Analysis
- max time kernel
152s - max time network
153s - platform
windows10-2004_x64 - resource
win10v2004-20220812-en - resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system - submitted
19/11/2022, 16:58
Behavioral task
behavioral1
Sample
e3fd16b88edd86a983c48cc883a5c547cf45120a93f1b2daa9e136bec579f43e.exe
Resource
win7-20221111-en
windows7-x64
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
e3fd16b88edd86a983c48cc883a5c547cf45120a93f1b2daa9e136bec579f43e.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
9 signatures
150 seconds
General
- Target e3fd16b88edd86a983c48cc883a5c547cf45120a93f1b2daa9e136bec579f43e.exe
- Size 756KB
- Sample221119-vgv6jsfb7v
- SHA256 e3fd16b88edd86a983c48cc883a5c547cf45120a93f1b2daa9e136bec579f43e
- MD5 4e506f075a695b552f62ba2355a67821
- SHA1 3bb446876e327963e3103d1efc6937f0712759ad
- SHA512 a1730a6ad825c0d275a767c4c2fd898303ad69ee31bc8d08d9608da6742449f9e5ccff75e967d9821f5bb9386c3bff937162160f12be03f9e067612bad608808
- SSDEEP 12288:z9HFJ9rJxRX1uVVjoaWSoynxdO1FVBaOiRZTERfIhNkNCCLo9Ek5C/hpO4VZ:9Z1xuVVjfFoynPaVBUR8f+kN10EBHZ
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Extracted
Family
-
darkcomet
Botnet
-
Guest16
C2
-
dc321.no-ip.biz:1604
Mutex
-
DC_MUTEX-CZ332FM
Attributes
-
InstallPath
MSDCSC\msdcsc.exe
-
gencode
7HbXBk2TuUsD
-
install
true
-
offline_keylogger
true
-
persistence
false
-
reg_key
MicroUpdate
Signatures
- Modifies WinLogon for persistence 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Users\\Admin\\Documents\\MSDCSC\\msdcsc.exe" e3fd16b88edd86a983c48cc883a5c547cf45120a93f1b2daa9e136bec579f43e.exe - Executes dropped EXE 1 IoCs
pid Process 4648 msdcsc.exe - Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation e3fd16b88edd86a983c48cc883a5c547cf45120a93f1b2daa9e136bec579f43e.exe - Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Users\\Admin\\Documents\\MSDCSC\\msdcsc.exe" e3fd16b88edd86a983c48cc883a5c547cf45120a93f1b2daa9e136bec579f43e.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Suspicious use of AdjustPrivilegeToken 48 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 3052 e3fd16b88edd86a983c48cc883a5c547cf45120a93f1b2daa9e136bec579f43e.exe Token: SeSecurityPrivilege 3052 e3fd16b88edd86a983c48cc883a5c547cf45120a93f1b2daa9e136bec579f43e.exe Token: SeTakeOwnershipPrivilege 3052 e3fd16b88edd86a983c48cc883a5c547cf45120a93f1b2daa9e136bec579f43e.exe Token: SeLoadDriverPrivilege 3052 e3fd16b88edd86a983c48cc883a5c547cf45120a93f1b2daa9e136bec579f43e.exe Token: SeSystemProfilePrivilege 3052 e3fd16b88edd86a983c48cc883a5c547cf45120a93f1b2daa9e136bec579f43e.exe Token: SeSystemtimePrivilege 3052 e3fd16b88edd86a983c48cc883a5c547cf45120a93f1b2daa9e136bec579f43e.exe Token: SeProfSingleProcessPrivilege 3052 e3fd16b88edd86a983c48cc883a5c547cf45120a93f1b2daa9e136bec579f43e.exe Token: SeIncBasePriorityPrivilege 3052 e3fd16b88edd86a983c48cc883a5c547cf45120a93f1b2daa9e136bec579f43e.exe Token: SeCreatePagefilePrivilege 3052 e3fd16b88edd86a983c48cc883a5c547cf45120a93f1b2daa9e136bec579f43e.exe Token: SeBackupPrivilege 3052 e3fd16b88edd86a983c48cc883a5c547cf45120a93f1b2daa9e136bec579f43e.exe Token: SeRestorePrivilege 3052 e3fd16b88edd86a983c48cc883a5c547cf45120a93f1b2daa9e136bec579f43e.exe Token: SeShutdownPrivilege 3052 e3fd16b88edd86a983c48cc883a5c547cf45120a93f1b2daa9e136bec579f43e.exe Token: SeDebugPrivilege 3052 e3fd16b88edd86a983c48cc883a5c547cf45120a93f1b2daa9e136bec579f43e.exe Token: SeSystemEnvironmentPrivilege 3052 e3fd16b88edd86a983c48cc883a5c547cf45120a93f1b2daa9e136bec579f43e.exe Token: SeChangeNotifyPrivilege 3052 e3fd16b88edd86a983c48cc883a5c547cf45120a93f1b2daa9e136bec579f43e.exe Token: SeRemoteShutdownPrivilege 3052 e3fd16b88edd86a983c48cc883a5c547cf45120a93f1b2daa9e136bec579f43e.exe Token: SeUndockPrivilege 3052 e3fd16b88edd86a983c48cc883a5c547cf45120a93f1b2daa9e136bec579f43e.exe Token: SeManageVolumePrivilege 3052 e3fd16b88edd86a983c48cc883a5c547cf45120a93f1b2daa9e136bec579f43e.exe Token: SeImpersonatePrivilege 3052 e3fd16b88edd86a983c48cc883a5c547cf45120a93f1b2daa9e136bec579f43e.exe Token: SeCreateGlobalPrivilege 3052 e3fd16b88edd86a983c48cc883a5c547cf45120a93f1b2daa9e136bec579f43e.exe Token: 33 3052 e3fd16b88edd86a983c48cc883a5c547cf45120a93f1b2daa9e136bec579f43e.exe Token: 34 3052 e3fd16b88edd86a983c48cc883a5c547cf45120a93f1b2daa9e136bec579f43e.exe Token: 35 3052 e3fd16b88edd86a983c48cc883a5c547cf45120a93f1b2daa9e136bec579f43e.exe Token: 36 3052 e3fd16b88edd86a983c48cc883a5c547cf45120a93f1b2daa9e136bec579f43e.exe Token: SeIncreaseQuotaPrivilege 4648 msdcsc.exe Token: SeSecurityPrivilege 4648 msdcsc.exe Token: SeTakeOwnershipPrivilege 4648 msdcsc.exe Token: SeLoadDriverPrivilege 4648 msdcsc.exe Token: SeSystemProfilePrivilege 4648 msdcsc.exe Token: SeSystemtimePrivilege 4648 msdcsc.exe Token: SeProfSingleProcessPrivilege 4648 msdcsc.exe Token: SeIncBasePriorityPrivilege 4648 msdcsc.exe Token: SeCreatePagefilePrivilege 4648 msdcsc.exe Token: SeBackupPrivilege 4648 msdcsc.exe Token: SeRestorePrivilege 4648 msdcsc.exe Token: SeShutdownPrivilege 4648 msdcsc.exe Token: SeDebugPrivilege 4648 msdcsc.exe Token: SeSystemEnvironmentPrivilege 4648 msdcsc.exe Token: SeChangeNotifyPrivilege 4648 msdcsc.exe Token: SeRemoteShutdownPrivilege 4648 msdcsc.exe Token: SeUndockPrivilege 4648 msdcsc.exe Token: SeManageVolumePrivilege 4648 msdcsc.exe Token: SeImpersonatePrivilege 4648 msdcsc.exe Token: SeCreateGlobalPrivilege 4648 msdcsc.exe Token: 33 4648 msdcsc.exe Token: 34 4648 msdcsc.exe Token: 35 4648 msdcsc.exe Token: 36 4648 msdcsc.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 4648 msdcsc.exe - Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 3052 wrote to memory of 4648 3052 e3fd16b88edd86a983c48cc883a5c547cf45120a93f1b2daa9e136bec579f43e.exe 78 PID 3052 wrote to memory of 4648 3052 e3fd16b88edd86a983c48cc883a5c547cf45120a93f1b2daa9e136bec579f43e.exe 78 PID 3052 wrote to memory of 4648 3052 e3fd16b88edd86a983c48cc883a5c547cf45120a93f1b2daa9e136bec579f43e.exe 78 PID 4648 wrote to memory of 4992 4648 msdcsc.exe 79 PID 4648 wrote to memory of 4992 4648 msdcsc.exe 79 PID 4648 wrote to memory of 4992 4648 msdcsc.exe 79 PID 4648 wrote to memory of 4624 4648 msdcsc.exe 80 PID 4648 wrote to memory of 4624 4648 msdcsc.exe 80
Processes
-
C:\Users\Admin\AppData\Local\Temp\e3fd16b88edd86a983c48cc883a5c547cf45120a93f1b2daa9e136bec579f43e.exe"C:\Users\Admin\AppData\Local\Temp\e3fd16b88edd86a983c48cc883a5c547cf45120a93f1b2daa9e136bec579f43e.exe"1⤵
- Modifies WinLogon for persistence
- Checks computer location settings
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3052 -
C:\Users\Admin\Documents\MSDCSC\msdcsc.exe"C:\Users\Admin\Documents\MSDCSC\msdcsc.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4648 -
C:\Program Files (x86)\Internet Explorer\iexplore.exe"C:\Program Files (x86)\Internet Explorer\iexplore.exe"3⤵PID:4992
-
-
C:\Windows\explorer.exe"C:\Windows\explorer.exe"3⤵PID:4624
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\Documents\MSDCSC\msdcsc.exe
- Size 756KB
- SHA256 e3fd16b88edd86a983c48cc883a5c547cf45120a93f1b2daa9e136bec579f43e
- MD5 4e506f075a695b552f62ba2355a67821
- SHA1 3bb446876e327963e3103d1efc6937f0712759ad
- SHA512 a1730a6ad825c0d275a767c4c2fd898303ad69ee31bc8d08d9608da6742449f9e5ccff75e967d9821f5bb9386c3bff937162160f12be03f9e067612bad608808
- SSDEEP 12288:z9HFJ9rJxRX1uVVjoaWSoynxdO1FVBaOiRZTERfIhNkNCCLo9Ek5C/hpO4VZ:9Z1xuVVjfFoynPaVBUR8f+kN10EBHZ
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\Documents\MSDCSC\msdcsc.exe
- Size 756KB
- SHA256 e3fd16b88edd86a983c48cc883a5c547cf45120a93f1b2daa9e136bec579f43e
- MD5 4e506f075a695b552f62ba2355a67821
- SHA1 3bb446876e327963e3103d1efc6937f0712759ad
- SHA512 a1730a6ad825c0d275a767c4c2fd898303ad69ee31bc8d08d9608da6742449f9e5ccff75e967d9821f5bb9386c3bff937162160f12be03f9e067612bad608808
- SSDEEP 12288:z9HFJ9rJxRX1uVVjoaWSoynxdO1FVBaOiRZTERfIhNkNCCLo9Ek5C/hpO4VZ:9Z1xuVVjfFoynPaVBUR8f+kN10EBHZ
- MD5 SHA1 SHA512 SSDEEP