Analysis
-
max time kernel
95s -
max time network
140s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
30-10-2022 11:47
Static task
static1
Behavioral task
behavioral1
Sample
eac97654d08020adbfe753a3b202202b5c62589e34f2097cd71a8a8d8b14bda7.exe
Resource
win7-20220812-en
General
-
Target
eac97654d08020adbfe753a3b202202b5c62589e34f2097cd71a8a8d8b14bda7.exe
-
Size
825KB
-
MD5
5a6b430cc8ebd6b4ea8aab5833a1cbdf
-
SHA1
99c87aecf5a7b5658fd1352dc97ad148a2545f2c
-
SHA256
eac97654d08020adbfe753a3b202202b5c62589e34f2097cd71a8a8d8b14bda7
-
SHA512
9ac2a08bf0983c570cc143b2b4f7f5db36c092a1159979063d3d9719eae3913c1b765eab242823008951f56cb4bc69edef2b46be894f3d35310ff6565ca58922
-
SSDEEP
24576:74nInLWoUHdj79beliFLfqd0c4ifqPHdvj5yL5j:MILWtHXFDvhHHdrkp
Malware Config
Extracted
darkcomet
2
127.0.0.1:1604
DC_MUTEX-HPTFP88
-
InstallPath
MSDCSC\msdcsc.exe
-
gencode
A4rqb41NhVrE
-
install
true
-
offline_keylogger
true
-
persistence
true
-
reg_key
MicroUpdate
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
Processes:
vbc.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe" vbc.exe -
Executes dropped EXE 1 IoCs
Processes:
msdcsc.exepid process 4008 msdcsc.exe -
Sets file to hidden 1 TTPs 2 IoCs
Modifies file attributes to stop it showing in Explorer etc.
Processes:
attrib.exeattrib.exepid process 4628 attrib.exe 4328 attrib.exe -
Uses the VBS compiler for execution 1 TTPs
-
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
vbc.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Windows\\system32\\MSDCSC\\msdcsc.exe" vbc.exe -
Drops file in System32 directory 3 IoCs
Processes:
vbc.exedescription ioc process File created C:\Windows\SysWOW64\MSDCSC\msdcsc.exe vbc.exe File opened for modification C:\Windows\SysWOW64\MSDCSC\msdcsc.exe vbc.exe File opened for modification C:\Windows\SysWOW64\MSDCSC\ vbc.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
eac97654d08020adbfe753a3b202202b5c62589e34f2097cd71a8a8d8b14bda7.exedescription pid process target process PID 1944 set thread context of 1836 1944 eac97654d08020adbfe753a3b202202b5c62589e34f2097cd71a8a8d8b14bda7.exe vbc.exe -
Drops file in Windows directory 2 IoCs
Processes:
attrib.exeattrib.exedescription ioc process File opened for modification C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe attrib.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v2.0.50727 attrib.exe -
Modifies registry class 1 IoCs
Processes:
vbc.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ vbc.exe -
Suspicious behavior: EnumeratesProcesses 11 IoCs
Processes:
eac97654d08020adbfe753a3b202202b5c62589e34f2097cd71a8a8d8b14bda7.exepid process 1944 eac97654d08020adbfe753a3b202202b5c62589e34f2097cd71a8a8d8b14bda7.exe 1944 eac97654d08020adbfe753a3b202202b5c62589e34f2097cd71a8a8d8b14bda7.exe 1944 eac97654d08020adbfe753a3b202202b5c62589e34f2097cd71a8a8d8b14bda7.exe 1944 eac97654d08020adbfe753a3b202202b5c62589e34f2097cd71a8a8d8b14bda7.exe 1944 eac97654d08020adbfe753a3b202202b5c62589e34f2097cd71a8a8d8b14bda7.exe 1944 eac97654d08020adbfe753a3b202202b5c62589e34f2097cd71a8a8d8b14bda7.exe 1944 eac97654d08020adbfe753a3b202202b5c62589e34f2097cd71a8a8d8b14bda7.exe 1944 eac97654d08020adbfe753a3b202202b5c62589e34f2097cd71a8a8d8b14bda7.exe 1944 eac97654d08020adbfe753a3b202202b5c62589e34f2097cd71a8a8d8b14bda7.exe 1944 eac97654d08020adbfe753a3b202202b5c62589e34f2097cd71a8a8d8b14bda7.exe 1944 eac97654d08020adbfe753a3b202202b5c62589e34f2097cd71a8a8d8b14bda7.exe -
Suspicious use of AdjustPrivilegeToken 25 IoCs
Processes:
eac97654d08020adbfe753a3b202202b5c62589e34f2097cd71a8a8d8b14bda7.exevbc.exedescription pid process Token: SeDebugPrivilege 1944 eac97654d08020adbfe753a3b202202b5c62589e34f2097cd71a8a8d8b14bda7.exe Token: SeIncreaseQuotaPrivilege 1836 vbc.exe Token: SeSecurityPrivilege 1836 vbc.exe Token: SeTakeOwnershipPrivilege 1836 vbc.exe Token: SeLoadDriverPrivilege 1836 vbc.exe Token: SeSystemProfilePrivilege 1836 vbc.exe Token: SeSystemtimePrivilege 1836 vbc.exe Token: SeProfSingleProcessPrivilege 1836 vbc.exe Token: SeIncBasePriorityPrivilege 1836 vbc.exe Token: SeCreatePagefilePrivilege 1836 vbc.exe Token: SeBackupPrivilege 1836 vbc.exe Token: SeRestorePrivilege 1836 vbc.exe Token: SeShutdownPrivilege 1836 vbc.exe Token: SeDebugPrivilege 1836 vbc.exe Token: SeSystemEnvironmentPrivilege 1836 vbc.exe Token: SeChangeNotifyPrivilege 1836 vbc.exe Token: SeRemoteShutdownPrivilege 1836 vbc.exe Token: SeUndockPrivilege 1836 vbc.exe Token: SeManageVolumePrivilege 1836 vbc.exe Token: SeImpersonatePrivilege 1836 vbc.exe Token: SeCreateGlobalPrivilege 1836 vbc.exe Token: 33 1836 vbc.exe Token: 34 1836 vbc.exe Token: 35 1836 vbc.exe Token: 36 1836 vbc.exe -
Suspicious use of WriteProcessMemory 29 IoCs
Processes:
eac97654d08020adbfe753a3b202202b5c62589e34f2097cd71a8a8d8b14bda7.exevbc.execmd.execmd.exedescription pid process target process PID 1944 wrote to memory of 1836 1944 eac97654d08020adbfe753a3b202202b5c62589e34f2097cd71a8a8d8b14bda7.exe vbc.exe PID 1944 wrote to memory of 1836 1944 eac97654d08020adbfe753a3b202202b5c62589e34f2097cd71a8a8d8b14bda7.exe vbc.exe PID 1944 wrote to memory of 1836 1944 eac97654d08020adbfe753a3b202202b5c62589e34f2097cd71a8a8d8b14bda7.exe vbc.exe PID 1944 wrote to memory of 1836 1944 eac97654d08020adbfe753a3b202202b5c62589e34f2097cd71a8a8d8b14bda7.exe vbc.exe PID 1944 wrote to memory of 1836 1944 eac97654d08020adbfe753a3b202202b5c62589e34f2097cd71a8a8d8b14bda7.exe vbc.exe PID 1944 wrote to memory of 1836 1944 eac97654d08020adbfe753a3b202202b5c62589e34f2097cd71a8a8d8b14bda7.exe vbc.exe PID 1944 wrote to memory of 1836 1944 eac97654d08020adbfe753a3b202202b5c62589e34f2097cd71a8a8d8b14bda7.exe vbc.exe PID 1944 wrote to memory of 1836 1944 eac97654d08020adbfe753a3b202202b5c62589e34f2097cd71a8a8d8b14bda7.exe vbc.exe PID 1944 wrote to memory of 1836 1944 eac97654d08020adbfe753a3b202202b5c62589e34f2097cd71a8a8d8b14bda7.exe vbc.exe PID 1944 wrote to memory of 1836 1944 eac97654d08020adbfe753a3b202202b5c62589e34f2097cd71a8a8d8b14bda7.exe vbc.exe PID 1944 wrote to memory of 1836 1944 eac97654d08020adbfe753a3b202202b5c62589e34f2097cd71a8a8d8b14bda7.exe vbc.exe PID 1944 wrote to memory of 1836 1944 eac97654d08020adbfe753a3b202202b5c62589e34f2097cd71a8a8d8b14bda7.exe vbc.exe PID 1944 wrote to memory of 1836 1944 eac97654d08020adbfe753a3b202202b5c62589e34f2097cd71a8a8d8b14bda7.exe vbc.exe PID 1944 wrote to memory of 1836 1944 eac97654d08020adbfe753a3b202202b5c62589e34f2097cd71a8a8d8b14bda7.exe vbc.exe PID 1836 wrote to memory of 5036 1836 vbc.exe cmd.exe PID 1836 wrote to memory of 5036 1836 vbc.exe cmd.exe PID 1836 wrote to memory of 5036 1836 vbc.exe cmd.exe PID 1836 wrote to memory of 4932 1836 vbc.exe cmd.exe PID 1836 wrote to memory of 4932 1836 vbc.exe cmd.exe PID 1836 wrote to memory of 4932 1836 vbc.exe cmd.exe PID 5036 wrote to memory of 4628 5036 cmd.exe attrib.exe PID 5036 wrote to memory of 4628 5036 cmd.exe attrib.exe PID 5036 wrote to memory of 4628 5036 cmd.exe attrib.exe PID 4932 wrote to memory of 4328 4932 cmd.exe attrib.exe PID 4932 wrote to memory of 4328 4932 cmd.exe attrib.exe PID 4932 wrote to memory of 4328 4932 cmd.exe attrib.exe PID 1836 wrote to memory of 4008 1836 vbc.exe msdcsc.exe PID 1836 wrote to memory of 4008 1836 vbc.exe msdcsc.exe PID 1836 wrote to memory of 4008 1836 vbc.exe msdcsc.exe -
Views/modifies file attributes 1 TTPs 2 IoCs
Processes:
attrib.exeattrib.exepid process 4628 attrib.exe 4328 attrib.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\eac97654d08020adbfe753a3b202202b5c62589e34f2097cd71a8a8d8b14bda7.exe"C:\Users\Admin\AppData\Local\Temp\eac97654d08020adbfe753a3b202202b5c62589e34f2097cd71a8a8d8b14bda7.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeC:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe2⤵
- Modifies WinLogon for persistence
- Adds Run key to start application
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" +s +h3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" +s +h4⤵
- Sets file to hidden
- Drops file in Windows directory
- Views/modifies file attributes
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\Microsoft.NET\Framework\v2.0.50727" +s +h3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\Microsoft.NET\Framework\v2.0.50727" +s +h4⤵
- Sets file to hidden
- Drops file in Windows directory
- Views/modifies file attributes
-
C:\Windows\SysWOW64\MSDCSC\msdcsc.exe"C:\Windows\system32\MSDCSC\msdcsc.exe"3⤵
- Executes dropped EXE
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Windows\SysWOW64\MSDCSC\msdcsc.exeFilesize
1.1MB
MD5d881de17aa8f2e2c08cbb7b265f928f9
SHA108936aebc87decf0af6e8eada191062b5e65ac2a
SHA256b3a37093609f9a20ad60b85a9fa9de2ba674cba9b5bd687729440c70ba619ca0
SHA5125f23bfb1b8740247b36ed0ab741738c7d4c949736129e767213e321607d1ccd3e3a8428e4ba44bd28a275b5e3f6206285b1a522514b7ef7ea5e698d90a713d34
-
C:\Windows\SysWOW64\MSDCSC\msdcsc.exeFilesize
1.1MB
MD5d881de17aa8f2e2c08cbb7b265f928f9
SHA108936aebc87decf0af6e8eada191062b5e65ac2a
SHA256b3a37093609f9a20ad60b85a9fa9de2ba674cba9b5bd687729440c70ba619ca0
SHA5125f23bfb1b8740247b36ed0ab741738c7d4c949736129e767213e321607d1ccd3e3a8428e4ba44bd28a275b5e3f6206285b1a522514b7ef7ea5e698d90a713d34
-
memory/1836-142-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/1836-133-0x0000000000000000-mapping.dmp
-
memory/1836-134-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/1836-135-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/1836-137-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/1944-136-0x0000000075590000-0x0000000075B41000-memory.dmpFilesize
5.7MB
-
memory/1944-132-0x0000000075590000-0x0000000075B41000-memory.dmpFilesize
5.7MB
-
memory/4008-143-0x0000000000000000-mapping.dmp
-
memory/4328-141-0x0000000000000000-mapping.dmp
-
memory/4628-140-0x0000000000000000-mapping.dmp
-
memory/4932-139-0x0000000000000000-mapping.dmp
-
memory/5036-138-0x0000000000000000-mapping.dmp