Analysis
-
max time kernel
162s -
max time network
172s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
23-11-2022 15:06
Static task
static1
Behavioral task
behavioral1
Sample
00d2305abc3da7774ba6457af59e1eed6707d7f25301b7cb8c92d15b710b7ea1.exe
Resource
win7-20221111-en
General
-
Target
00d2305abc3da7774ba6457af59e1eed6707d7f25301b7cb8c92d15b710b7ea1.exe
-
Size
602KB
-
MD5
10c1f5e88fc58c3b81f674b236f865a7
-
SHA1
81c2c3503264b4e93138d01d2d3d9f35d20fa16e
-
SHA256
00d2305abc3da7774ba6457af59e1eed6707d7f25301b7cb8c92d15b710b7ea1
-
SHA512
ff66f2af00d2dc75151c7b3bd57f14939a07616f6791d9d6e93662473e1374b6ea0c736a7bb1aa9ae9e6d97e6d22b23df3be13876503db04f3a70a886934d9c2
-
SSDEEP
12288:d5POFJhOmLP8f8WN3wE2qW9VqaBeK0NUecJ4:TgkmwEW2BqUVqaN0F
Malware Config
Extracted
darkcomet
POWER
uche.ddns.net:1604
DC_MUTEX-AN3QBSU
-
gencode
WEYVhvx4N8NX
-
install
false
-
offline_keylogger
true
-
persistence
false
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
Processes:
00d2305abc3da7774ba6457af59e1eed6707d7f25301b7cb8c92d15b710b7ea1.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "C:\\Users\\Admin\\AppData\\Local\\Temp\\file.exe" 00d2305abc3da7774ba6457af59e1eed6707d7f25301b7cb8c92d15b710b7ea1.exe -
Executes dropped EXE 1 IoCs
Processes:
notepad .exepid process 5100 notepad .exe -
Processes:
resource yara_rule behavioral2/memory/5100-139-0x0000000000400000-0x00000000004B7000-memory.dmp upx behavioral2/memory/5100-145-0x0000000000400000-0x00000000004B7000-memory.dmp upx behavioral2/memory/5100-146-0x0000000000400000-0x00000000004B7000-memory.dmp upx behavioral2/memory/5100-148-0x0000000000400000-0x00000000004B7000-memory.dmp upx behavioral2/memory/5100-149-0x0000000000400000-0x00000000004B7000-memory.dmp upx behavioral2/memory/5100-150-0x0000000000400000-0x00000000004B7000-memory.dmp upx -
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
wscript.exe00d2305abc3da7774ba6457af59e1eed6707d7f25301b7cb8c92d15b710b7ea1.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Control Panel\International\Geo\Nation wscript.exe Key value queried \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Control Panel\International\Geo\Nation 00d2305abc3da7774ba6457af59e1eed6707d7f25301b7cb8c92d15b710b7ea1.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
00d2305abc3da7774ba6457af59e1eed6707d7f25301b7cb8c92d15b710b7ea1.exedescription pid process target process PID 816 set thread context of 5100 816 00d2305abc3da7774ba6457af59e1eed6707d7f25301b7cb8c92d15b710b7ea1.exe notepad .exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Delays execution with timeout.exe 1 IoCs
Processes:
timeout.exepid process 432 timeout.exe -
Suspicious behavior: EnumeratesProcesses 3 IoCs
Processes:
00d2305abc3da7774ba6457af59e1eed6707d7f25301b7cb8c92d15b710b7ea1.exepid process 816 00d2305abc3da7774ba6457af59e1eed6707d7f25301b7cb8c92d15b710b7ea1.exe 816 00d2305abc3da7774ba6457af59e1eed6707d7f25301b7cb8c92d15b710b7ea1.exe 816 00d2305abc3da7774ba6457af59e1eed6707d7f25301b7cb8c92d15b710b7ea1.exe -
Suspicious use of AdjustPrivilegeToken 25 IoCs
Processes:
00d2305abc3da7774ba6457af59e1eed6707d7f25301b7cb8c92d15b710b7ea1.exenotepad .exedescription pid process Token: SeDebugPrivilege 816 00d2305abc3da7774ba6457af59e1eed6707d7f25301b7cb8c92d15b710b7ea1.exe Token: SeIncreaseQuotaPrivilege 5100 notepad .exe Token: SeSecurityPrivilege 5100 notepad .exe Token: SeTakeOwnershipPrivilege 5100 notepad .exe Token: SeLoadDriverPrivilege 5100 notepad .exe Token: SeSystemProfilePrivilege 5100 notepad .exe Token: SeSystemtimePrivilege 5100 notepad .exe Token: SeProfSingleProcessPrivilege 5100 notepad .exe Token: SeIncBasePriorityPrivilege 5100 notepad .exe Token: SeCreatePagefilePrivilege 5100 notepad .exe Token: SeBackupPrivilege 5100 notepad .exe Token: SeRestorePrivilege 5100 notepad .exe Token: SeShutdownPrivilege 5100 notepad .exe Token: SeDebugPrivilege 5100 notepad .exe Token: SeSystemEnvironmentPrivilege 5100 notepad .exe Token: SeChangeNotifyPrivilege 5100 notepad .exe Token: SeRemoteShutdownPrivilege 5100 notepad .exe Token: SeUndockPrivilege 5100 notepad .exe Token: SeManageVolumePrivilege 5100 notepad .exe Token: SeImpersonatePrivilege 5100 notepad .exe Token: SeCreateGlobalPrivilege 5100 notepad .exe Token: 33 5100 notepad .exe Token: 34 5100 notepad .exe Token: 35 5100 notepad .exe Token: 36 5100 notepad .exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
notepad .exepid process 5100 notepad .exe -
Suspicious use of WriteProcessMemory 23 IoCs
Processes:
00d2305abc3da7774ba6457af59e1eed6707d7f25301b7cb8c92d15b710b7ea1.execmd.exewscript.execmd.exedescription pid process target process PID 816 wrote to memory of 3144 816 00d2305abc3da7774ba6457af59e1eed6707d7f25301b7cb8c92d15b710b7ea1.exe cmd.exe PID 816 wrote to memory of 3144 816 00d2305abc3da7774ba6457af59e1eed6707d7f25301b7cb8c92d15b710b7ea1.exe cmd.exe PID 816 wrote to memory of 3144 816 00d2305abc3da7774ba6457af59e1eed6707d7f25301b7cb8c92d15b710b7ea1.exe cmd.exe PID 3144 wrote to memory of 5096 3144 cmd.exe wscript.exe PID 3144 wrote to memory of 5096 3144 cmd.exe wscript.exe PID 3144 wrote to memory of 5096 3144 cmd.exe wscript.exe PID 816 wrote to memory of 5100 816 00d2305abc3da7774ba6457af59e1eed6707d7f25301b7cb8c92d15b710b7ea1.exe notepad .exe PID 816 wrote to memory of 5100 816 00d2305abc3da7774ba6457af59e1eed6707d7f25301b7cb8c92d15b710b7ea1.exe notepad .exe PID 816 wrote to memory of 5100 816 00d2305abc3da7774ba6457af59e1eed6707d7f25301b7cb8c92d15b710b7ea1.exe notepad .exe PID 816 wrote to memory of 5100 816 00d2305abc3da7774ba6457af59e1eed6707d7f25301b7cb8c92d15b710b7ea1.exe notepad .exe PID 816 wrote to memory of 5100 816 00d2305abc3da7774ba6457af59e1eed6707d7f25301b7cb8c92d15b710b7ea1.exe notepad .exe PID 816 wrote to memory of 5100 816 00d2305abc3da7774ba6457af59e1eed6707d7f25301b7cb8c92d15b710b7ea1.exe notepad .exe PID 816 wrote to memory of 5100 816 00d2305abc3da7774ba6457af59e1eed6707d7f25301b7cb8c92d15b710b7ea1.exe notepad .exe PID 816 wrote to memory of 5100 816 00d2305abc3da7774ba6457af59e1eed6707d7f25301b7cb8c92d15b710b7ea1.exe notepad .exe PID 5096 wrote to memory of 3508 5096 wscript.exe cmd.exe PID 5096 wrote to memory of 3508 5096 wscript.exe cmd.exe PID 5096 wrote to memory of 3508 5096 wscript.exe cmd.exe PID 816 wrote to memory of 4552 816 00d2305abc3da7774ba6457af59e1eed6707d7f25301b7cb8c92d15b710b7ea1.exe cmd.exe PID 816 wrote to memory of 4552 816 00d2305abc3da7774ba6457af59e1eed6707d7f25301b7cb8c92d15b710b7ea1.exe cmd.exe PID 816 wrote to memory of 4552 816 00d2305abc3da7774ba6457af59e1eed6707d7f25301b7cb8c92d15b710b7ea1.exe cmd.exe PID 4552 wrote to memory of 432 4552 cmd.exe timeout.exe PID 4552 wrote to memory of 432 4552 cmd.exe timeout.exe PID 4552 wrote to memory of 432 4552 cmd.exe timeout.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\00d2305abc3da7774ba6457af59e1eed6707d7f25301b7cb8c92d15b710b7ea1.exe"C:\Users\Admin\AppData\Local\Temp\00d2305abc3da7774ba6457af59e1eed6707d7f25301b7cb8c92d15b710b7ea1.exe"1⤵
- Modifies WinLogon for persistence
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\\mata.bat2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\wscript.exewscript.exe "C:\Users\Admin\AppData\Local\Temp\invs.vbs" "C:\Users\Admin\AppData\Local\Temp\mata2.bat3⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\mata2.bat" "4⤵
-
C:\Users\Admin\AppData\Local\Temp\notepad .exe"C:\Users\Admin\AppData\Local\Temp\notepad .exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\stres.bat" "2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\timeout.exetimeout /t 3003⤵
- Delays execution with timeout.exe
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\file.exeFilesize
602KB
MD510c1f5e88fc58c3b81f674b236f865a7
SHA181c2c3503264b4e93138d01d2d3d9f35d20fa16e
SHA25600d2305abc3da7774ba6457af59e1eed6707d7f25301b7cb8c92d15b710b7ea1
SHA512ff66f2af00d2dc75151c7b3bd57f14939a07616f6791d9d6e93662473e1374b6ea0c736a7bb1aa9ae9e6d97e6d22b23df3be13876503db04f3a70a886934d9c2
-
C:\Users\Admin\AppData\Local\Temp\invs.vbsFilesize
78B
MD5c578d9653b22800c3eb6b6a51219bbb8
SHA1a97aa251901bbe179a48dbc7a0c1872e163b1f2d
SHA25620a98a7e6e137bb1b9bd5ef6911a479cb8eac925b80d6db4e70b19f62a40cce2
SHA5123ae6dc8f02d1a78e1235a0782b632972da5a74ab32287cc41aa672d4fa4a9d34bb5fc50eba07b6915f2e61c402927cd5f6feeb7f7602afa2f64e91efb3b7fc4d
-
C:\Users\Admin\AppData\Local\Temp\mata.batFilesize
47B
MD558c538a6ae20a3c6031217903cdf8e5d
SHA1399fd50eadf4945b665877facfc4f53d16e18b1e
SHA2566bcc0e04d9bc32209d90a65c320dc6363e523dd94b38b17bcdc5b980b6405f53
SHA512c01828a5390fec3443e19d317137ae873de77c7737db7802650430e6a0a1edbd3aabe362903243b372536418fbd8482c2a6efd122d853744a41ade567956c359
-
C:\Users\Admin\AppData\Local\Temp\mata2.batFilesize
47B
MD5095b2908ae8b2e0e3704c0163f26e283
SHA13429b6c1421d448c98c1da9625badcea2484a521
SHA25622b182644ab28f5e9e17b5a03ba404d09b02da367146b80484584adc842a3ed1
SHA512e22e379b4f0d8e11fa7c29c3297a3e24a533fb08895d18e9bb27e8cab84da1dd52ff437aca90c5c32a9bdb578b3c1bfb3ff42d3bc2c5951ffeb5941c8286c731
-
C:\Users\Admin\AppData\Local\Temp\notepad .exeFilesize
34KB
MD5e118330b4629b12368d91b9df6488be0
SHA1ce90218c7e3b90df2a3409ec253048bb6472c2fd
SHA2563a0f2936b8c45e8ba3458d69d7859a63844469e698652e15fb56639d32f40cc9
SHA512ac91c04cb20223dbaaf594440cb778dff36e857921be427c8528ba4c6cdb3e8bf8e71e1ae8af7bde9c04ff5b97b379231625bc1a2b66aba2f98cd340cd8a94b0
-
C:\Users\Admin\AppData\Local\Temp\notepad .exeFilesize
34KB
MD5e118330b4629b12368d91b9df6488be0
SHA1ce90218c7e3b90df2a3409ec253048bb6472c2fd
SHA2563a0f2936b8c45e8ba3458d69d7859a63844469e698652e15fb56639d32f40cc9
SHA512ac91c04cb20223dbaaf594440cb778dff36e857921be427c8528ba4c6cdb3e8bf8e71e1ae8af7bde9c04ff5b97b379231625bc1a2b66aba2f98cd340cd8a94b0
-
C:\Users\Admin\AppData\Local\Temp\rundll11-.txtFilesize
602KB
MD510c1f5e88fc58c3b81f674b236f865a7
SHA181c2c3503264b4e93138d01d2d3d9f35d20fa16e
SHA25600d2305abc3da7774ba6457af59e1eed6707d7f25301b7cb8c92d15b710b7ea1
SHA512ff66f2af00d2dc75151c7b3bd57f14939a07616f6791d9d6e93662473e1374b6ea0c736a7bb1aa9ae9e6d97e6d22b23df3be13876503db04f3a70a886934d9c2
-
C:\Users\Admin\AppData\Local\Temp\stres.batFilesize
200B
MD5fc10f5325d4bf4be8eaac50c0a463469
SHA154d4daf129d17abf8284835017865f99c70ffe22
SHA256acf2946adf8e613c5f2d776863f844b9572fc580eb4d9324f285d1bb3844e70e
SHA512ae3ba84843312be74fda36615bd476f7b6aec5223cc0dbb183d42a57c27a8d2a6545f5273866ded6d3e3c31ef640724c74c0f47992c1c825f6f2e56ab5160490
-
memory/432-153-0x0000000000000000-mapping.dmp
-
memory/816-132-0x0000000074B60000-0x0000000075111000-memory.dmpFilesize
5.7MB
-
memory/816-155-0x0000000074B60000-0x0000000075111000-memory.dmpFilesize
5.7MB
-
memory/816-133-0x0000000074B60000-0x0000000075111000-memory.dmpFilesize
5.7MB
-
memory/3144-134-0x0000000000000000-mapping.dmp
-
memory/3508-141-0x0000000000000000-mapping.dmp
-
memory/4552-151-0x0000000000000000-mapping.dmp
-
memory/5096-136-0x0000000000000000-mapping.dmp
-
memory/5100-137-0x0000000000000000-mapping.dmp
-
memory/5100-150-0x0000000000400000-0x00000000004B7000-memory.dmpFilesize
732KB
-
memory/5100-149-0x0000000000400000-0x00000000004B7000-memory.dmpFilesize
732KB
-
memory/5100-148-0x0000000000400000-0x00000000004B7000-memory.dmpFilesize
732KB
-
memory/5100-146-0x0000000000400000-0x00000000004B7000-memory.dmpFilesize
732KB
-
memory/5100-145-0x0000000000400000-0x00000000004B7000-memory.dmpFilesize
732KB
-
memory/5100-139-0x0000000000400000-0x00000000004B7000-memory.dmpFilesize
732KB