Analysis
-
max time kernel
178s -
max time network
214s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
23-11-2022 15:30
Static task
static1
Behavioral task
behavioral1
Sample
bc7f0ec83577f07d0e4238401dc0e4f09d1d23bc45b05dd6cf59e60a9e51db59.exe
Resource
win7-20221111-en
General
-
Target
bc7f0ec83577f07d0e4238401dc0e4f09d1d23bc45b05dd6cf59e60a9e51db59.exe
-
Size
452KB
-
MD5
2e3ab1bbf15e53f6b7157c2d75808562
-
SHA1
2830a10c16acfb19d06ee71c366f699068507e36
-
SHA256
bc7f0ec83577f07d0e4238401dc0e4f09d1d23bc45b05dd6cf59e60a9e51db59
-
SHA512
ac0c57ef76ce7d06a78f71f1a81335fc110265b7c3f99b1e0ceed332045044fa6442dc02b90c7b248f0381b8628ce0b3956c2a0051f3f6d87e15a93c88f24665
-
SSDEEP
12288:8mPNiMwOB3vWON7iPsPNIP4Xvfr/6kQCsfbin:8iNizOB/ECK4XvfD+Csbin
Malware Config
Extracted
darkcomet
Victim
jrusse.no-ip.org:5050
DC_MUTEX-SANCFCW
-
InstallPath
MSDCSC\msdcsc.exe
-
gencode
Xl6PgidaJaTh
-
install
true
-
offline_keylogger
true
-
persistence
true
-
reg_key
rundll32
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
Processes:
vbc.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Users\\Admin\\AppData\\Local\\Temp\\MSDCSC\\msdcsc.exe" vbc.exe -
Executes dropped EXE 1 IoCs
Processes:
msdcsc.exepid process 4244 msdcsc.exe -
Sets file to hidden 1 TTPs 2 IoCs
Modifies file attributes to stop it showing in Explorer etc.
Processes:
attrib.exeattrib.exepid process 1140 attrib.exe 1116 attrib.exe -
Uses the VBS compiler for execution 1 TTPs
-
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
vbc.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\rundll32 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\MSDCSC\\msdcsc.exe" vbc.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
bc7f0ec83577f07d0e4238401dc0e4f09d1d23bc45b05dd6cf59e60a9e51db59.exedescription pid process target process PID 728 set thread context of 4392 728 bc7f0ec83577f07d0e4238401dc0e4f09d1d23bc45b05dd6cf59e60a9e51db59.exe vbc.exe -
Drops file in Windows directory 2 IoCs
Processes:
attrib.exeattrib.exedescription ioc process File opened for modification C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe attrib.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v2.0.50727 attrib.exe -
Modifies registry class 1 IoCs
Processes:
vbc.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ vbc.exe -
Suspicious use of AdjustPrivilegeToken 24 IoCs
Processes:
vbc.exedescription pid process Token: SeIncreaseQuotaPrivilege 4392 vbc.exe Token: SeSecurityPrivilege 4392 vbc.exe Token: SeTakeOwnershipPrivilege 4392 vbc.exe Token: SeLoadDriverPrivilege 4392 vbc.exe Token: SeSystemProfilePrivilege 4392 vbc.exe Token: SeSystemtimePrivilege 4392 vbc.exe Token: SeProfSingleProcessPrivilege 4392 vbc.exe Token: SeIncBasePriorityPrivilege 4392 vbc.exe Token: SeCreatePagefilePrivilege 4392 vbc.exe Token: SeBackupPrivilege 4392 vbc.exe Token: SeRestorePrivilege 4392 vbc.exe Token: SeShutdownPrivilege 4392 vbc.exe Token: SeDebugPrivilege 4392 vbc.exe Token: SeSystemEnvironmentPrivilege 4392 vbc.exe Token: SeChangeNotifyPrivilege 4392 vbc.exe Token: SeRemoteShutdownPrivilege 4392 vbc.exe Token: SeUndockPrivilege 4392 vbc.exe Token: SeManageVolumePrivilege 4392 vbc.exe Token: SeImpersonatePrivilege 4392 vbc.exe Token: SeCreateGlobalPrivilege 4392 vbc.exe Token: 33 4392 vbc.exe Token: 34 4392 vbc.exe Token: 35 4392 vbc.exe Token: 36 4392 vbc.exe -
Suspicious use of WriteProcessMemory 29 IoCs
Processes:
bc7f0ec83577f07d0e4238401dc0e4f09d1d23bc45b05dd6cf59e60a9e51db59.exevbc.execmd.execmd.exedescription pid process target process PID 728 wrote to memory of 4392 728 bc7f0ec83577f07d0e4238401dc0e4f09d1d23bc45b05dd6cf59e60a9e51db59.exe vbc.exe PID 728 wrote to memory of 4392 728 bc7f0ec83577f07d0e4238401dc0e4f09d1d23bc45b05dd6cf59e60a9e51db59.exe vbc.exe PID 728 wrote to memory of 4392 728 bc7f0ec83577f07d0e4238401dc0e4f09d1d23bc45b05dd6cf59e60a9e51db59.exe vbc.exe PID 728 wrote to memory of 4392 728 bc7f0ec83577f07d0e4238401dc0e4f09d1d23bc45b05dd6cf59e60a9e51db59.exe vbc.exe PID 728 wrote to memory of 4392 728 bc7f0ec83577f07d0e4238401dc0e4f09d1d23bc45b05dd6cf59e60a9e51db59.exe vbc.exe PID 728 wrote to memory of 4392 728 bc7f0ec83577f07d0e4238401dc0e4f09d1d23bc45b05dd6cf59e60a9e51db59.exe vbc.exe PID 728 wrote to memory of 4392 728 bc7f0ec83577f07d0e4238401dc0e4f09d1d23bc45b05dd6cf59e60a9e51db59.exe vbc.exe PID 728 wrote to memory of 4392 728 bc7f0ec83577f07d0e4238401dc0e4f09d1d23bc45b05dd6cf59e60a9e51db59.exe vbc.exe PID 728 wrote to memory of 4392 728 bc7f0ec83577f07d0e4238401dc0e4f09d1d23bc45b05dd6cf59e60a9e51db59.exe vbc.exe PID 728 wrote to memory of 4392 728 bc7f0ec83577f07d0e4238401dc0e4f09d1d23bc45b05dd6cf59e60a9e51db59.exe vbc.exe PID 728 wrote to memory of 4392 728 bc7f0ec83577f07d0e4238401dc0e4f09d1d23bc45b05dd6cf59e60a9e51db59.exe vbc.exe PID 728 wrote to memory of 4392 728 bc7f0ec83577f07d0e4238401dc0e4f09d1d23bc45b05dd6cf59e60a9e51db59.exe vbc.exe PID 728 wrote to memory of 4392 728 bc7f0ec83577f07d0e4238401dc0e4f09d1d23bc45b05dd6cf59e60a9e51db59.exe vbc.exe PID 728 wrote to memory of 4392 728 bc7f0ec83577f07d0e4238401dc0e4f09d1d23bc45b05dd6cf59e60a9e51db59.exe vbc.exe PID 4392 wrote to memory of 2080 4392 vbc.exe cmd.exe PID 4392 wrote to memory of 2080 4392 vbc.exe cmd.exe PID 4392 wrote to memory of 2080 4392 vbc.exe cmd.exe PID 4392 wrote to memory of 1700 4392 vbc.exe cmd.exe PID 4392 wrote to memory of 1700 4392 vbc.exe cmd.exe PID 4392 wrote to memory of 1700 4392 vbc.exe cmd.exe PID 2080 wrote to memory of 1116 2080 cmd.exe attrib.exe PID 2080 wrote to memory of 1116 2080 cmd.exe attrib.exe PID 2080 wrote to memory of 1116 2080 cmd.exe attrib.exe PID 1700 wrote to memory of 1140 1700 cmd.exe attrib.exe PID 1700 wrote to memory of 1140 1700 cmd.exe attrib.exe PID 1700 wrote to memory of 1140 1700 cmd.exe attrib.exe PID 4392 wrote to memory of 4244 4392 vbc.exe msdcsc.exe PID 4392 wrote to memory of 4244 4392 vbc.exe msdcsc.exe PID 4392 wrote to memory of 4244 4392 vbc.exe msdcsc.exe -
Views/modifies file attributes 1 TTPs 2 IoCs
Processes:
attrib.exeattrib.exepid process 1140 attrib.exe 1116 attrib.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\bc7f0ec83577f07d0e4238401dc0e4f09d1d23bc45b05dd6cf59e60a9e51db59.exe"C:\Users\Admin\AppData\Local\Temp\bc7f0ec83577f07d0e4238401dc0e4f09d1d23bc45b05dd6cf59e60a9e51db59.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"2⤵
- Modifies WinLogon for persistence
- Adds Run key to start application
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" +s +h3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" +s +h4⤵
- Sets file to hidden
- Drops file in Windows directory
- Views/modifies file attributes
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\Microsoft.NET\Framework\v2.0.50727" +s +h3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\Microsoft.NET\Framework\v2.0.50727" +s +h4⤵
- Sets file to hidden
- Drops file in Windows directory
- Views/modifies file attributes
-
C:\Users\Admin\AppData\Local\Temp\MSDCSC\msdcsc.exe"C:\Users\Admin\AppData\Local\Temp\MSDCSC\msdcsc.exe"3⤵
- Executes dropped EXE
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\MSDCSC\msdcsc.exeFilesize
1.1MB
MD5d881de17aa8f2e2c08cbb7b265f928f9
SHA108936aebc87decf0af6e8eada191062b5e65ac2a
SHA256b3a37093609f9a20ad60b85a9fa9de2ba674cba9b5bd687729440c70ba619ca0
SHA5125f23bfb1b8740247b36ed0ab741738c7d4c949736129e767213e321607d1ccd3e3a8428e4ba44bd28a275b5e3f6206285b1a522514b7ef7ea5e698d90a713d34
-
C:\Users\Admin\AppData\Local\Temp\MSDCSC\msdcsc.exeFilesize
1.1MB
MD5d881de17aa8f2e2c08cbb7b265f928f9
SHA108936aebc87decf0af6e8eada191062b5e65ac2a
SHA256b3a37093609f9a20ad60b85a9fa9de2ba674cba9b5bd687729440c70ba619ca0
SHA5125f23bfb1b8740247b36ed0ab741738c7d4c949736129e767213e321607d1ccd3e3a8428e4ba44bd28a275b5e3f6206285b1a522514b7ef7ea5e698d90a713d34
-
memory/728-146-0x0000000074C60000-0x0000000075211000-memory.dmpFilesize
5.7MB
-
memory/728-132-0x0000000074C60000-0x0000000075211000-memory.dmpFilesize
5.7MB
-
memory/1116-150-0x0000000000000000-mapping.dmp
-
memory/1140-151-0x0000000000000000-mapping.dmp
-
memory/1700-149-0x0000000000000000-mapping.dmp
-
memory/2080-148-0x0000000000000000-mapping.dmp
-
memory/4244-152-0x0000000000000000-mapping.dmp
-
memory/4392-138-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/4392-145-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/4392-144-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/4392-147-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/4392-142-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/4392-141-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/4392-140-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/4392-136-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/4392-135-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/4392-134-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/4392-133-0x0000000000000000-mapping.dmp
-
memory/4392-155-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB