Analysis
-
max time kernel
151s -
max time network
140s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
23-11-2022 13:23
Static task
static1
Behavioral task
behavioral1
Sample
ae09e31694f993c501a0be510387740d2c0183746cd211e06df209832780f0bf.exe
Resource
win7-20220812-en
General
-
Target
ae09e31694f993c501a0be510387740d2c0183746cd211e06df209832780f0bf.exe
-
Size
656KB
-
MD5
43cf563f1ec7d4e846fb8026b25dfd22
-
SHA1
8f17ea13d266f6000700264447eebcfca706ac87
-
SHA256
ae09e31694f993c501a0be510387740d2c0183746cd211e06df209832780f0bf
-
SHA512
d526402638b4afd4510c7b18beff61b5eb16b2c69a8ec5a6b08b555b6fb52e022c8026b2db69c062f0f3ddb482b3f7ead0140350c2c795236971a2c7e0d302ca
-
SSDEEP
12288:p+zAJeM/XzsV9TBhwxPtztYHz4A7dfmHZJXPgu6Z08vm:p+8JX/Xz29TBO1BYT4A7Bmr4u6Z08m
Malware Config
Extracted
darkcomet
IFY
uche.ddns.net:1604
DC_MUTEX-UU8NM43
-
gencode
8tkYU6w6xNHG
-
install
false
-
offline_keylogger
true
-
persistence
false
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
Processes:
ae09e31694f993c501a0be510387740d2c0183746cd211e06df209832780f0bf.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "C:\\Users\\Admin\\AppData\\Local\\Temp\\file.exe" ae09e31694f993c501a0be510387740d2c0183746cd211e06df209832780f0bf.exe -
Executes dropped EXE 1 IoCs
Processes:
notepad .exepid process 2264 notepad .exe -
Processes:
resource yara_rule behavioral2/memory/2264-142-0x0000000000400000-0x00000000004B7000-memory.dmp upx behavioral2/memory/2264-145-0x0000000000400000-0x00000000004B7000-memory.dmp upx behavioral2/memory/2264-146-0x0000000000400000-0x00000000004B7000-memory.dmp upx behavioral2/memory/2264-148-0x0000000000400000-0x00000000004B7000-memory.dmp upx behavioral2/memory/2264-149-0x0000000000400000-0x00000000004B7000-memory.dmp upx behavioral2/memory/2264-150-0x0000000000400000-0x00000000004B7000-memory.dmp upx -
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
wscript.exeae09e31694f993c501a0be510387740d2c0183746cd211e06df209832780f0bf.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation wscript.exe Key value queried \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation ae09e31694f993c501a0be510387740d2c0183746cd211e06df209832780f0bf.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
ae09e31694f993c501a0be510387740d2c0183746cd211e06df209832780f0bf.exedescription pid process target process PID 4728 set thread context of 2264 4728 ae09e31694f993c501a0be510387740d2c0183746cd211e06df209832780f0bf.exe notepad .exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 3 IoCs
Processes:
ae09e31694f993c501a0be510387740d2c0183746cd211e06df209832780f0bf.exepid process 4728 ae09e31694f993c501a0be510387740d2c0183746cd211e06df209832780f0bf.exe 4728 ae09e31694f993c501a0be510387740d2c0183746cd211e06df209832780f0bf.exe 4728 ae09e31694f993c501a0be510387740d2c0183746cd211e06df209832780f0bf.exe -
Suspicious use of AdjustPrivilegeToken 25 IoCs
Processes:
ae09e31694f993c501a0be510387740d2c0183746cd211e06df209832780f0bf.exenotepad .exedescription pid process Token: SeDebugPrivilege 4728 ae09e31694f993c501a0be510387740d2c0183746cd211e06df209832780f0bf.exe Token: SeIncreaseQuotaPrivilege 2264 notepad .exe Token: SeSecurityPrivilege 2264 notepad .exe Token: SeTakeOwnershipPrivilege 2264 notepad .exe Token: SeLoadDriverPrivilege 2264 notepad .exe Token: SeSystemProfilePrivilege 2264 notepad .exe Token: SeSystemtimePrivilege 2264 notepad .exe Token: SeProfSingleProcessPrivilege 2264 notepad .exe Token: SeIncBasePriorityPrivilege 2264 notepad .exe Token: SeCreatePagefilePrivilege 2264 notepad .exe Token: SeBackupPrivilege 2264 notepad .exe Token: SeRestorePrivilege 2264 notepad .exe Token: SeShutdownPrivilege 2264 notepad .exe Token: SeDebugPrivilege 2264 notepad .exe Token: SeSystemEnvironmentPrivilege 2264 notepad .exe Token: SeChangeNotifyPrivilege 2264 notepad .exe Token: SeRemoteShutdownPrivilege 2264 notepad .exe Token: SeUndockPrivilege 2264 notepad .exe Token: SeManageVolumePrivilege 2264 notepad .exe Token: SeImpersonatePrivilege 2264 notepad .exe Token: SeCreateGlobalPrivilege 2264 notepad .exe Token: 33 2264 notepad .exe Token: 34 2264 notepad .exe Token: 35 2264 notepad .exe Token: 36 2264 notepad .exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
notepad .exepid process 2264 notepad .exe -
Suspicious use of WriteProcessMemory 17 IoCs
Processes:
ae09e31694f993c501a0be510387740d2c0183746cd211e06df209832780f0bf.execmd.exewscript.exedescription pid process target process PID 4728 wrote to memory of 1404 4728 ae09e31694f993c501a0be510387740d2c0183746cd211e06df209832780f0bf.exe cmd.exe PID 4728 wrote to memory of 1404 4728 ae09e31694f993c501a0be510387740d2c0183746cd211e06df209832780f0bf.exe cmd.exe PID 4728 wrote to memory of 1404 4728 ae09e31694f993c501a0be510387740d2c0183746cd211e06df209832780f0bf.exe cmd.exe PID 4728 wrote to memory of 2264 4728 ae09e31694f993c501a0be510387740d2c0183746cd211e06df209832780f0bf.exe notepad .exe PID 4728 wrote to memory of 2264 4728 ae09e31694f993c501a0be510387740d2c0183746cd211e06df209832780f0bf.exe notepad .exe PID 4728 wrote to memory of 2264 4728 ae09e31694f993c501a0be510387740d2c0183746cd211e06df209832780f0bf.exe notepad .exe PID 1404 wrote to memory of 3468 1404 cmd.exe wscript.exe PID 1404 wrote to memory of 3468 1404 cmd.exe wscript.exe PID 1404 wrote to memory of 3468 1404 cmd.exe wscript.exe PID 4728 wrote to memory of 2264 4728 ae09e31694f993c501a0be510387740d2c0183746cd211e06df209832780f0bf.exe notepad .exe PID 4728 wrote to memory of 2264 4728 ae09e31694f993c501a0be510387740d2c0183746cd211e06df209832780f0bf.exe notepad .exe PID 4728 wrote to memory of 2264 4728 ae09e31694f993c501a0be510387740d2c0183746cd211e06df209832780f0bf.exe notepad .exe PID 4728 wrote to memory of 2264 4728 ae09e31694f993c501a0be510387740d2c0183746cd211e06df209832780f0bf.exe notepad .exe PID 4728 wrote to memory of 2264 4728 ae09e31694f993c501a0be510387740d2c0183746cd211e06df209832780f0bf.exe notepad .exe PID 3468 wrote to memory of 5052 3468 wscript.exe cmd.exe PID 3468 wrote to memory of 5052 3468 wscript.exe cmd.exe PID 3468 wrote to memory of 5052 3468 wscript.exe cmd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\ae09e31694f993c501a0be510387740d2c0183746cd211e06df209832780f0bf.exe"C:\Users\Admin\AppData\Local\Temp\ae09e31694f993c501a0be510387740d2c0183746cd211e06df209832780f0bf.exe"1⤵
- Modifies WinLogon for persistence
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4728 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\\mata.bat2⤵
- Suspicious use of WriteProcessMemory
PID:1404 -
C:\Windows\SysWOW64\wscript.exewscript.exe "C:\Users\Admin\AppData\Local\Temp\invs.vbs" "C:\Users\Admin\AppData\Local\Temp\mata2.bat3⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:3468 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\mata2.bat" "4⤵PID:5052
-
C:\Users\Admin\AppData\Local\Temp\notepad .exe"C:\Users\Admin\AppData\Local\Temp\notepad .exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2264
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\file.exeFilesize
656KB
MD543cf563f1ec7d4e846fb8026b25dfd22
SHA18f17ea13d266f6000700264447eebcfca706ac87
SHA256ae09e31694f993c501a0be510387740d2c0183746cd211e06df209832780f0bf
SHA512d526402638b4afd4510c7b18beff61b5eb16b2c69a8ec5a6b08b555b6fb52e022c8026b2db69c062f0f3ddb482b3f7ead0140350c2c795236971a2c7e0d302ca
-
C:\Users\Admin\AppData\Local\Temp\invs.vbsFilesize
78B
MD5c578d9653b22800c3eb6b6a51219bbb8
SHA1a97aa251901bbe179a48dbc7a0c1872e163b1f2d
SHA25620a98a7e6e137bb1b9bd5ef6911a479cb8eac925b80d6db4e70b19f62a40cce2
SHA5123ae6dc8f02d1a78e1235a0782b632972da5a74ab32287cc41aa672d4fa4a9d34bb5fc50eba07b6915f2e61c402927cd5f6feeb7f7602afa2f64e91efb3b7fc4d
-
C:\Users\Admin\AppData\Local\Temp\mata.batFilesize
47B
MD558c538a6ae20a3c6031217903cdf8e5d
SHA1399fd50eadf4945b665877facfc4f53d16e18b1e
SHA2566bcc0e04d9bc32209d90a65c320dc6363e523dd94b38b17bcdc5b980b6405f53
SHA512c01828a5390fec3443e19d317137ae873de77c7737db7802650430e6a0a1edbd3aabe362903243b372536418fbd8482c2a6efd122d853744a41ade567956c359
-
C:\Users\Admin\AppData\Local\Temp\mata2.batFilesize
47B
MD5095b2908ae8b2e0e3704c0163f26e283
SHA13429b6c1421d448c98c1da9625badcea2484a521
SHA25622b182644ab28f5e9e17b5a03ba404d09b02da367146b80484584adc842a3ed1
SHA512e22e379b4f0d8e11fa7c29c3297a3e24a533fb08895d18e9bb27e8cab84da1dd52ff437aca90c5c32a9bdb578b3c1bfb3ff42d3bc2c5951ffeb5941c8286c731
-
C:\Users\Admin\AppData\Local\Temp\notepad .exeFilesize
34KB
MD5e118330b4629b12368d91b9df6488be0
SHA1ce90218c7e3b90df2a3409ec253048bb6472c2fd
SHA2563a0f2936b8c45e8ba3458d69d7859a63844469e698652e15fb56639d32f40cc9
SHA512ac91c04cb20223dbaaf594440cb778dff36e857921be427c8528ba4c6cdb3e8bf8e71e1ae8af7bde9c04ff5b97b379231625bc1a2b66aba2f98cd340cd8a94b0
-
C:\Users\Admin\AppData\Local\Temp\notepad .exeFilesize
34KB
MD5e118330b4629b12368d91b9df6488be0
SHA1ce90218c7e3b90df2a3409ec253048bb6472c2fd
SHA2563a0f2936b8c45e8ba3458d69d7859a63844469e698652e15fb56639d32f40cc9
SHA512ac91c04cb20223dbaaf594440cb778dff36e857921be427c8528ba4c6cdb3e8bf8e71e1ae8af7bde9c04ff5b97b379231625bc1a2b66aba2f98cd340cd8a94b0
-
C:\Users\Admin\AppData\Local\Temp\rundll11-.txtFilesize
656KB
MD543cf563f1ec7d4e846fb8026b25dfd22
SHA18f17ea13d266f6000700264447eebcfca706ac87
SHA256ae09e31694f993c501a0be510387740d2c0183746cd211e06df209832780f0bf
SHA512d526402638b4afd4510c7b18beff61b5eb16b2c69a8ec5a6b08b555b6fb52e022c8026b2db69c062f0f3ddb482b3f7ead0140350c2c795236971a2c7e0d302ca
-
memory/1404-133-0x0000000000000000-mapping.dmp
-
memory/2264-142-0x0000000000400000-0x00000000004B7000-memory.dmpFilesize
732KB
-
memory/2264-136-0x0000000000000000-mapping.dmp
-
memory/2264-145-0x0000000000400000-0x00000000004B7000-memory.dmpFilesize
732KB
-
memory/2264-146-0x0000000000400000-0x00000000004B7000-memory.dmpFilesize
732KB
-
memory/2264-148-0x0000000000400000-0x00000000004B7000-memory.dmpFilesize
732KB
-
memory/2264-149-0x0000000000400000-0x00000000004B7000-memory.dmpFilesize
732KB
-
memory/2264-150-0x0000000000400000-0x00000000004B7000-memory.dmpFilesize
732KB
-
memory/3468-135-0x0000000000000000-mapping.dmp
-
memory/4728-141-0x0000000075590000-0x0000000075B41000-memory.dmpFilesize
5.7MB
-
memory/4728-132-0x0000000075590000-0x0000000075B41000-memory.dmpFilesize
5.7MB
-
memory/4728-152-0x0000000075590000-0x0000000075B41000-memory.dmpFilesize
5.7MB
-
memory/5052-139-0x0000000000000000-mapping.dmp