Analysis
-
max time kernel
52s -
max time network
50s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
29/10/2022, 13:08
Static task
static1
Behavioral task
behavioral1
Sample
c3e979d3da9c48e0e9043c84a30c5e20572c443979850a362d5a1ae62cfb4069.exe
Resource
win7-20220812-en
General
-
Target
c3e979d3da9c48e0e9043c84a30c5e20572c443979850a362d5a1ae62cfb4069.exe
-
Size
751KB
-
MD5
ff033882fd3fb5e207376bf6c88e483a
-
SHA1
4f2f1e0397b82a0a01c1ab5cd5b0ed4900746c32
-
SHA256
c3e979d3da9c48e0e9043c84a30c5e20572c443979850a362d5a1ae62cfb4069
-
SHA512
827c471c6389a5b215eac0c88e5d4cf88ab72f626640d34e617c6cbdfa998c590a7b2ac1be921fad3426428124e0e7985776ea12024eea8347da94add5c8a0a8
-
SSDEEP
12288:uoAD0ZjhqJ7RX0VIidy+6+M+u4GZDBPsX2S/Z+noPtGBpEU47mZ2bHJA8xzYi65b:uoACdARX6IF+6PKGZtM/Z+oFGrBamZ2u
Malware Config
Extracted
darkcomet
NEW
m5tl.no-ip.biz:2271
DC_MUTEX-P6L94WP
-
InstallPath
MSDCSC\msdcsc.exe
-
gencode
G55c97KT2sPR
-
install
true
-
offline_keylogger
true
-
persistence
true
-
reg_key
MicroUpdate
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Users\\Admin\\Documents\\MSDCSC\\msdcsc.exe" c3e979d3da9c48e0e9043c84a30c5e20572c443979850a362d5a1ae62cfb4069.exe -
Executes dropped EXE 2 IoCs
pid Process 740 msdcsc.exe 1640 msdcsc.exe -
Sets file to hidden 1 TTPs 2 IoCs
Modifies file attributes to stop it showing in Explorer etc.
pid Process 1152 attrib.exe 276 attrib.exe -
Deletes itself 1 IoCs
pid Process 572 notepad.exe -
Loads dropped DLL 2 IoCs
pid Process 1736 c3e979d3da9c48e0e9043c84a30c5e20572c443979850a362d5a1ae62cfb4069.exe 1736 c3e979d3da9c48e0e9043c84a30c5e20572c443979850a362d5a1ae62cfb4069.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Users\\Admin\\Documents\\MSDCSC\\msdcsc.exe" c3e979d3da9c48e0e9043c84a30c5e20572c443979850a362d5a1ae62cfb4069.exe -
Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 1988 set thread context of 1736 1988 c3e979d3da9c48e0e9043c84a30c5e20572c443979850a362d5a1ae62cfb4069.exe 28 PID 740 set thread context of 1640 740 msdcsc.exe 37 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of AdjustPrivilegeToken 29 IoCs
description pid Process Token: SeDebugPrivilege 1988 c3e979d3da9c48e0e9043c84a30c5e20572c443979850a362d5a1ae62cfb4069.exe Token: 33 1988 c3e979d3da9c48e0e9043c84a30c5e20572c443979850a362d5a1ae62cfb4069.exe Token: SeIncBasePriorityPrivilege 1988 c3e979d3da9c48e0e9043c84a30c5e20572c443979850a362d5a1ae62cfb4069.exe Token: SeIncreaseQuotaPrivilege 1736 c3e979d3da9c48e0e9043c84a30c5e20572c443979850a362d5a1ae62cfb4069.exe Token: SeSecurityPrivilege 1736 c3e979d3da9c48e0e9043c84a30c5e20572c443979850a362d5a1ae62cfb4069.exe Token: SeTakeOwnershipPrivilege 1736 c3e979d3da9c48e0e9043c84a30c5e20572c443979850a362d5a1ae62cfb4069.exe Token: SeLoadDriverPrivilege 1736 c3e979d3da9c48e0e9043c84a30c5e20572c443979850a362d5a1ae62cfb4069.exe Token: SeSystemProfilePrivilege 1736 c3e979d3da9c48e0e9043c84a30c5e20572c443979850a362d5a1ae62cfb4069.exe Token: SeSystemtimePrivilege 1736 c3e979d3da9c48e0e9043c84a30c5e20572c443979850a362d5a1ae62cfb4069.exe Token: SeProfSingleProcessPrivilege 1736 c3e979d3da9c48e0e9043c84a30c5e20572c443979850a362d5a1ae62cfb4069.exe Token: SeIncBasePriorityPrivilege 1736 c3e979d3da9c48e0e9043c84a30c5e20572c443979850a362d5a1ae62cfb4069.exe Token: SeCreatePagefilePrivilege 1736 c3e979d3da9c48e0e9043c84a30c5e20572c443979850a362d5a1ae62cfb4069.exe Token: SeBackupPrivilege 1736 c3e979d3da9c48e0e9043c84a30c5e20572c443979850a362d5a1ae62cfb4069.exe Token: SeRestorePrivilege 1736 c3e979d3da9c48e0e9043c84a30c5e20572c443979850a362d5a1ae62cfb4069.exe Token: SeShutdownPrivilege 1736 c3e979d3da9c48e0e9043c84a30c5e20572c443979850a362d5a1ae62cfb4069.exe Token: SeDebugPrivilege 1736 c3e979d3da9c48e0e9043c84a30c5e20572c443979850a362d5a1ae62cfb4069.exe Token: SeSystemEnvironmentPrivilege 1736 c3e979d3da9c48e0e9043c84a30c5e20572c443979850a362d5a1ae62cfb4069.exe Token: SeChangeNotifyPrivilege 1736 c3e979d3da9c48e0e9043c84a30c5e20572c443979850a362d5a1ae62cfb4069.exe Token: SeRemoteShutdownPrivilege 1736 c3e979d3da9c48e0e9043c84a30c5e20572c443979850a362d5a1ae62cfb4069.exe Token: SeUndockPrivilege 1736 c3e979d3da9c48e0e9043c84a30c5e20572c443979850a362d5a1ae62cfb4069.exe Token: SeManageVolumePrivilege 1736 c3e979d3da9c48e0e9043c84a30c5e20572c443979850a362d5a1ae62cfb4069.exe Token: SeImpersonatePrivilege 1736 c3e979d3da9c48e0e9043c84a30c5e20572c443979850a362d5a1ae62cfb4069.exe Token: SeCreateGlobalPrivilege 1736 c3e979d3da9c48e0e9043c84a30c5e20572c443979850a362d5a1ae62cfb4069.exe Token: 33 1736 c3e979d3da9c48e0e9043c84a30c5e20572c443979850a362d5a1ae62cfb4069.exe Token: 34 1736 c3e979d3da9c48e0e9043c84a30c5e20572c443979850a362d5a1ae62cfb4069.exe Token: 35 1736 c3e979d3da9c48e0e9043c84a30c5e20572c443979850a362d5a1ae62cfb4069.exe Token: SeDebugPrivilege 740 msdcsc.exe Token: 33 740 msdcsc.exe Token: SeIncBasePriorityPrivilege 740 msdcsc.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1988 wrote to memory of 1736 1988 c3e979d3da9c48e0e9043c84a30c5e20572c443979850a362d5a1ae62cfb4069.exe 28 PID 1988 wrote to memory of 1736 1988 c3e979d3da9c48e0e9043c84a30c5e20572c443979850a362d5a1ae62cfb4069.exe 28 PID 1988 wrote to memory of 1736 1988 c3e979d3da9c48e0e9043c84a30c5e20572c443979850a362d5a1ae62cfb4069.exe 28 PID 1988 wrote to memory of 1736 1988 c3e979d3da9c48e0e9043c84a30c5e20572c443979850a362d5a1ae62cfb4069.exe 28 PID 1988 wrote to memory of 1736 1988 c3e979d3da9c48e0e9043c84a30c5e20572c443979850a362d5a1ae62cfb4069.exe 28 PID 1988 wrote to memory of 1736 1988 c3e979d3da9c48e0e9043c84a30c5e20572c443979850a362d5a1ae62cfb4069.exe 28 PID 1988 wrote to memory of 1736 1988 c3e979d3da9c48e0e9043c84a30c5e20572c443979850a362d5a1ae62cfb4069.exe 28 PID 1988 wrote to memory of 1736 1988 c3e979d3da9c48e0e9043c84a30c5e20572c443979850a362d5a1ae62cfb4069.exe 28 PID 1988 wrote to memory of 1736 1988 c3e979d3da9c48e0e9043c84a30c5e20572c443979850a362d5a1ae62cfb4069.exe 28 PID 1988 wrote to memory of 1736 1988 c3e979d3da9c48e0e9043c84a30c5e20572c443979850a362d5a1ae62cfb4069.exe 28 PID 1988 wrote to memory of 1736 1988 c3e979d3da9c48e0e9043c84a30c5e20572c443979850a362d5a1ae62cfb4069.exe 28 PID 1988 wrote to memory of 1736 1988 c3e979d3da9c48e0e9043c84a30c5e20572c443979850a362d5a1ae62cfb4069.exe 28 PID 1988 wrote to memory of 1736 1988 c3e979d3da9c48e0e9043c84a30c5e20572c443979850a362d5a1ae62cfb4069.exe 28 PID 1988 wrote to memory of 1736 1988 c3e979d3da9c48e0e9043c84a30c5e20572c443979850a362d5a1ae62cfb4069.exe 28 PID 1988 wrote to memory of 1736 1988 c3e979d3da9c48e0e9043c84a30c5e20572c443979850a362d5a1ae62cfb4069.exe 28 PID 1736 wrote to memory of 1720 1736 c3e979d3da9c48e0e9043c84a30c5e20572c443979850a362d5a1ae62cfb4069.exe 29 PID 1736 wrote to memory of 1720 1736 c3e979d3da9c48e0e9043c84a30c5e20572c443979850a362d5a1ae62cfb4069.exe 29 PID 1736 wrote to memory of 1720 1736 c3e979d3da9c48e0e9043c84a30c5e20572c443979850a362d5a1ae62cfb4069.exe 29 PID 1736 wrote to memory of 1720 1736 c3e979d3da9c48e0e9043c84a30c5e20572c443979850a362d5a1ae62cfb4069.exe 29 PID 1736 wrote to memory of 1276 1736 c3e979d3da9c48e0e9043c84a30c5e20572c443979850a362d5a1ae62cfb4069.exe 31 PID 1736 wrote to memory of 1276 1736 c3e979d3da9c48e0e9043c84a30c5e20572c443979850a362d5a1ae62cfb4069.exe 31 PID 1736 wrote to memory of 1276 1736 c3e979d3da9c48e0e9043c84a30c5e20572c443979850a362d5a1ae62cfb4069.exe 31 PID 1736 wrote to memory of 1276 1736 c3e979d3da9c48e0e9043c84a30c5e20572c443979850a362d5a1ae62cfb4069.exe 31 PID 1736 wrote to memory of 572 1736 c3e979d3da9c48e0e9043c84a30c5e20572c443979850a362d5a1ae62cfb4069.exe 32 PID 1736 wrote to memory of 572 1736 c3e979d3da9c48e0e9043c84a30c5e20572c443979850a362d5a1ae62cfb4069.exe 32 PID 1736 wrote to memory of 572 1736 c3e979d3da9c48e0e9043c84a30c5e20572c443979850a362d5a1ae62cfb4069.exe 32 PID 1736 wrote to memory of 572 1736 c3e979d3da9c48e0e9043c84a30c5e20572c443979850a362d5a1ae62cfb4069.exe 32 PID 1736 wrote to memory of 572 1736 c3e979d3da9c48e0e9043c84a30c5e20572c443979850a362d5a1ae62cfb4069.exe 32 PID 1736 wrote to memory of 572 1736 c3e979d3da9c48e0e9043c84a30c5e20572c443979850a362d5a1ae62cfb4069.exe 32 PID 1736 wrote to memory of 572 1736 c3e979d3da9c48e0e9043c84a30c5e20572c443979850a362d5a1ae62cfb4069.exe 32 PID 1736 wrote to memory of 572 1736 c3e979d3da9c48e0e9043c84a30c5e20572c443979850a362d5a1ae62cfb4069.exe 32 PID 1736 wrote to memory of 572 1736 c3e979d3da9c48e0e9043c84a30c5e20572c443979850a362d5a1ae62cfb4069.exe 32 PID 1736 wrote to memory of 572 1736 c3e979d3da9c48e0e9043c84a30c5e20572c443979850a362d5a1ae62cfb4069.exe 32 PID 1736 wrote to memory of 572 1736 c3e979d3da9c48e0e9043c84a30c5e20572c443979850a362d5a1ae62cfb4069.exe 32 PID 1736 wrote to memory of 572 1736 c3e979d3da9c48e0e9043c84a30c5e20572c443979850a362d5a1ae62cfb4069.exe 32 PID 1736 wrote to memory of 572 1736 c3e979d3da9c48e0e9043c84a30c5e20572c443979850a362d5a1ae62cfb4069.exe 32 PID 1736 wrote to memory of 572 1736 c3e979d3da9c48e0e9043c84a30c5e20572c443979850a362d5a1ae62cfb4069.exe 32 PID 1736 wrote to memory of 572 1736 c3e979d3da9c48e0e9043c84a30c5e20572c443979850a362d5a1ae62cfb4069.exe 32 PID 1736 wrote to memory of 572 1736 c3e979d3da9c48e0e9043c84a30c5e20572c443979850a362d5a1ae62cfb4069.exe 32 PID 1736 wrote to memory of 572 1736 c3e979d3da9c48e0e9043c84a30c5e20572c443979850a362d5a1ae62cfb4069.exe 32 PID 1736 wrote to memory of 572 1736 c3e979d3da9c48e0e9043c84a30c5e20572c443979850a362d5a1ae62cfb4069.exe 32 PID 1720 wrote to memory of 1152 1720 cmd.exe 34 PID 1720 wrote to memory of 1152 1720 cmd.exe 34 PID 1720 wrote to memory of 1152 1720 cmd.exe 34 PID 1720 wrote to memory of 1152 1720 cmd.exe 34 PID 1736 wrote to memory of 740 1736 c3e979d3da9c48e0e9043c84a30c5e20572c443979850a362d5a1ae62cfb4069.exe 35 PID 1736 wrote to memory of 740 1736 c3e979d3da9c48e0e9043c84a30c5e20572c443979850a362d5a1ae62cfb4069.exe 35 PID 1736 wrote to memory of 740 1736 c3e979d3da9c48e0e9043c84a30c5e20572c443979850a362d5a1ae62cfb4069.exe 35 PID 1736 wrote to memory of 740 1736 c3e979d3da9c48e0e9043c84a30c5e20572c443979850a362d5a1ae62cfb4069.exe 35 PID 1276 wrote to memory of 276 1276 cmd.exe 36 PID 1276 wrote to memory of 276 1276 cmd.exe 36 PID 1276 wrote to memory of 276 1276 cmd.exe 36 PID 1276 wrote to memory of 276 1276 cmd.exe 36 PID 740 wrote to memory of 1640 740 msdcsc.exe 37 PID 740 wrote to memory of 1640 740 msdcsc.exe 37 PID 740 wrote to memory of 1640 740 msdcsc.exe 37 PID 740 wrote to memory of 1640 740 msdcsc.exe 37 PID 740 wrote to memory of 1640 740 msdcsc.exe 37 PID 740 wrote to memory of 1640 740 msdcsc.exe 37 PID 740 wrote to memory of 1640 740 msdcsc.exe 37 PID 740 wrote to memory of 1640 740 msdcsc.exe 37 PID 740 wrote to memory of 1640 740 msdcsc.exe 37 PID 740 wrote to memory of 1640 740 msdcsc.exe 37 PID 740 wrote to memory of 1640 740 msdcsc.exe 37 -
Views/modifies file attributes 1 TTPs 2 IoCs
pid Process 1152 attrib.exe 276 attrib.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\c3e979d3da9c48e0e9043c84a30c5e20572c443979850a362d5a1ae62cfb4069.exe"C:\Users\Admin\AppData\Local\Temp\c3e979d3da9c48e0e9043c84a30c5e20572c443979850a362d5a1ae62cfb4069.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1988 -
C:\Users\Admin\AppData\Local\Temp\c3e979d3da9c48e0e9043c84a30c5e20572c443979850a362d5a1ae62cfb4069.exeC:\Users\Admin\AppData\Local\Temp\c3e979d3da9c48e0e9043c84a30c5e20572c443979850a362d5a1ae62cfb4069.exe2⤵
- Modifies WinLogon for persistence
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1736 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp\c3e979d3da9c48e0e9043c84a30c5e20572c443979850a362d5a1ae62cfb4069.exe" +s +h3⤵
- Suspicious use of WriteProcessMemory
PID:1720 -
C:\Windows\SysWOW64\attrib.exeattrib "C:\Users\Admin\AppData\Local\Temp\c3e979d3da9c48e0e9043c84a30c5e20572c443979850a362d5a1ae62cfb4069.exe" +s +h4⤵
- Sets file to hidden
- Views/modifies file attributes
PID:1152
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp" +s +h3⤵
- Suspicious use of WriteProcessMemory
PID:1276 -
C:\Windows\SysWOW64\attrib.exeattrib "C:\Users\Admin\AppData\Local\Temp" +s +h4⤵
- Sets file to hidden
- Views/modifies file attributes
PID:276
-
-
-
C:\Windows\SysWOW64\notepad.exenotepad3⤵
- Deletes itself
PID:572
-
-
C:\Users\Admin\Documents\MSDCSC\msdcsc.exe"C:\Users\Admin\Documents\MSDCSC\msdcsc.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:740 -
C:\Users\Admin\Documents\MSDCSC\msdcsc.exeC:\Users\Admin\Documents\MSDCSC\msdcsc.exe4⤵
- Executes dropped EXE
PID:1640
-
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
751KB
MD5ff033882fd3fb5e207376bf6c88e483a
SHA14f2f1e0397b82a0a01c1ab5cd5b0ed4900746c32
SHA256c3e979d3da9c48e0e9043c84a30c5e20572c443979850a362d5a1ae62cfb4069
SHA512827c471c6389a5b215eac0c88e5d4cf88ab72f626640d34e617c6cbdfa998c590a7b2ac1be921fad3426428124e0e7985776ea12024eea8347da94add5c8a0a8
-
Filesize
751KB
MD5ff033882fd3fb5e207376bf6c88e483a
SHA14f2f1e0397b82a0a01c1ab5cd5b0ed4900746c32
SHA256c3e979d3da9c48e0e9043c84a30c5e20572c443979850a362d5a1ae62cfb4069
SHA512827c471c6389a5b215eac0c88e5d4cf88ab72f626640d34e617c6cbdfa998c590a7b2ac1be921fad3426428124e0e7985776ea12024eea8347da94add5c8a0a8
-
Filesize
751KB
MD5ff033882fd3fb5e207376bf6c88e483a
SHA14f2f1e0397b82a0a01c1ab5cd5b0ed4900746c32
SHA256c3e979d3da9c48e0e9043c84a30c5e20572c443979850a362d5a1ae62cfb4069
SHA512827c471c6389a5b215eac0c88e5d4cf88ab72f626640d34e617c6cbdfa998c590a7b2ac1be921fad3426428124e0e7985776ea12024eea8347da94add5c8a0a8
-
Filesize
751KB
MD5ff033882fd3fb5e207376bf6c88e483a
SHA14f2f1e0397b82a0a01c1ab5cd5b0ed4900746c32
SHA256c3e979d3da9c48e0e9043c84a30c5e20572c443979850a362d5a1ae62cfb4069
SHA512827c471c6389a5b215eac0c88e5d4cf88ab72f626640d34e617c6cbdfa998c590a7b2ac1be921fad3426428124e0e7985776ea12024eea8347da94add5c8a0a8
-
Filesize
751KB
MD5ff033882fd3fb5e207376bf6c88e483a
SHA14f2f1e0397b82a0a01c1ab5cd5b0ed4900746c32
SHA256c3e979d3da9c48e0e9043c84a30c5e20572c443979850a362d5a1ae62cfb4069
SHA512827c471c6389a5b215eac0c88e5d4cf88ab72f626640d34e617c6cbdfa998c590a7b2ac1be921fad3426428124e0e7985776ea12024eea8347da94add5c8a0a8