Analysis
-
max time kernel
185s -
max time network
211s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
23-11-2022 14:34
Static task
static1
Behavioral task
behavioral1
Sample
39b3577f623fbfd5b84250da4b9233df05787582f210acffcc3058515e0cd1cd.exe
Resource
win7-20221111-en
General
-
Target
39b3577f623fbfd5b84250da4b9233df05787582f210acffcc3058515e0cd1cd.exe
-
Size
1.2MB
-
MD5
9fc38321f1909639ad798581695a4356
-
SHA1
1909410463a9e964dd2053c36ac8d90e8bc515b5
-
SHA256
39b3577f623fbfd5b84250da4b9233df05787582f210acffcc3058515e0cd1cd
-
SHA512
1022d56042dc083d14fdf89314fab7b36f63798a3c818dae9caded437d4e19350f66d612c296e545037cd71ca32594b1da54b4f4b769e7957e0180f5d6e7abc0
-
SSDEEP
24576:0FJlc+Eeep4XeQs1HoITBZVYW1yvIjls+54RTGEKFEVlvsfAvbIL+LHLRVe:amdYoHo4ZVYW8vIq+5YGil88Ve
Malware Config
Extracted
darkcomet
UNKNOWN
abdulzokhan.no-ip.org:2323
DC_MUTEX-UP6NB9G
-
InstallPath
NokiaOviSuite.exe
-
gencode
qEy8YaRgYauv
-
install
true
-
offline_keylogger
true
-
persistence
true
-
reg_key
NokiaOviSuite
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
Processes:
39b3577f623fbfd5b84250da4b9233df05787582f210acffcc3058515e0cd1cd.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Users\\Admin\\AppData\\Local\\Temp\\NokiaOviSuite.exe" 39b3577f623fbfd5b84250da4b9233df05787582f210acffcc3058515e0cd1cd.exe -
Executes dropped EXE 2 IoCs
Processes:
NokiaOviSuite.exeNokiaOviSuite.exepid process 4460 NokiaOviSuite.exe 4448 NokiaOviSuite.exe -
Sets file to hidden 1 TTPs 2 IoCs
Modifies file attributes to stop it showing in Explorer etc.
Processes:
attrib.exeattrib.exepid process 4984 attrib.exe 1656 attrib.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
39b3577f623fbfd5b84250da4b9233df05787582f210acffcc3058515e0cd1cd.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-4060001867-1434967833-2212371794-1000\Control Panel\International\Geo\Nation 39b3577f623fbfd5b84250da4b9233df05787582f210acffcc3058515e0cd1cd.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
39b3577f623fbfd5b84250da4b9233df05787582f210acffcc3058515e0cd1cd.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-4060001867-1434967833-2212371794-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\NokiaOviSuite = "C:\\Users\\Admin\\AppData\\Local\\Temp\\NokiaOviSuite.exe" 39b3577f623fbfd5b84250da4b9233df05787582f210acffcc3058515e0cd1cd.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
39b3577f623fbfd5b84250da4b9233df05787582f210acffcc3058515e0cd1cd.exeNokiaOviSuite.exedescription pid process target process PID 1536 set thread context of 1548 1536 39b3577f623fbfd5b84250da4b9233df05787582f210acffcc3058515e0cd1cd.exe 39b3577f623fbfd5b84250da4b9233df05787582f210acffcc3058515e0cd1cd.exe PID 4460 set thread context of 4448 4460 NokiaOviSuite.exe NokiaOviSuite.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 4920 4448 WerFault.exe NokiaOviSuite.exe -
Modifies registry class 1 IoCs
Processes:
39b3577f623fbfd5b84250da4b9233df05787582f210acffcc3058515e0cd1cd.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ 39b3577f623fbfd5b84250da4b9233df05787582f210acffcc3058515e0cd1cd.exe -
Suspicious use of AdjustPrivilegeToken 26 IoCs
Processes:
39b3577f623fbfd5b84250da4b9233df05787582f210acffcc3058515e0cd1cd.exe39b3577f623fbfd5b84250da4b9233df05787582f210acffcc3058515e0cd1cd.exeNokiaOviSuite.exedescription pid process Token: SeDebugPrivilege 1536 39b3577f623fbfd5b84250da4b9233df05787582f210acffcc3058515e0cd1cd.exe Token: SeIncreaseQuotaPrivilege 1548 39b3577f623fbfd5b84250da4b9233df05787582f210acffcc3058515e0cd1cd.exe Token: SeSecurityPrivilege 1548 39b3577f623fbfd5b84250da4b9233df05787582f210acffcc3058515e0cd1cd.exe Token: SeTakeOwnershipPrivilege 1548 39b3577f623fbfd5b84250da4b9233df05787582f210acffcc3058515e0cd1cd.exe Token: SeLoadDriverPrivilege 1548 39b3577f623fbfd5b84250da4b9233df05787582f210acffcc3058515e0cd1cd.exe Token: SeSystemProfilePrivilege 1548 39b3577f623fbfd5b84250da4b9233df05787582f210acffcc3058515e0cd1cd.exe Token: SeSystemtimePrivilege 1548 39b3577f623fbfd5b84250da4b9233df05787582f210acffcc3058515e0cd1cd.exe Token: SeProfSingleProcessPrivilege 1548 39b3577f623fbfd5b84250da4b9233df05787582f210acffcc3058515e0cd1cd.exe Token: SeIncBasePriorityPrivilege 1548 39b3577f623fbfd5b84250da4b9233df05787582f210acffcc3058515e0cd1cd.exe Token: SeCreatePagefilePrivilege 1548 39b3577f623fbfd5b84250da4b9233df05787582f210acffcc3058515e0cd1cd.exe Token: SeBackupPrivilege 1548 39b3577f623fbfd5b84250da4b9233df05787582f210acffcc3058515e0cd1cd.exe Token: SeRestorePrivilege 1548 39b3577f623fbfd5b84250da4b9233df05787582f210acffcc3058515e0cd1cd.exe Token: SeShutdownPrivilege 1548 39b3577f623fbfd5b84250da4b9233df05787582f210acffcc3058515e0cd1cd.exe Token: SeDebugPrivilege 1548 39b3577f623fbfd5b84250da4b9233df05787582f210acffcc3058515e0cd1cd.exe Token: SeSystemEnvironmentPrivilege 1548 39b3577f623fbfd5b84250da4b9233df05787582f210acffcc3058515e0cd1cd.exe Token: SeChangeNotifyPrivilege 1548 39b3577f623fbfd5b84250da4b9233df05787582f210acffcc3058515e0cd1cd.exe Token: SeRemoteShutdownPrivilege 1548 39b3577f623fbfd5b84250da4b9233df05787582f210acffcc3058515e0cd1cd.exe Token: SeUndockPrivilege 1548 39b3577f623fbfd5b84250da4b9233df05787582f210acffcc3058515e0cd1cd.exe Token: SeManageVolumePrivilege 1548 39b3577f623fbfd5b84250da4b9233df05787582f210acffcc3058515e0cd1cd.exe Token: SeImpersonatePrivilege 1548 39b3577f623fbfd5b84250da4b9233df05787582f210acffcc3058515e0cd1cd.exe Token: SeCreateGlobalPrivilege 1548 39b3577f623fbfd5b84250da4b9233df05787582f210acffcc3058515e0cd1cd.exe Token: 33 1548 39b3577f623fbfd5b84250da4b9233df05787582f210acffcc3058515e0cd1cd.exe Token: 34 1548 39b3577f623fbfd5b84250da4b9233df05787582f210acffcc3058515e0cd1cd.exe Token: 35 1548 39b3577f623fbfd5b84250da4b9233df05787582f210acffcc3058515e0cd1cd.exe Token: 36 1548 39b3577f623fbfd5b84250da4b9233df05787582f210acffcc3058515e0cd1cd.exe Token: SeDebugPrivilege 4460 NokiaOviSuite.exe -
Suspicious use of WriteProcessMemory 43 IoCs
Processes:
39b3577f623fbfd5b84250da4b9233df05787582f210acffcc3058515e0cd1cd.exe39b3577f623fbfd5b84250da4b9233df05787582f210acffcc3058515e0cd1cd.execmd.execmd.exeNokiaOviSuite.exedescription pid process target process PID 1536 wrote to memory of 1548 1536 39b3577f623fbfd5b84250da4b9233df05787582f210acffcc3058515e0cd1cd.exe 39b3577f623fbfd5b84250da4b9233df05787582f210acffcc3058515e0cd1cd.exe PID 1536 wrote to memory of 1548 1536 39b3577f623fbfd5b84250da4b9233df05787582f210acffcc3058515e0cd1cd.exe 39b3577f623fbfd5b84250da4b9233df05787582f210acffcc3058515e0cd1cd.exe PID 1536 wrote to memory of 1548 1536 39b3577f623fbfd5b84250da4b9233df05787582f210acffcc3058515e0cd1cd.exe 39b3577f623fbfd5b84250da4b9233df05787582f210acffcc3058515e0cd1cd.exe PID 1536 wrote to memory of 1548 1536 39b3577f623fbfd5b84250da4b9233df05787582f210acffcc3058515e0cd1cd.exe 39b3577f623fbfd5b84250da4b9233df05787582f210acffcc3058515e0cd1cd.exe PID 1536 wrote to memory of 1548 1536 39b3577f623fbfd5b84250da4b9233df05787582f210acffcc3058515e0cd1cd.exe 39b3577f623fbfd5b84250da4b9233df05787582f210acffcc3058515e0cd1cd.exe PID 1536 wrote to memory of 1548 1536 39b3577f623fbfd5b84250da4b9233df05787582f210acffcc3058515e0cd1cd.exe 39b3577f623fbfd5b84250da4b9233df05787582f210acffcc3058515e0cd1cd.exe PID 1536 wrote to memory of 1548 1536 39b3577f623fbfd5b84250da4b9233df05787582f210acffcc3058515e0cd1cd.exe 39b3577f623fbfd5b84250da4b9233df05787582f210acffcc3058515e0cd1cd.exe PID 1536 wrote to memory of 1548 1536 39b3577f623fbfd5b84250da4b9233df05787582f210acffcc3058515e0cd1cd.exe 39b3577f623fbfd5b84250da4b9233df05787582f210acffcc3058515e0cd1cd.exe PID 1536 wrote to memory of 1548 1536 39b3577f623fbfd5b84250da4b9233df05787582f210acffcc3058515e0cd1cd.exe 39b3577f623fbfd5b84250da4b9233df05787582f210acffcc3058515e0cd1cd.exe PID 1536 wrote to memory of 1548 1536 39b3577f623fbfd5b84250da4b9233df05787582f210acffcc3058515e0cd1cd.exe 39b3577f623fbfd5b84250da4b9233df05787582f210acffcc3058515e0cd1cd.exe PID 1536 wrote to memory of 1548 1536 39b3577f623fbfd5b84250da4b9233df05787582f210acffcc3058515e0cd1cd.exe 39b3577f623fbfd5b84250da4b9233df05787582f210acffcc3058515e0cd1cd.exe PID 1536 wrote to memory of 1548 1536 39b3577f623fbfd5b84250da4b9233df05787582f210acffcc3058515e0cd1cd.exe 39b3577f623fbfd5b84250da4b9233df05787582f210acffcc3058515e0cd1cd.exe PID 1536 wrote to memory of 1548 1536 39b3577f623fbfd5b84250da4b9233df05787582f210acffcc3058515e0cd1cd.exe 39b3577f623fbfd5b84250da4b9233df05787582f210acffcc3058515e0cd1cd.exe PID 1536 wrote to memory of 1548 1536 39b3577f623fbfd5b84250da4b9233df05787582f210acffcc3058515e0cd1cd.exe 39b3577f623fbfd5b84250da4b9233df05787582f210acffcc3058515e0cd1cd.exe PID 1548 wrote to memory of 4620 1548 39b3577f623fbfd5b84250da4b9233df05787582f210acffcc3058515e0cd1cd.exe cmd.exe PID 1548 wrote to memory of 4620 1548 39b3577f623fbfd5b84250da4b9233df05787582f210acffcc3058515e0cd1cd.exe cmd.exe PID 1548 wrote to memory of 4620 1548 39b3577f623fbfd5b84250da4b9233df05787582f210acffcc3058515e0cd1cd.exe cmd.exe PID 1548 wrote to memory of 4612 1548 39b3577f623fbfd5b84250da4b9233df05787582f210acffcc3058515e0cd1cd.exe cmd.exe PID 1548 wrote to memory of 4612 1548 39b3577f623fbfd5b84250da4b9233df05787582f210acffcc3058515e0cd1cd.exe cmd.exe PID 1548 wrote to memory of 4612 1548 39b3577f623fbfd5b84250da4b9233df05787582f210acffcc3058515e0cd1cd.exe cmd.exe PID 4620 wrote to memory of 4984 4620 cmd.exe attrib.exe PID 4620 wrote to memory of 4984 4620 cmd.exe attrib.exe PID 4620 wrote to memory of 4984 4620 cmd.exe attrib.exe PID 4612 wrote to memory of 1656 4612 cmd.exe attrib.exe PID 4612 wrote to memory of 1656 4612 cmd.exe attrib.exe PID 4612 wrote to memory of 1656 4612 cmd.exe attrib.exe PID 1548 wrote to memory of 4460 1548 39b3577f623fbfd5b84250da4b9233df05787582f210acffcc3058515e0cd1cd.exe NokiaOviSuite.exe PID 1548 wrote to memory of 4460 1548 39b3577f623fbfd5b84250da4b9233df05787582f210acffcc3058515e0cd1cd.exe NokiaOviSuite.exe PID 1548 wrote to memory of 4460 1548 39b3577f623fbfd5b84250da4b9233df05787582f210acffcc3058515e0cd1cd.exe NokiaOviSuite.exe PID 4460 wrote to memory of 4448 4460 NokiaOviSuite.exe NokiaOviSuite.exe PID 4460 wrote to memory of 4448 4460 NokiaOviSuite.exe NokiaOviSuite.exe PID 4460 wrote to memory of 4448 4460 NokiaOviSuite.exe NokiaOviSuite.exe PID 4460 wrote to memory of 4448 4460 NokiaOviSuite.exe NokiaOviSuite.exe PID 4460 wrote to memory of 4448 4460 NokiaOviSuite.exe NokiaOviSuite.exe PID 4460 wrote to memory of 4448 4460 NokiaOviSuite.exe NokiaOviSuite.exe PID 4460 wrote to memory of 4448 4460 NokiaOviSuite.exe NokiaOviSuite.exe PID 4460 wrote to memory of 4448 4460 NokiaOviSuite.exe NokiaOviSuite.exe PID 4460 wrote to memory of 4448 4460 NokiaOviSuite.exe NokiaOviSuite.exe PID 4460 wrote to memory of 4448 4460 NokiaOviSuite.exe NokiaOviSuite.exe PID 4460 wrote to memory of 4448 4460 NokiaOviSuite.exe NokiaOviSuite.exe PID 4460 wrote to memory of 4448 4460 NokiaOviSuite.exe NokiaOviSuite.exe PID 4460 wrote to memory of 4448 4460 NokiaOviSuite.exe NokiaOviSuite.exe PID 4460 wrote to memory of 4448 4460 NokiaOviSuite.exe NokiaOviSuite.exe -
Views/modifies file attributes 1 TTPs 2 IoCs
Processes:
attrib.exeattrib.exepid process 1656 attrib.exe 4984 attrib.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\39b3577f623fbfd5b84250da4b9233df05787582f210acffcc3058515e0cd1cd.exe"C:\Users\Admin\AppData\Local\Temp\39b3577f623fbfd5b84250da4b9233df05787582f210acffcc3058515e0cd1cd.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\39b3577f623fbfd5b84250da4b9233df05787582f210acffcc3058515e0cd1cd.exeC:\Users\Admin\AppData\Local\Temp\39b3577f623fbfd5b84250da4b9233df05787582f210acffcc3058515e0cd1cd.exe2⤵
- Modifies WinLogon for persistence
- Checks computer location settings
- Adds Run key to start application
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp\39b3577f623fbfd5b84250da4b9233df05787582f210acffcc3058515e0cd1cd.exe" +s +h3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Users\Admin\AppData\Local\Temp\39b3577f623fbfd5b84250da4b9233df05787582f210acffcc3058515e0cd1cd.exe" +s +h4⤵
- Sets file to hidden
- Views/modifies file attributes
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp" +s +h3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Users\Admin\AppData\Local\Temp" +s +h4⤵
- Sets file to hidden
- Views/modifies file attributes
-
C:\Users\Admin\AppData\Local\Temp\NokiaOviSuite.exe"C:\Users\Admin\AppData\Local\Temp\NokiaOviSuite.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\NokiaOviSuite.exeC:\Users\Admin\AppData\Local\Temp\NokiaOviSuite.exe4⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4448 -s 805⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 4448 -ip 44481⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\NokiaOviSuite.exeFilesize
1.2MB
MD59fc38321f1909639ad798581695a4356
SHA11909410463a9e964dd2053c36ac8d90e8bc515b5
SHA25639b3577f623fbfd5b84250da4b9233df05787582f210acffcc3058515e0cd1cd
SHA5121022d56042dc083d14fdf89314fab7b36f63798a3c818dae9caded437d4e19350f66d612c296e545037cd71ca32594b1da54b4f4b769e7957e0180f5d6e7abc0
-
C:\Users\Admin\AppData\Local\Temp\NokiaOviSuite.exeFilesize
1.2MB
MD59fc38321f1909639ad798581695a4356
SHA11909410463a9e964dd2053c36ac8d90e8bc515b5
SHA25639b3577f623fbfd5b84250da4b9233df05787582f210acffcc3058515e0cd1cd
SHA5121022d56042dc083d14fdf89314fab7b36f63798a3c818dae9caded437d4e19350f66d612c296e545037cd71ca32594b1da54b4f4b769e7957e0180f5d6e7abc0
-
C:\Users\Admin\AppData\Local\Temp\NokiaOviSuite.exeFilesize
1.2MB
MD59fc38321f1909639ad798581695a4356
SHA11909410463a9e964dd2053c36ac8d90e8bc515b5
SHA25639b3577f623fbfd5b84250da4b9233df05787582f210acffcc3058515e0cd1cd
SHA5121022d56042dc083d14fdf89314fab7b36f63798a3c818dae9caded437d4e19350f66d612c296e545037cd71ca32594b1da54b4f4b769e7957e0180f5d6e7abc0
-
memory/1536-137-0x0000000074EF0000-0x00000000754A1000-memory.dmpFilesize
5.7MB
-
memory/1536-132-0x0000000074EF0000-0x00000000754A1000-memory.dmpFilesize
5.7MB
-
memory/1548-136-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/1548-135-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/1548-151-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/1548-133-0x0000000000000000-mapping.dmp
-
memory/1548-138-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/1548-134-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/1656-142-0x0000000000000000-mapping.dmp
-
memory/4448-147-0x0000000000000000-mapping.dmp
-
memory/4460-143-0x0000000000000000-mapping.dmp
-
memory/4460-146-0x00000000735C0000-0x0000000073B71000-memory.dmpFilesize
5.7MB
-
memory/4460-150-0x00000000735C0000-0x0000000073B71000-memory.dmpFilesize
5.7MB
-
memory/4612-140-0x0000000000000000-mapping.dmp
-
memory/4620-139-0x0000000000000000-mapping.dmp
-
memory/4984-141-0x0000000000000000-mapping.dmp