Analysis
-
max time kernel
152s -
max time network
155s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
23-11-2022 13:23
Static task
static1
Behavioral task
behavioral1
Sample
ae09e31694f993c501a0be510387740d2c0183746cd211e06df209832780f0bf.exe
Resource
win7-20220812-en
General
-
Target
ae09e31694f993c501a0be510387740d2c0183746cd211e06df209832780f0bf.exe
-
Size
656KB
-
MD5
43cf563f1ec7d4e846fb8026b25dfd22
-
SHA1
8f17ea13d266f6000700264447eebcfca706ac87
-
SHA256
ae09e31694f993c501a0be510387740d2c0183746cd211e06df209832780f0bf
-
SHA512
d526402638b4afd4510c7b18beff61b5eb16b2c69a8ec5a6b08b555b6fb52e022c8026b2db69c062f0f3ddb482b3f7ead0140350c2c795236971a2c7e0d302ca
-
SSDEEP
12288:p+zAJeM/XzsV9TBhwxPtztYHz4A7dfmHZJXPgu6Z08vm:p+8JX/Xz29TBO1BYT4A7Bmr4u6Z08m
Malware Config
Extracted
darkcomet
IFY
uche.ddns.net:1604
DC_MUTEX-UU8NM43
-
gencode
8tkYU6w6xNHG
-
install
false
-
offline_keylogger
true
-
persistence
false
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
Processes:
ae09e31694f993c501a0be510387740d2c0183746cd211e06df209832780f0bf.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "C:\\Users\\Admin\\AppData\\Local\\Temp\\file.exe" ae09e31694f993c501a0be510387740d2c0183746cd211e06df209832780f0bf.exe -
Executes dropped EXE 1 IoCs
Processes:
notepad .exepid process 1492 notepad .exe -
Processes:
resource yara_rule behavioral1/memory/1492-59-0x0000000000400000-0x00000000004B7000-memory.dmp upx behavioral1/memory/1492-61-0x0000000000400000-0x00000000004B7000-memory.dmp upx behavioral1/memory/1492-70-0x0000000000400000-0x00000000004B7000-memory.dmp upx behavioral1/memory/1492-73-0x0000000000400000-0x00000000004B7000-memory.dmp upx behavioral1/memory/1492-75-0x0000000000400000-0x00000000004B7000-memory.dmp upx behavioral1/memory/1492-76-0x0000000000400000-0x00000000004B7000-memory.dmp upx behavioral1/memory/1492-78-0x0000000000400000-0x00000000004B7000-memory.dmp upx behavioral1/memory/1492-79-0x0000000000400000-0x00000000004B7000-memory.dmp upx -
Loads dropped DLL 1 IoCs
Processes:
ae09e31694f993c501a0be510387740d2c0183746cd211e06df209832780f0bf.exepid process 1112 ae09e31694f993c501a0be510387740d2c0183746cd211e06df209832780f0bf.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
ae09e31694f993c501a0be510387740d2c0183746cd211e06df209832780f0bf.exedescription pid process target process PID 1112 set thread context of 1492 1112 ae09e31694f993c501a0be510387740d2c0183746cd211e06df209832780f0bf.exe notepad .exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 3 IoCs
Processes:
ae09e31694f993c501a0be510387740d2c0183746cd211e06df209832780f0bf.exepid process 1112 ae09e31694f993c501a0be510387740d2c0183746cd211e06df209832780f0bf.exe 1112 ae09e31694f993c501a0be510387740d2c0183746cd211e06df209832780f0bf.exe 1112 ae09e31694f993c501a0be510387740d2c0183746cd211e06df209832780f0bf.exe -
Suspicious use of AdjustPrivilegeToken 24 IoCs
Processes:
ae09e31694f993c501a0be510387740d2c0183746cd211e06df209832780f0bf.exenotepad .exedescription pid process Token: SeDebugPrivilege 1112 ae09e31694f993c501a0be510387740d2c0183746cd211e06df209832780f0bf.exe Token: SeIncreaseQuotaPrivilege 1492 notepad .exe Token: SeSecurityPrivilege 1492 notepad .exe Token: SeTakeOwnershipPrivilege 1492 notepad .exe Token: SeLoadDriverPrivilege 1492 notepad .exe Token: SeSystemProfilePrivilege 1492 notepad .exe Token: SeSystemtimePrivilege 1492 notepad .exe Token: SeProfSingleProcessPrivilege 1492 notepad .exe Token: SeIncBasePriorityPrivilege 1492 notepad .exe Token: SeCreatePagefilePrivilege 1492 notepad .exe Token: SeBackupPrivilege 1492 notepad .exe Token: SeRestorePrivilege 1492 notepad .exe Token: SeShutdownPrivilege 1492 notepad .exe Token: SeDebugPrivilege 1492 notepad .exe Token: SeSystemEnvironmentPrivilege 1492 notepad .exe Token: SeChangeNotifyPrivilege 1492 notepad .exe Token: SeRemoteShutdownPrivilege 1492 notepad .exe Token: SeUndockPrivilege 1492 notepad .exe Token: SeManageVolumePrivilege 1492 notepad .exe Token: SeImpersonatePrivilege 1492 notepad .exe Token: SeCreateGlobalPrivilege 1492 notepad .exe Token: 33 1492 notepad .exe Token: 34 1492 notepad .exe Token: 35 1492 notepad .exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
notepad .exepid process 1492 notepad .exe -
Suspicious use of WriteProcessMemory 20 IoCs
Processes:
ae09e31694f993c501a0be510387740d2c0183746cd211e06df209832780f0bf.execmd.exewscript.exedescription pid process target process PID 1112 wrote to memory of 1132 1112 ae09e31694f993c501a0be510387740d2c0183746cd211e06df209832780f0bf.exe cmd.exe PID 1112 wrote to memory of 1132 1112 ae09e31694f993c501a0be510387740d2c0183746cd211e06df209832780f0bf.exe cmd.exe PID 1112 wrote to memory of 1132 1112 ae09e31694f993c501a0be510387740d2c0183746cd211e06df209832780f0bf.exe cmd.exe PID 1112 wrote to memory of 1132 1112 ae09e31694f993c501a0be510387740d2c0183746cd211e06df209832780f0bf.exe cmd.exe PID 1112 wrote to memory of 1492 1112 ae09e31694f993c501a0be510387740d2c0183746cd211e06df209832780f0bf.exe notepad .exe PID 1112 wrote to memory of 1492 1112 ae09e31694f993c501a0be510387740d2c0183746cd211e06df209832780f0bf.exe notepad .exe PID 1112 wrote to memory of 1492 1112 ae09e31694f993c501a0be510387740d2c0183746cd211e06df209832780f0bf.exe notepad .exe PID 1112 wrote to memory of 1492 1112 ae09e31694f993c501a0be510387740d2c0183746cd211e06df209832780f0bf.exe notepad .exe PID 1112 wrote to memory of 1492 1112 ae09e31694f993c501a0be510387740d2c0183746cd211e06df209832780f0bf.exe notepad .exe PID 1112 wrote to memory of 1492 1112 ae09e31694f993c501a0be510387740d2c0183746cd211e06df209832780f0bf.exe notepad .exe PID 1112 wrote to memory of 1492 1112 ae09e31694f993c501a0be510387740d2c0183746cd211e06df209832780f0bf.exe notepad .exe PID 1112 wrote to memory of 1492 1112 ae09e31694f993c501a0be510387740d2c0183746cd211e06df209832780f0bf.exe notepad .exe PID 1132 wrote to memory of 1000 1132 cmd.exe wscript.exe PID 1132 wrote to memory of 1000 1132 cmd.exe wscript.exe PID 1132 wrote to memory of 1000 1132 cmd.exe wscript.exe PID 1132 wrote to memory of 1000 1132 cmd.exe wscript.exe PID 1000 wrote to memory of 1672 1000 wscript.exe cmd.exe PID 1000 wrote to memory of 1672 1000 wscript.exe cmd.exe PID 1000 wrote to memory of 1672 1000 wscript.exe cmd.exe PID 1000 wrote to memory of 1672 1000 wscript.exe cmd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\ae09e31694f993c501a0be510387740d2c0183746cd211e06df209832780f0bf.exe"C:\Users\Admin\AppData\Local\Temp\ae09e31694f993c501a0be510387740d2c0183746cd211e06df209832780f0bf.exe"1⤵
- Modifies WinLogon for persistence
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1112 -
C:\Windows\SysWOW64\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\\mata.bat2⤵
- Suspicious use of WriteProcessMemory
PID:1132 -
C:\Windows\SysWOW64\wscript.exewscript.exe "C:\Users\Admin\AppData\Local\Temp\invs.vbs" "C:\Users\Admin\AppData\Local\Temp\mata2.bat3⤵
- Suspicious use of WriteProcessMemory
PID:1000 -
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\mata2.bat" "4⤵PID:1672
-
C:\Users\Admin\AppData\Local\Temp\notepad .exe"C:\Users\Admin\AppData\Local\Temp\notepad .exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1492
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\file.exeFilesize
656KB
MD543cf563f1ec7d4e846fb8026b25dfd22
SHA18f17ea13d266f6000700264447eebcfca706ac87
SHA256ae09e31694f993c501a0be510387740d2c0183746cd211e06df209832780f0bf
SHA512d526402638b4afd4510c7b18beff61b5eb16b2c69a8ec5a6b08b555b6fb52e022c8026b2db69c062f0f3ddb482b3f7ead0140350c2c795236971a2c7e0d302ca
-
C:\Users\Admin\AppData\Local\Temp\invs.vbsFilesize
78B
MD5c578d9653b22800c3eb6b6a51219bbb8
SHA1a97aa251901bbe179a48dbc7a0c1872e163b1f2d
SHA25620a98a7e6e137bb1b9bd5ef6911a479cb8eac925b80d6db4e70b19f62a40cce2
SHA5123ae6dc8f02d1a78e1235a0782b632972da5a74ab32287cc41aa672d4fa4a9d34bb5fc50eba07b6915f2e61c402927cd5f6feeb7f7602afa2f64e91efb3b7fc4d
-
C:\Users\Admin\AppData\Local\Temp\mata.batFilesize
47B
MD558c538a6ae20a3c6031217903cdf8e5d
SHA1399fd50eadf4945b665877facfc4f53d16e18b1e
SHA2566bcc0e04d9bc32209d90a65c320dc6363e523dd94b38b17bcdc5b980b6405f53
SHA512c01828a5390fec3443e19d317137ae873de77c7737db7802650430e6a0a1edbd3aabe362903243b372536418fbd8482c2a6efd122d853744a41ade567956c359
-
C:\Users\Admin\AppData\Local\Temp\mata2.batFilesize
47B
MD5095b2908ae8b2e0e3704c0163f26e283
SHA13429b6c1421d448c98c1da9625badcea2484a521
SHA25622b182644ab28f5e9e17b5a03ba404d09b02da367146b80484584adc842a3ed1
SHA512e22e379b4f0d8e11fa7c29c3297a3e24a533fb08895d18e9bb27e8cab84da1dd52ff437aca90c5c32a9bdb578b3c1bfb3ff42d3bc2c5951ffeb5941c8286c731
-
C:\Users\Admin\AppData\Local\Temp\notepad .exeFilesize
31KB
MD5ed797d8dc2c92401985d162e42ffa450
SHA10f02fc517c7facc4baefde4fe9467fb6488ebabe
SHA256b746362010a101cb5931bc066f0f4d3fc740c02a68c1f37fc3c8e6c87fd7cb1e
SHA512e831a6ff987f3ef29982da16afad06938b68eddd43c234ba88d1c96a1b5547f2284baf35cbb3a5bfd75e7f0445d14daa014e0ba00b4db72c67f83f0a314c80c2
-
C:\Users\Admin\AppData\Local\Temp\notepad .exeFilesize
31KB
MD5ed797d8dc2c92401985d162e42ffa450
SHA10f02fc517c7facc4baefde4fe9467fb6488ebabe
SHA256b746362010a101cb5931bc066f0f4d3fc740c02a68c1f37fc3c8e6c87fd7cb1e
SHA512e831a6ff987f3ef29982da16afad06938b68eddd43c234ba88d1c96a1b5547f2284baf35cbb3a5bfd75e7f0445d14daa014e0ba00b4db72c67f83f0a314c80c2
-
C:\Users\Admin\AppData\Local\Temp\rundll11-.txtFilesize
656KB
MD543cf563f1ec7d4e846fb8026b25dfd22
SHA18f17ea13d266f6000700264447eebcfca706ac87
SHA256ae09e31694f993c501a0be510387740d2c0183746cd211e06df209832780f0bf
SHA512d526402638b4afd4510c7b18beff61b5eb16b2c69a8ec5a6b08b555b6fb52e022c8026b2db69c062f0f3ddb482b3f7ead0140350c2c795236971a2c7e0d302ca
-
\Users\Admin\AppData\Local\Temp\notepad .exeFilesize
31KB
MD5ed797d8dc2c92401985d162e42ffa450
SHA10f02fc517c7facc4baefde4fe9467fb6488ebabe
SHA256b746362010a101cb5931bc066f0f4d3fc740c02a68c1f37fc3c8e6c87fd7cb1e
SHA512e831a6ff987f3ef29982da16afad06938b68eddd43c234ba88d1c96a1b5547f2284baf35cbb3a5bfd75e7f0445d14daa014e0ba00b4db72c67f83f0a314c80c2
-
memory/1000-63-0x0000000000000000-mapping.dmp
-
memory/1112-81-0x00000000747F0000-0x0000000074D9B000-memory.dmpFilesize
5.7MB
-
memory/1112-66-0x00000000747F0000-0x0000000074D9B000-memory.dmpFilesize
5.7MB
-
memory/1112-55-0x00000000747F0000-0x0000000074D9B000-memory.dmpFilesize
5.7MB
-
memory/1112-54-0x0000000075351000-0x0000000075353000-memory.dmpFilesize
8KB
-
memory/1132-56-0x0000000000000000-mapping.dmp
-
memory/1492-75-0x0000000000400000-0x00000000004B7000-memory.dmpFilesize
732KB
-
memory/1492-71-0x00000000004B5650-mapping.dmp
-
memory/1492-70-0x0000000000400000-0x00000000004B7000-memory.dmpFilesize
732KB
-
memory/1492-73-0x0000000000400000-0x00000000004B7000-memory.dmpFilesize
732KB
-
memory/1492-76-0x0000000000400000-0x00000000004B7000-memory.dmpFilesize
732KB
-
memory/1492-61-0x0000000000400000-0x00000000004B7000-memory.dmpFilesize
732KB
-
memory/1492-78-0x0000000000400000-0x00000000004B7000-memory.dmpFilesize
732KB
-
memory/1492-79-0x0000000000400000-0x00000000004B7000-memory.dmpFilesize
732KB
-
memory/1492-59-0x0000000000400000-0x00000000004B7000-memory.dmpFilesize
732KB
-
memory/1492-58-0x0000000000400000-0x00000000004B7000-memory.dmpFilesize
732KB
-
memory/1672-68-0x0000000000000000-mapping.dmp