Analysis
-
max time kernel
167s -
max time network
169s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
19-11-2022 09:27
Behavioral task
behavioral1
Sample
a388d70926f91a010bdbaac36a277e8c4aed820d7d223e11bf387352b3b77e9e.exe
Resource
win7-20221111-en
General
-
Target
a388d70926f91a010bdbaac36a277e8c4aed820d7d223e11bf387352b3b77e9e.exe
-
Size
690KB
-
MD5
527532ba8c387b294cd05e3e4a579dc6
-
SHA1
e829080f98b7f7b94c25d7f08b6e56ca349904c5
-
SHA256
a388d70926f91a010bdbaac36a277e8c4aed820d7d223e11bf387352b3b77e9e
-
SHA512
44565f37619ff4b642204e31ac11fda8587e7bff6b21e14ded0068aee53febfef824ffe6ba64dbd828502d799f665f1ac53181aacc415a4e3b3546c7f30b0b6b
-
SSDEEP
12288:Z9HFJ9rJxRX1uVVjoaWSoynxdO1FVBaOiRZTERfIhNkNCCLo9Ek5C/hJy:jZ1xuVVjfFoynPaVBUR8f+kN10EB+
Malware Config
Extracted
darkcomet
Bot
dms17.no-ip.org:1604
127.0.0.1:1604
DC_MUTEX-DGLFPKJ
-
InstallPath
MSDCSC\msdcsc.exe
-
gencode
UPrqceYJUHhe
-
install
true
-
offline_keylogger
true
-
persistence
true
-
reg_key
MicroUpdate
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
Processes:
a388d70926f91a010bdbaac36a277e8c4aed820d7d223e11bf387352b3b77e9e.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe" a388d70926f91a010bdbaac36a277e8c4aed820d7d223e11bf387352b3b77e9e.exe -
Executes dropped EXE 1 IoCs
Processes:
msdcsc.exepid process 3780 msdcsc.exe -
Sets file to hidden 1 TTPs 2 IoCs
Modifies file attributes to stop it showing in Explorer etc.
Processes:
attrib.exeattrib.exepid process 3024 attrib.exe 3476 attrib.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
a388d70926f91a010bdbaac36a277e8c4aed820d7d223e11bf387352b3b77e9e.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Control Panel\International\Geo\Nation a388d70926f91a010bdbaac36a277e8c4aed820d7d223e11bf387352b3b77e9e.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
a388d70926f91a010bdbaac36a277e8c4aed820d7d223e11bf387352b3b77e9e.exemsdcsc.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Windows\\system32\\MSDCSC\\msdcsc.exe" a388d70926f91a010bdbaac36a277e8c4aed820d7d223e11bf387352b3b77e9e.exe Set value (str) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Windows\\system32\\MSDCSC\\msdcsc.exe" msdcsc.exe -
Drops file in System32 directory 3 IoCs
Processes:
a388d70926f91a010bdbaac36a277e8c4aed820d7d223e11bf387352b3b77e9e.exedescription ioc process File created C:\Windows\SysWOW64\MSDCSC\msdcsc.exe a388d70926f91a010bdbaac36a277e8c4aed820d7d223e11bf387352b3b77e9e.exe File opened for modification C:\Windows\SysWOW64\MSDCSC\msdcsc.exe a388d70926f91a010bdbaac36a277e8c4aed820d7d223e11bf387352b3b77e9e.exe File opened for modification C:\Windows\SysWOW64\MSDCSC\ a388d70926f91a010bdbaac36a277e8c4aed820d7d223e11bf387352b3b77e9e.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Modifies registry class 1 IoCs
Processes:
a388d70926f91a010bdbaac36a277e8c4aed820d7d223e11bf387352b3b77e9e.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ a388d70926f91a010bdbaac36a277e8c4aed820d7d223e11bf387352b3b77e9e.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
msdcsc.exepid process 3780 msdcsc.exe -
Suspicious use of AdjustPrivilegeToken 48 IoCs
Processes:
a388d70926f91a010bdbaac36a277e8c4aed820d7d223e11bf387352b3b77e9e.exemsdcsc.exedescription pid process Token: SeIncreaseQuotaPrivilege 4868 a388d70926f91a010bdbaac36a277e8c4aed820d7d223e11bf387352b3b77e9e.exe Token: SeSecurityPrivilege 4868 a388d70926f91a010bdbaac36a277e8c4aed820d7d223e11bf387352b3b77e9e.exe Token: SeTakeOwnershipPrivilege 4868 a388d70926f91a010bdbaac36a277e8c4aed820d7d223e11bf387352b3b77e9e.exe Token: SeLoadDriverPrivilege 4868 a388d70926f91a010bdbaac36a277e8c4aed820d7d223e11bf387352b3b77e9e.exe Token: SeSystemProfilePrivilege 4868 a388d70926f91a010bdbaac36a277e8c4aed820d7d223e11bf387352b3b77e9e.exe Token: SeSystemtimePrivilege 4868 a388d70926f91a010bdbaac36a277e8c4aed820d7d223e11bf387352b3b77e9e.exe Token: SeProfSingleProcessPrivilege 4868 a388d70926f91a010bdbaac36a277e8c4aed820d7d223e11bf387352b3b77e9e.exe Token: SeIncBasePriorityPrivilege 4868 a388d70926f91a010bdbaac36a277e8c4aed820d7d223e11bf387352b3b77e9e.exe Token: SeCreatePagefilePrivilege 4868 a388d70926f91a010bdbaac36a277e8c4aed820d7d223e11bf387352b3b77e9e.exe Token: SeBackupPrivilege 4868 a388d70926f91a010bdbaac36a277e8c4aed820d7d223e11bf387352b3b77e9e.exe Token: SeRestorePrivilege 4868 a388d70926f91a010bdbaac36a277e8c4aed820d7d223e11bf387352b3b77e9e.exe Token: SeShutdownPrivilege 4868 a388d70926f91a010bdbaac36a277e8c4aed820d7d223e11bf387352b3b77e9e.exe Token: SeDebugPrivilege 4868 a388d70926f91a010bdbaac36a277e8c4aed820d7d223e11bf387352b3b77e9e.exe Token: SeSystemEnvironmentPrivilege 4868 a388d70926f91a010bdbaac36a277e8c4aed820d7d223e11bf387352b3b77e9e.exe Token: SeChangeNotifyPrivilege 4868 a388d70926f91a010bdbaac36a277e8c4aed820d7d223e11bf387352b3b77e9e.exe Token: SeRemoteShutdownPrivilege 4868 a388d70926f91a010bdbaac36a277e8c4aed820d7d223e11bf387352b3b77e9e.exe Token: SeUndockPrivilege 4868 a388d70926f91a010bdbaac36a277e8c4aed820d7d223e11bf387352b3b77e9e.exe Token: SeManageVolumePrivilege 4868 a388d70926f91a010bdbaac36a277e8c4aed820d7d223e11bf387352b3b77e9e.exe Token: SeImpersonatePrivilege 4868 a388d70926f91a010bdbaac36a277e8c4aed820d7d223e11bf387352b3b77e9e.exe Token: SeCreateGlobalPrivilege 4868 a388d70926f91a010bdbaac36a277e8c4aed820d7d223e11bf387352b3b77e9e.exe Token: 33 4868 a388d70926f91a010bdbaac36a277e8c4aed820d7d223e11bf387352b3b77e9e.exe Token: 34 4868 a388d70926f91a010bdbaac36a277e8c4aed820d7d223e11bf387352b3b77e9e.exe Token: 35 4868 a388d70926f91a010bdbaac36a277e8c4aed820d7d223e11bf387352b3b77e9e.exe Token: 36 4868 a388d70926f91a010bdbaac36a277e8c4aed820d7d223e11bf387352b3b77e9e.exe Token: SeIncreaseQuotaPrivilege 3780 msdcsc.exe Token: SeSecurityPrivilege 3780 msdcsc.exe Token: SeTakeOwnershipPrivilege 3780 msdcsc.exe Token: SeLoadDriverPrivilege 3780 msdcsc.exe Token: SeSystemProfilePrivilege 3780 msdcsc.exe Token: SeSystemtimePrivilege 3780 msdcsc.exe Token: SeProfSingleProcessPrivilege 3780 msdcsc.exe Token: SeIncBasePriorityPrivilege 3780 msdcsc.exe Token: SeCreatePagefilePrivilege 3780 msdcsc.exe Token: SeBackupPrivilege 3780 msdcsc.exe Token: SeRestorePrivilege 3780 msdcsc.exe Token: SeShutdownPrivilege 3780 msdcsc.exe Token: SeDebugPrivilege 3780 msdcsc.exe Token: SeSystemEnvironmentPrivilege 3780 msdcsc.exe Token: SeChangeNotifyPrivilege 3780 msdcsc.exe Token: SeRemoteShutdownPrivilege 3780 msdcsc.exe Token: SeUndockPrivilege 3780 msdcsc.exe Token: SeManageVolumePrivilege 3780 msdcsc.exe Token: SeImpersonatePrivilege 3780 msdcsc.exe Token: SeCreateGlobalPrivilege 3780 msdcsc.exe Token: 33 3780 msdcsc.exe Token: 34 3780 msdcsc.exe Token: 35 3780 msdcsc.exe Token: 36 3780 msdcsc.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
msdcsc.exepid process 3780 msdcsc.exe -
Suspicious use of WriteProcessMemory 54 IoCs
Processes:
a388d70926f91a010bdbaac36a277e8c4aed820d7d223e11bf387352b3b77e9e.execmd.execmd.exemsdcsc.exedescription pid process target process PID 4868 wrote to memory of 2356 4868 a388d70926f91a010bdbaac36a277e8c4aed820d7d223e11bf387352b3b77e9e.exe cmd.exe PID 4868 wrote to memory of 2356 4868 a388d70926f91a010bdbaac36a277e8c4aed820d7d223e11bf387352b3b77e9e.exe cmd.exe PID 4868 wrote to memory of 2356 4868 a388d70926f91a010bdbaac36a277e8c4aed820d7d223e11bf387352b3b77e9e.exe cmd.exe PID 4868 wrote to memory of 4076 4868 a388d70926f91a010bdbaac36a277e8c4aed820d7d223e11bf387352b3b77e9e.exe cmd.exe PID 4868 wrote to memory of 4076 4868 a388d70926f91a010bdbaac36a277e8c4aed820d7d223e11bf387352b3b77e9e.exe cmd.exe PID 4868 wrote to memory of 4076 4868 a388d70926f91a010bdbaac36a277e8c4aed820d7d223e11bf387352b3b77e9e.exe cmd.exe PID 4868 wrote to memory of 1756 4868 a388d70926f91a010bdbaac36a277e8c4aed820d7d223e11bf387352b3b77e9e.exe notepad.exe PID 4868 wrote to memory of 1756 4868 a388d70926f91a010bdbaac36a277e8c4aed820d7d223e11bf387352b3b77e9e.exe notepad.exe PID 4868 wrote to memory of 1756 4868 a388d70926f91a010bdbaac36a277e8c4aed820d7d223e11bf387352b3b77e9e.exe notepad.exe PID 4868 wrote to memory of 1756 4868 a388d70926f91a010bdbaac36a277e8c4aed820d7d223e11bf387352b3b77e9e.exe notepad.exe PID 4868 wrote to memory of 1756 4868 a388d70926f91a010bdbaac36a277e8c4aed820d7d223e11bf387352b3b77e9e.exe notepad.exe PID 4868 wrote to memory of 1756 4868 a388d70926f91a010bdbaac36a277e8c4aed820d7d223e11bf387352b3b77e9e.exe notepad.exe PID 4868 wrote to memory of 1756 4868 a388d70926f91a010bdbaac36a277e8c4aed820d7d223e11bf387352b3b77e9e.exe notepad.exe PID 4868 wrote to memory of 1756 4868 a388d70926f91a010bdbaac36a277e8c4aed820d7d223e11bf387352b3b77e9e.exe notepad.exe PID 4868 wrote to memory of 1756 4868 a388d70926f91a010bdbaac36a277e8c4aed820d7d223e11bf387352b3b77e9e.exe notepad.exe PID 4868 wrote to memory of 1756 4868 a388d70926f91a010bdbaac36a277e8c4aed820d7d223e11bf387352b3b77e9e.exe notepad.exe PID 4868 wrote to memory of 1756 4868 a388d70926f91a010bdbaac36a277e8c4aed820d7d223e11bf387352b3b77e9e.exe notepad.exe PID 4868 wrote to memory of 1756 4868 a388d70926f91a010bdbaac36a277e8c4aed820d7d223e11bf387352b3b77e9e.exe notepad.exe PID 4868 wrote to memory of 1756 4868 a388d70926f91a010bdbaac36a277e8c4aed820d7d223e11bf387352b3b77e9e.exe notepad.exe PID 4868 wrote to memory of 1756 4868 a388d70926f91a010bdbaac36a277e8c4aed820d7d223e11bf387352b3b77e9e.exe notepad.exe PID 4868 wrote to memory of 1756 4868 a388d70926f91a010bdbaac36a277e8c4aed820d7d223e11bf387352b3b77e9e.exe notepad.exe PID 4868 wrote to memory of 1756 4868 a388d70926f91a010bdbaac36a277e8c4aed820d7d223e11bf387352b3b77e9e.exe notepad.exe PID 4868 wrote to memory of 1756 4868 a388d70926f91a010bdbaac36a277e8c4aed820d7d223e11bf387352b3b77e9e.exe notepad.exe PID 4076 wrote to memory of 3024 4076 cmd.exe attrib.exe PID 4076 wrote to memory of 3024 4076 cmd.exe attrib.exe PID 4076 wrote to memory of 3024 4076 cmd.exe attrib.exe PID 2356 wrote to memory of 3476 2356 cmd.exe attrib.exe PID 2356 wrote to memory of 3476 2356 cmd.exe attrib.exe PID 2356 wrote to memory of 3476 2356 cmd.exe attrib.exe PID 4868 wrote to memory of 3780 4868 a388d70926f91a010bdbaac36a277e8c4aed820d7d223e11bf387352b3b77e9e.exe msdcsc.exe PID 4868 wrote to memory of 3780 4868 a388d70926f91a010bdbaac36a277e8c4aed820d7d223e11bf387352b3b77e9e.exe msdcsc.exe PID 4868 wrote to memory of 3780 4868 a388d70926f91a010bdbaac36a277e8c4aed820d7d223e11bf387352b3b77e9e.exe msdcsc.exe PID 3780 wrote to memory of 1812 3780 msdcsc.exe notepad.exe PID 3780 wrote to memory of 1812 3780 msdcsc.exe notepad.exe PID 3780 wrote to memory of 1812 3780 msdcsc.exe notepad.exe PID 3780 wrote to memory of 1812 3780 msdcsc.exe notepad.exe PID 3780 wrote to memory of 1812 3780 msdcsc.exe notepad.exe PID 3780 wrote to memory of 1812 3780 msdcsc.exe notepad.exe PID 3780 wrote to memory of 1812 3780 msdcsc.exe notepad.exe PID 3780 wrote to memory of 1812 3780 msdcsc.exe notepad.exe PID 3780 wrote to memory of 1812 3780 msdcsc.exe notepad.exe PID 3780 wrote to memory of 1812 3780 msdcsc.exe notepad.exe PID 3780 wrote to memory of 1812 3780 msdcsc.exe notepad.exe PID 3780 wrote to memory of 1812 3780 msdcsc.exe notepad.exe PID 3780 wrote to memory of 1812 3780 msdcsc.exe notepad.exe PID 3780 wrote to memory of 1812 3780 msdcsc.exe notepad.exe PID 3780 wrote to memory of 1812 3780 msdcsc.exe notepad.exe PID 3780 wrote to memory of 1812 3780 msdcsc.exe notepad.exe PID 3780 wrote to memory of 1812 3780 msdcsc.exe notepad.exe PID 3780 wrote to memory of 1812 3780 msdcsc.exe notepad.exe PID 3780 wrote to memory of 1812 3780 msdcsc.exe notepad.exe PID 3780 wrote to memory of 1812 3780 msdcsc.exe notepad.exe PID 3780 wrote to memory of 1812 3780 msdcsc.exe notepad.exe PID 3780 wrote to memory of 1812 3780 msdcsc.exe notepad.exe -
Views/modifies file attributes 1 TTPs 2 IoCs
Processes:
attrib.exeattrib.exepid process 3024 attrib.exe 3476 attrib.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\a388d70926f91a010bdbaac36a277e8c4aed820d7d223e11bf387352b3b77e9e.exe"C:\Users\Admin\AppData\Local\Temp\a388d70926f91a010bdbaac36a277e8c4aed820d7d223e11bf387352b3b77e9e.exe"1⤵
- Modifies WinLogon for persistence
- Checks computer location settings
- Adds Run key to start application
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp\a388d70926f91a010bdbaac36a277e8c4aed820d7d223e11bf387352b3b77e9e.exe" +s +h2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Users\Admin\AppData\Local\Temp\a388d70926f91a010bdbaac36a277e8c4aed820d7d223e11bf387352b3b77e9e.exe" +s +h3⤵
- Sets file to hidden
- Views/modifies file attributes
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp" +s +h2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Users\Admin\AppData\Local\Temp" +s +h3⤵
- Sets file to hidden
- Views/modifies file attributes
-
C:\Windows\SysWOW64\notepad.exenotepad2⤵
-
C:\Windows\SysWOW64\MSDCSC\msdcsc.exe"C:\Windows\system32\MSDCSC\msdcsc.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\notepad.exenotepad3⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Windows\SysWOW64\MSDCSC\msdcsc.exeFilesize
690KB
MD5527532ba8c387b294cd05e3e4a579dc6
SHA1e829080f98b7f7b94c25d7f08b6e56ca349904c5
SHA256a388d70926f91a010bdbaac36a277e8c4aed820d7d223e11bf387352b3b77e9e
SHA51244565f37619ff4b642204e31ac11fda8587e7bff6b21e14ded0068aee53febfef824ffe6ba64dbd828502d799f665f1ac53181aacc415a4e3b3546c7f30b0b6b
-
C:\Windows\SysWOW64\MSDCSC\msdcsc.exeFilesize
690KB
MD5527532ba8c387b294cd05e3e4a579dc6
SHA1e829080f98b7f7b94c25d7f08b6e56ca349904c5
SHA256a388d70926f91a010bdbaac36a277e8c4aed820d7d223e11bf387352b3b77e9e
SHA51244565f37619ff4b642204e31ac11fda8587e7bff6b21e14ded0068aee53febfef824ffe6ba64dbd828502d799f665f1ac53181aacc415a4e3b3546c7f30b0b6b
-
memory/1756-134-0x0000000000000000-mapping.dmp
-
memory/1812-140-0x0000000000000000-mapping.dmp
-
memory/2356-132-0x0000000000000000-mapping.dmp
-
memory/3024-135-0x0000000000000000-mapping.dmp
-
memory/3476-136-0x0000000000000000-mapping.dmp
-
memory/3780-137-0x0000000000000000-mapping.dmp
-
memory/4076-133-0x0000000000000000-mapping.dmp