465ac8adced544708603ae5fcf680fe15af563a4eb45b287c0c3.exe Token: SeChangeNotifyPrivilege 2236 36f8422a4c2d465ac8adced544708603ae5fcf680fe15af563a4eb45b287c0c3.exe Token: SeRemoteShutdownPrivilege 2236 36f8422a4c2d465ac8adced544708603ae5fcf680fe15af563a4eb45b287c0c3.exe Token: SeUndockPrivilege 2236 36f8422a4c2d465ac8adced544708603ae5fcf680fe15af563a4eb45b287c0c3.exe Token: SeManageVolumePrivilege 2236 36f8422a4c2d465ac8adced544708603ae5fcf680fe15af563a4eb45b287c0c3.exe Token: SeImpersonatePrivilege 2236 36f8422a4c2d465ac8adced544708603ae5fcf680fe15af563a4eb45b287c0c3.exe Token: SeCreateGlobalPrivilege 2236 36f8422a4c2d465ac8adced544708603ae5fcf680fe15af563a4eb45b287c0c3.exe Token: 33 2236 36f8422a4c2d465ac8adced544708603ae5fcf680fe15af563a4eb45b287c0c3.exe Token: 34 2236 36f8422a4c2d465ac8adced544708603ae5fcf680fe15af563a4eb45b287c0c3.exe Token: 35 2236 36f8422a4c2d465ac8adced544708603ae5fcf680fe15af563a4eb45b287c0c3.exe Token: 36 2236 36f8422a4c2d465ac8adced544708603ae5fcf680fe15af563a4eb45b287c0c3.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2236 36f8422a4c2d465ac8adced544708603ae5fcf680fe15af563a4eb45b287c0c3.exe -
Suspicious use of WriteProcessMemory 57 IoCs
description pid Process procid_target PID 4280 wrote to memory of 1676 4280 36f8422a4c2d465ac8adced544708603ae5fcf680fe15af563a4eb45b287c0c3.exe 84 PID 4280 wrote to memory of 1676 4280 36f8422a4c2d465ac8adced544708603ae5fcf680fe15af563a4eb45b287c0c3.exe 84 PID 4280 wrote to memory of 1676 4280 36f8422a4c2d465ac8adced544708603ae5fcf680fe15af563a4eb45b287c0c3.exe 84 PID 4280 wrote to memory of 2236 4280 36f8422a4c2d465ac8adced544708603ae5fcf680fe15af563a4eb45b287c0c3.exe 85 PID 4280 wrote to memory of 2236 4280 36f8422a4c2d465ac8adced544708603ae5fcf680fe15af563a4eb45b287c0c3.exe 85 PID 4280 wrote to memory of 2236 4280 36f8422a4c2d465ac8adced544708603ae5fcf680fe15af563a4eb45b287c0c3.exe 85 PID 4280 wrote to memory of 2236 4280 36f8422a4c2d465ac8adced544708603ae5fcf680fe15af563a4eb45b287c0c3.exe 85 PID 4280 wrote to memory of 2236 4280 36f8422a4c2d465ac8adced544708603ae5fcf680fe15af563a4eb45b287c0c3.exe 85 PID 4280 wrote to memory of 2236 4280 36f8422a4c2d465ac8adced544708603ae5fcf680fe15af563a4eb45b287c0c3.exe 85 PID 4280 wrote to memory of 2236 4280 36f8422a4c2d465ac8adced544708603ae5fcf680fe15af563a4eb45b287c0c3.exe 85 PID 4280 wrote to memory of 2236 4280 36f8422a4c2d465ac8adced544708603ae5fcf680fe15af563a4eb45b287c0c3.exe 85 PID 4280 wrote to memory of 2236 4280 36f8422a4c2d465ac8adced544708603ae5fcf680fe15af563a4eb45b287c0c3.exe 85 PID 4280 wrote to memory of 2236 4280 36f8422a4c2d465ac8adced544708603ae5fcf680fe15af563a4eb45b287c0c3.exe 85 PID 4280 wrote to memory of 2236 4280 36f8422a4c2d465ac8adced544708603ae5fcf680fe15af563a4eb45b287c0c3.exe 85 PID 4280 wrote to memory of 2236 4280 36f8422a4c2d465ac8adced544708603ae5fcf680fe15af563a4eb45b287c0c3.exe 85 PID 4280 wrote to memory of 2236 4280 36f8422a4c2d465ac8adced544708603ae5fcf680fe15af563a4eb45b287c0c3.exe 85 PID 4280 wrote to memory of 2236 4280 36f8422a4c2d465ac8adced544708603ae5fcf680fe15af563a4eb45b287c0c3.exe 85 PID 1676 wrote to memory of 2400 1676 cmd.exe 87 PID 1676 wrote to memory of 2400 1676 cmd.exe 87 PID 1676 wrote to memory of 2400 1676 cmd.exe 87 PID 2400 wrote to memory of 4428 2400 net.exe 88 PID 2400 wrote to memory of 4428 2400 net.exe 88 PID 2400 wrote to memory of 4428 2400 net.exe 88 PID 2236 wrote to memory of 3708 2236 36f8422a4c2d465ac8adced544708603ae5fcf680fe15af563a4eb45b287c0c3.exe 89 PID 2236 wrote to memory of 3708 2236 36f8422a4c2d465ac8adced544708603ae5fcf680fe15af563a4eb45b287c0c3.exe 89 PID 2236 wrote to memory of 3708 2236 36f8422a4c2d465ac8adced544708603ae5fcf680fe15af563a4eb45b287c0c3.exe 89 PID 2236 wrote to memory of 3124 2236 36f8422a4c2d465ac8adced544708603ae5fcf680fe15af563a4eb45b287c0c3.exe 91 PID 2236 wrote to memory of 3124 2236 36f8422a4c2d465ac8adced544708603ae5fcf680fe15af563a4eb45b287c0c3.exe 91 PID 2236 wrote to memory of 3124 2236 36f8422a4c2d465ac8adced544708603ae5fcf680fe15af563a4eb45b287c0c3.exe 91 PID 2236 wrote to memory of 116 2236 36f8422a4c2d465ac8adced544708603ae5fcf680fe15af563a4eb45b287c0c3.exe 93 PID 2236 wrote to memory of 116 2236 36f8422a4c2d465ac8adced544708603ae5fcf680fe15af563a4eb45b287c0c3.exe 93 PID 2236 wrote to memory of 116 2236 36f8422a4c2d465ac8adced544708603ae5fcf680fe15af563a4eb45b287c0c3.exe 93 PID 2236 wrote to memory of 116 2236 36f8422a4c2d465ac8adced544708603ae5fcf680fe15af563a4eb45b287c0c3.exe 93 PID 2236 wrote to memory of 116 2236 36f8422a4c2d465ac8adced544708603ae5fcf680fe15af563a4eb45b287c0c3.exe 93 PID 2236 wrote to memory of 116 2236 36f8422a4c2d465ac8adced544708603ae5fcf680fe15af563a4eb45b287c0c3.exe 93 PID 2236 wrote to memory of 116 2236 36f8422a4c2d465ac8adced544708603ae5fcf680fe15af563a4eb45b287c0c3.exe 93 PID 2236 wrote to memory of 116 2236 36f8422a4c2d465ac8adced544708603ae5fcf680fe15af563a4eb45b287c0c3.exe 93 PID 2236 wrote to memory of 116 2236 36f8422a4c2d465ac8adced544708603ae5fcf680fe15af563a4eb45b287c0c3.exe 93 PID 2236 wrote to memory of 116 2236 36f8422a4c2d465ac8adced544708603ae5fcf680fe15af563a4eb45b287c0c3.exe 93 PID 2236 wrote to memory of 116 2236 36f8422a4c2d465ac8adced544708603ae5fcf680fe15af563a4eb45b287c0c3.exe 93 PID 2236 wrote to memory of 116 2236 36f8422a4c2d465ac8adced544708603ae5fcf680fe15af563a4eb45b287c0c3.exe 93 PID 2236 wrote to memory of 116 2236 36f8422a4c2d465ac8adced544708603ae5fcf680fe15af563a4eb45b287c0c3.exe 93 PID 2236 wrote to memory of 116 2236 36f8422a4c2d465ac8adced544708603ae5fcf680fe15af563a4eb45b287c0c3.exe 93 PID 2236 wrote to memory of 116 2236 36f8422a4c2d465ac8adced544708603ae5fcf680fe15af563a4eb45b287c0c3.exe 93 PID 2236 wrote to memory of 116 2236 36f8422a4c2d465ac8adced544708603ae5fcf680fe15af563a4eb45b287c0c3.exe 93 PID 2236 wrote to memory of 116 2236 36f8422a4c2d465ac8adced544708603ae5fcf680fe15af563a4eb45b287c0c3.exe 93 PID 2236 wrote to memory of 116 2236 36f8422a4c2d465ac8adced544708603ae5fcf680fe15af563a4eb45b287c0c3.exe 93 PID 2236 wrote to memory of 116 2236 36f8422a4c2d465ac8adced544708603ae5fcf680fe15af563a4eb45b287c0c3.exe 93 PID 2236 wrote to memory of 116 2236 36f8422a4c2d465ac8adced544708603ae5fcf680fe15af563a4eb45b287c0c3.exe 93 PID 2236 wrote to memory of 116 2236 36f8422a4c2d465ac8adced544708603ae5fcf680fe15af563a4eb45b287c0c3.exe 93 PID 2236 wrote to memory of 116 2236 36f8422a4c2d465ac8adced544708603ae5fcf680fe15af563a4eb45b287c0c3.exe 93 PID 3708 wrote to memory of 3784 3708 cmd.exe 94 PID 3708 wrote to memory of 3784 3708 cmd.exe 94 PID 3708 wrote to memory of 3784 3708 cmd.exe 94 PID 3124 wrote to memory of 3856 3124 cmd.exe 95 PID 3124 wrote to memory of 3856 3124 cmd.exe 95 PID 3124 wrote to memory of 3856 3124 cmd.exe 95 -
Views/modifies file attributes 1 TTPs 2 IoCs
pid Process 3856 attrib.exe 3784 attrib.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\36f8422a4c2d465ac8adced544708603ae5fcf680fe15af563a4eb45b287c0c3.exe"C:\Users\Admin\AppData\Local\Temp\36f8422a4c2d465ac8adced544708603ae5fcf680fe15af563a4eb45b287c0c3.exe"1⤵
- Drops startup file
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4280 -
C:\Windows\SysWOW64\cmd.exe/c net stop MpsSvc2⤵
- Suspicious use of WriteProcessMemory
PID:1676 -
C:\Windows\SysWOW64\net.exenet stop MpsSvc3⤵
- Suspicious use of WriteProcessMemory
PID:2400 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MpsSvc4⤵PID:4428
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\36f8422a4c2d465ac8adced544708603ae5fcf680fe15af563a4eb45b287c0c3.exeC:\Users\Admin\AppData\Local\Temp\36f8422a4c2d465ac8adced544708603ae5fcf680fe15af563a4eb45b287c0c3.exe2⤵
- Windows security bypass
- Executes dropped EXE
- Checks computer location settings
- Windows security modification
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2236 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp\36f8422a4c2d465ac8adced544708603ae5fcf680fe15af563a4eb45b287c0c3.exe" +s +h3⤵
- Suspicious use of WriteProcessMemory
PID:3708 -
C:\Windows\SysWOW64\attrib.exeattrib "C:\Users\Admin\AppData\Local\Temp\36f8422a4c2d465ac8adced544708603ae5fcf680fe15af563a4eb45b287c0c3.exe" +s +h4⤵
- Sets file to hidden
- Views/modifies file attributes
PID:3784
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp" +s +h3⤵
- Suspicious use of WriteProcessMemory
PID:3124 -
C:\Windows\SysWOW64\attrib.exeattrib "C:\Users\Admin\AppData\Local\Temp" +s +h4⤵
- Sets file to hidden
- Views/modifies file attributes
PID:3856
-
-
-
C:\Windows\SysWOW64\notepad.exenotepad3⤵PID:116
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\36f8422a4c2d465ac8adced544708603ae5fcf680fe15af563a4eb45b287c0c3.exe
Filesize818KB
MD5a2325f08d58dba788f3ab58f89e4a0b0
SHA160057894fe68b30e15ae4b14740db897012f9a69
SHA25636f8422a4c2d465ac8adced544708603ae5fcf680fe15af563a4eb45b287c0c3
SHA512bad9a11c6021cf7d93b251d9321edcb57a2c007e45ef3a042b7a34c360dbc0e0e4bf48601612890101925f030b3a993da6c5b1848cb090e114b514d4e61b5c3d