Analysis
-
max time kernel
167s -
max time network
169s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
19-11-2022 09:27
Behavioral task
behavioral1
Sample
a388d70926f91a010bdbaac36a277e8c4aed820d7d223e11bf387352b3b77e9e.exe
Resource
win7-20221111-en
General
-
Target
a388d70926f91a010bdbaac36a277e8c4aed820d7d223e11bf387352b3b77e9e.exe
-
Size
690KB
-
MD5
527532ba8c387b294cd05e3e4a579dc6
-
SHA1
e829080f98b7f7b94c25d7f08b6e56ca349904c5
-
SHA256
a388d70926f91a010bdbaac36a277e8c4aed820d7d223e11bf387352b3b77e9e
-
SHA512
44565f37619ff4b642204e31ac11fda8587e7bff6b21e14ded0068aee53febfef824ffe6ba64dbd828502d799f665f1ac53181aacc415a4e3b3546c7f30b0b6b
-
SSDEEP
12288:Z9HFJ9rJxRX1uVVjoaWSoynxdO1FVBaOiRZTERfIhNkNCCLo9Ek5C/hJy:jZ1xuVVjfFoynPaVBUR8f+kN10EB+
Malware Config
Extracted
darkcomet
Bot
dms17.no-ip.org:1604
127.0.0.1:1604
DC_MUTEX-DGLFPKJ
-
InstallPath
MSDCSC\msdcsc.exe
-
gencode
UPrqceYJUHhe
-
install
true
-
offline_keylogger
true
-
persistence
true
-
reg_key
MicroUpdate
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
Processes:
a388d70926f91a010bdbaac36a277e8c4aed820d7d223e11bf387352b3b77e9e.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe" a388d70926f91a010bdbaac36a277e8c4aed820d7d223e11bf387352b3b77e9e.exe -
Executes dropped EXE 1 IoCs
Processes:
msdcsc.exepid process 580 msdcsc.exe -
Sets file to hidden 1 TTPs 2 IoCs
Modifies file attributes to stop it showing in Explorer etc.
Processes:
attrib.exeattrib.exepid process 1912 attrib.exe 576 attrib.exe -
Deletes itself 1 IoCs
Processes:
notepad.exepid process 572 notepad.exe -
Loads dropped DLL 2 IoCs
Processes:
a388d70926f91a010bdbaac36a277e8c4aed820d7d223e11bf387352b3b77e9e.exepid process 1224 a388d70926f91a010bdbaac36a277e8c4aed820d7d223e11bf387352b3b77e9e.exe 1224 a388d70926f91a010bdbaac36a277e8c4aed820d7d223e11bf387352b3b77e9e.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
a388d70926f91a010bdbaac36a277e8c4aed820d7d223e11bf387352b3b77e9e.exemsdcsc.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Windows\\system32\\MSDCSC\\msdcsc.exe" a388d70926f91a010bdbaac36a277e8c4aed820d7d223e11bf387352b3b77e9e.exe Set value (str) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Windows\\system32\\MSDCSC\\msdcsc.exe" msdcsc.exe -
Drops file in System32 directory 3 IoCs
Processes:
a388d70926f91a010bdbaac36a277e8c4aed820d7d223e11bf387352b3b77e9e.exedescription ioc process File created C:\Windows\SysWOW64\MSDCSC\msdcsc.exe a388d70926f91a010bdbaac36a277e8c4aed820d7d223e11bf387352b3b77e9e.exe File opened for modification C:\Windows\SysWOW64\MSDCSC\msdcsc.exe a388d70926f91a010bdbaac36a277e8c4aed820d7d223e11bf387352b3b77e9e.exe File opened for modification C:\Windows\SysWOW64\MSDCSC\ a388d70926f91a010bdbaac36a277e8c4aed820d7d223e11bf387352b3b77e9e.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
msdcsc.exepid process 580 msdcsc.exe -
Suspicious use of AdjustPrivilegeToken 46 IoCs
Processes:
a388d70926f91a010bdbaac36a277e8c4aed820d7d223e11bf387352b3b77e9e.exemsdcsc.exedescription pid process Token: SeIncreaseQuotaPrivilege 1224 a388d70926f91a010bdbaac36a277e8c4aed820d7d223e11bf387352b3b77e9e.exe Token: SeSecurityPrivilege 1224 a388d70926f91a010bdbaac36a277e8c4aed820d7d223e11bf387352b3b77e9e.exe Token: SeTakeOwnershipPrivilege 1224 a388d70926f91a010bdbaac36a277e8c4aed820d7d223e11bf387352b3b77e9e.exe Token: SeLoadDriverPrivilege 1224 a388d70926f91a010bdbaac36a277e8c4aed820d7d223e11bf387352b3b77e9e.exe Token: SeSystemProfilePrivilege 1224 a388d70926f91a010bdbaac36a277e8c4aed820d7d223e11bf387352b3b77e9e.exe Token: SeSystemtimePrivilege 1224 a388d70926f91a010bdbaac36a277e8c4aed820d7d223e11bf387352b3b77e9e.exe Token: SeProfSingleProcessPrivilege 1224 a388d70926f91a010bdbaac36a277e8c4aed820d7d223e11bf387352b3b77e9e.exe Token: SeIncBasePriorityPrivilege 1224 a388d70926f91a010bdbaac36a277e8c4aed820d7d223e11bf387352b3b77e9e.exe Token: SeCreatePagefilePrivilege 1224 a388d70926f91a010bdbaac36a277e8c4aed820d7d223e11bf387352b3b77e9e.exe Token: SeBackupPrivilege 1224 a388d70926f91a010bdbaac36a277e8c4aed820d7d223e11bf387352b3b77e9e.exe Token: SeRestorePrivilege 1224 a388d70926f91a010bdbaac36a277e8c4aed820d7d223e11bf387352b3b77e9e.exe Token: SeShutdownPrivilege 1224 a388d70926f91a010bdbaac36a277e8c4aed820d7d223e11bf387352b3b77e9e.exe Token: SeDebugPrivilege 1224 a388d70926f91a010bdbaac36a277e8c4aed820d7d223e11bf387352b3b77e9e.exe Token: SeSystemEnvironmentPrivilege 1224 a388d70926f91a010bdbaac36a277e8c4aed820d7d223e11bf387352b3b77e9e.exe Token: SeChangeNotifyPrivilege 1224 a388d70926f91a010bdbaac36a277e8c4aed820d7d223e11bf387352b3b77e9e.exe Token: SeRemoteShutdownPrivilege 1224 a388d70926f91a010bdbaac36a277e8c4aed820d7d223e11bf387352b3b77e9e.exe Token: SeUndockPrivilege 1224 a388d70926f91a010bdbaac36a277e8c4aed820d7d223e11bf387352b3b77e9e.exe Token: SeManageVolumePrivilege 1224 a388d70926f91a010bdbaac36a277e8c4aed820d7d223e11bf387352b3b77e9e.exe Token: SeImpersonatePrivilege 1224 a388d70926f91a010bdbaac36a277e8c4aed820d7d223e11bf387352b3b77e9e.exe Token: SeCreateGlobalPrivilege 1224 a388d70926f91a010bdbaac36a277e8c4aed820d7d223e11bf387352b3b77e9e.exe Token: 33 1224 a388d70926f91a010bdbaac36a277e8c4aed820d7d223e11bf387352b3b77e9e.exe Token: 34 1224 a388d70926f91a010bdbaac36a277e8c4aed820d7d223e11bf387352b3b77e9e.exe Token: 35 1224 a388d70926f91a010bdbaac36a277e8c4aed820d7d223e11bf387352b3b77e9e.exe Token: SeIncreaseQuotaPrivilege 580 msdcsc.exe Token: SeSecurityPrivilege 580 msdcsc.exe Token: SeTakeOwnershipPrivilege 580 msdcsc.exe Token: SeLoadDriverPrivilege 580 msdcsc.exe Token: SeSystemProfilePrivilege 580 msdcsc.exe Token: SeSystemtimePrivilege 580 msdcsc.exe Token: SeProfSingleProcessPrivilege 580 msdcsc.exe Token: SeIncBasePriorityPrivilege 580 msdcsc.exe Token: SeCreatePagefilePrivilege 580 msdcsc.exe Token: SeBackupPrivilege 580 msdcsc.exe Token: SeRestorePrivilege 580 msdcsc.exe Token: SeShutdownPrivilege 580 msdcsc.exe Token: SeDebugPrivilege 580 msdcsc.exe Token: SeSystemEnvironmentPrivilege 580 msdcsc.exe Token: SeChangeNotifyPrivilege 580 msdcsc.exe Token: SeRemoteShutdownPrivilege 580 msdcsc.exe Token: SeUndockPrivilege 580 msdcsc.exe Token: SeManageVolumePrivilege 580 msdcsc.exe Token: SeImpersonatePrivilege 580 msdcsc.exe Token: SeCreateGlobalPrivilege 580 msdcsc.exe Token: 33 580 msdcsc.exe Token: 34 580 msdcsc.exe Token: 35 580 msdcsc.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
msdcsc.exepid process 580 msdcsc.exe -
Suspicious use of WriteProcessMemory 61 IoCs
Processes:
a388d70926f91a010bdbaac36a277e8c4aed820d7d223e11bf387352b3b77e9e.execmd.execmd.exemsdcsc.exedescription pid process target process PID 1224 wrote to memory of 2024 1224 a388d70926f91a010bdbaac36a277e8c4aed820d7d223e11bf387352b3b77e9e.exe cmd.exe PID 1224 wrote to memory of 2024 1224 a388d70926f91a010bdbaac36a277e8c4aed820d7d223e11bf387352b3b77e9e.exe cmd.exe PID 1224 wrote to memory of 2024 1224 a388d70926f91a010bdbaac36a277e8c4aed820d7d223e11bf387352b3b77e9e.exe cmd.exe PID 1224 wrote to memory of 2024 1224 a388d70926f91a010bdbaac36a277e8c4aed820d7d223e11bf387352b3b77e9e.exe cmd.exe PID 1224 wrote to memory of 1712 1224 a388d70926f91a010bdbaac36a277e8c4aed820d7d223e11bf387352b3b77e9e.exe cmd.exe PID 1224 wrote to memory of 1712 1224 a388d70926f91a010bdbaac36a277e8c4aed820d7d223e11bf387352b3b77e9e.exe cmd.exe PID 1224 wrote to memory of 1712 1224 a388d70926f91a010bdbaac36a277e8c4aed820d7d223e11bf387352b3b77e9e.exe cmd.exe PID 1224 wrote to memory of 1712 1224 a388d70926f91a010bdbaac36a277e8c4aed820d7d223e11bf387352b3b77e9e.exe cmd.exe PID 1224 wrote to memory of 572 1224 a388d70926f91a010bdbaac36a277e8c4aed820d7d223e11bf387352b3b77e9e.exe notepad.exe PID 1224 wrote to memory of 572 1224 a388d70926f91a010bdbaac36a277e8c4aed820d7d223e11bf387352b3b77e9e.exe notepad.exe PID 1224 wrote to memory of 572 1224 a388d70926f91a010bdbaac36a277e8c4aed820d7d223e11bf387352b3b77e9e.exe notepad.exe PID 1224 wrote to memory of 572 1224 a388d70926f91a010bdbaac36a277e8c4aed820d7d223e11bf387352b3b77e9e.exe notepad.exe PID 1224 wrote to memory of 572 1224 a388d70926f91a010bdbaac36a277e8c4aed820d7d223e11bf387352b3b77e9e.exe notepad.exe PID 1224 wrote to memory of 572 1224 a388d70926f91a010bdbaac36a277e8c4aed820d7d223e11bf387352b3b77e9e.exe notepad.exe PID 1224 wrote to memory of 572 1224 a388d70926f91a010bdbaac36a277e8c4aed820d7d223e11bf387352b3b77e9e.exe notepad.exe PID 1224 wrote to memory of 572 1224 a388d70926f91a010bdbaac36a277e8c4aed820d7d223e11bf387352b3b77e9e.exe notepad.exe PID 1224 wrote to memory of 572 1224 a388d70926f91a010bdbaac36a277e8c4aed820d7d223e11bf387352b3b77e9e.exe notepad.exe PID 1224 wrote to memory of 572 1224 a388d70926f91a010bdbaac36a277e8c4aed820d7d223e11bf387352b3b77e9e.exe notepad.exe PID 1224 wrote to memory of 572 1224 a388d70926f91a010bdbaac36a277e8c4aed820d7d223e11bf387352b3b77e9e.exe notepad.exe PID 1224 wrote to memory of 572 1224 a388d70926f91a010bdbaac36a277e8c4aed820d7d223e11bf387352b3b77e9e.exe notepad.exe PID 1224 wrote to memory of 572 1224 a388d70926f91a010bdbaac36a277e8c4aed820d7d223e11bf387352b3b77e9e.exe notepad.exe PID 1224 wrote to memory of 572 1224 a388d70926f91a010bdbaac36a277e8c4aed820d7d223e11bf387352b3b77e9e.exe notepad.exe PID 1224 wrote to memory of 572 1224 a388d70926f91a010bdbaac36a277e8c4aed820d7d223e11bf387352b3b77e9e.exe notepad.exe PID 1224 wrote to memory of 572 1224 a388d70926f91a010bdbaac36a277e8c4aed820d7d223e11bf387352b3b77e9e.exe notepad.exe PID 1224 wrote to memory of 572 1224 a388d70926f91a010bdbaac36a277e8c4aed820d7d223e11bf387352b3b77e9e.exe notepad.exe PID 1224 wrote to memory of 572 1224 a388d70926f91a010bdbaac36a277e8c4aed820d7d223e11bf387352b3b77e9e.exe notepad.exe PID 1712 wrote to memory of 1912 1712 cmd.exe attrib.exe PID 1712 wrote to memory of 1912 1712 cmd.exe attrib.exe PID 1712 wrote to memory of 1912 1712 cmd.exe attrib.exe PID 1712 wrote to memory of 1912 1712 cmd.exe attrib.exe PID 2024 wrote to memory of 576 2024 cmd.exe attrib.exe PID 2024 wrote to memory of 576 2024 cmd.exe attrib.exe PID 2024 wrote to memory of 576 2024 cmd.exe attrib.exe PID 2024 wrote to memory of 576 2024 cmd.exe attrib.exe PID 1224 wrote to memory of 580 1224 a388d70926f91a010bdbaac36a277e8c4aed820d7d223e11bf387352b3b77e9e.exe msdcsc.exe PID 1224 wrote to memory of 580 1224 a388d70926f91a010bdbaac36a277e8c4aed820d7d223e11bf387352b3b77e9e.exe msdcsc.exe PID 1224 wrote to memory of 580 1224 a388d70926f91a010bdbaac36a277e8c4aed820d7d223e11bf387352b3b77e9e.exe msdcsc.exe PID 1224 wrote to memory of 580 1224 a388d70926f91a010bdbaac36a277e8c4aed820d7d223e11bf387352b3b77e9e.exe msdcsc.exe PID 580 wrote to memory of 1856 580 msdcsc.exe notepad.exe PID 580 wrote to memory of 1856 580 msdcsc.exe notepad.exe PID 580 wrote to memory of 1856 580 msdcsc.exe notepad.exe PID 580 wrote to memory of 1856 580 msdcsc.exe notepad.exe PID 580 wrote to memory of 1856 580 msdcsc.exe notepad.exe PID 580 wrote to memory of 1856 580 msdcsc.exe notepad.exe PID 580 wrote to memory of 1856 580 msdcsc.exe notepad.exe PID 580 wrote to memory of 1856 580 msdcsc.exe notepad.exe PID 580 wrote to memory of 1856 580 msdcsc.exe notepad.exe PID 580 wrote to memory of 1856 580 msdcsc.exe notepad.exe PID 580 wrote to memory of 1856 580 msdcsc.exe notepad.exe PID 580 wrote to memory of 1856 580 msdcsc.exe notepad.exe PID 580 wrote to memory of 1856 580 msdcsc.exe notepad.exe PID 580 wrote to memory of 1856 580 msdcsc.exe notepad.exe PID 580 wrote to memory of 1856 580 msdcsc.exe notepad.exe PID 580 wrote to memory of 1856 580 msdcsc.exe notepad.exe PID 580 wrote to memory of 1856 580 msdcsc.exe notepad.exe PID 580 wrote to memory of 1856 580 msdcsc.exe notepad.exe PID 580 wrote to memory of 1856 580 msdcsc.exe notepad.exe PID 580 wrote to memory of 1856 580 msdcsc.exe notepad.exe PID 580 wrote to memory of 1856 580 msdcsc.exe notepad.exe PID 580 wrote to memory of 1856 580 msdcsc.exe notepad.exe PID 580 wrote to memory of 1856 580 msdcsc.exe notepad.exe -
Views/modifies file attributes 1 TTPs 2 IoCs
Processes:
attrib.exeattrib.exepid process 1912 attrib.exe 576 attrib.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\a388d70926f91a010bdbaac36a277e8c4aed820d7d223e11bf387352b3b77e9e.exe"C:\Users\Admin\AppData\Local\Temp\a388d70926f91a010bdbaac36a277e8c4aed820d7d223e11bf387352b3b77e9e.exe"1⤵
- Modifies WinLogon for persistence
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp\a388d70926f91a010bdbaac36a277e8c4aed820d7d223e11bf387352b3b77e9e.exe" +s +h2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Users\Admin\AppData\Local\Temp\a388d70926f91a010bdbaac36a277e8c4aed820d7d223e11bf387352b3b77e9e.exe" +s +h3⤵
- Sets file to hidden
- Views/modifies file attributes
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp" +s +h2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Users\Admin\AppData\Local\Temp" +s +h3⤵
- Sets file to hidden
- Views/modifies file attributes
-
C:\Windows\SysWOW64\notepad.exenotepad2⤵
- Deletes itself
-
C:\Windows\SysWOW64\MSDCSC\msdcsc.exe"C:\Windows\system32\MSDCSC\msdcsc.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\notepad.exenotepad3⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Windows\SysWOW64\MSDCSC\msdcsc.exeFilesize
690KB
MD5527532ba8c387b294cd05e3e4a579dc6
SHA1e829080f98b7f7b94c25d7f08b6e56ca349904c5
SHA256a388d70926f91a010bdbaac36a277e8c4aed820d7d223e11bf387352b3b77e9e
SHA51244565f37619ff4b642204e31ac11fda8587e7bff6b21e14ded0068aee53febfef824ffe6ba64dbd828502d799f665f1ac53181aacc415a4e3b3546c7f30b0b6b
-
C:\Windows\SysWOW64\MSDCSC\msdcsc.exeFilesize
690KB
MD5527532ba8c387b294cd05e3e4a579dc6
SHA1e829080f98b7f7b94c25d7f08b6e56ca349904c5
SHA256a388d70926f91a010bdbaac36a277e8c4aed820d7d223e11bf387352b3b77e9e
SHA51244565f37619ff4b642204e31ac11fda8587e7bff6b21e14ded0068aee53febfef824ffe6ba64dbd828502d799f665f1ac53181aacc415a4e3b3546c7f30b0b6b
-
\Windows\SysWOW64\MSDCSC\msdcsc.exeFilesize
690KB
MD5527532ba8c387b294cd05e3e4a579dc6
SHA1e829080f98b7f7b94c25d7f08b6e56ca349904c5
SHA256a388d70926f91a010bdbaac36a277e8c4aed820d7d223e11bf387352b3b77e9e
SHA51244565f37619ff4b642204e31ac11fda8587e7bff6b21e14ded0068aee53febfef824ffe6ba64dbd828502d799f665f1ac53181aacc415a4e3b3546c7f30b0b6b
-
\Windows\SysWOW64\MSDCSC\msdcsc.exeFilesize
690KB
MD5527532ba8c387b294cd05e3e4a579dc6
SHA1e829080f98b7f7b94c25d7f08b6e56ca349904c5
SHA256a388d70926f91a010bdbaac36a277e8c4aed820d7d223e11bf387352b3b77e9e
SHA51244565f37619ff4b642204e31ac11fda8587e7bff6b21e14ded0068aee53febfef824ffe6ba64dbd828502d799f665f1ac53181aacc415a4e3b3546c7f30b0b6b
-
memory/572-57-0x0000000000000000-mapping.dmp
-
memory/576-60-0x0000000000000000-mapping.dmp
-
memory/580-63-0x0000000000000000-mapping.dmp
-
memory/1224-54-0x0000000075C41000-0x0000000075C43000-memory.dmpFilesize
8KB
-
memory/1712-56-0x0000000000000000-mapping.dmp
-
memory/1856-67-0x0000000000000000-mapping.dmp
-
memory/1912-59-0x0000000000000000-mapping.dmp
-
memory/2024-55-0x0000000000000000-mapping.dmp