Analysis
-
max time kernel
146s -
max time network
177s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
23-11-2022 15:55
Static task
static1
Behavioral task
behavioral1
Sample
2c9f925fbe8a4fff4ec605d0fab5af44f7b5f5b97b3063b27a7a598685292aa7.exe
Resource
win7-20220901-en
General
-
Target
2c9f925fbe8a4fff4ec605d0fab5af44f7b5f5b97b3063b27a7a598685292aa7.exe
-
Size
464KB
-
MD5
455a2fad3532faddf2835a8022988081
-
SHA1
8d5d184f381a175fff723458fda8999bde0d9438
-
SHA256
2c9f925fbe8a4fff4ec605d0fab5af44f7b5f5b97b3063b27a7a598685292aa7
-
SHA512
e6559c5076ec9d4ccdff2926fa5161b398c462457c6242cd079dfeecc263bc7d1d0b319397aa0d2f6a10579966aa5b020bccd1dc48bf2335c6b266268113cb2f
-
SSDEEP
6144:f2+6gLCdeFBHGz1iRkHDQA9v+bxcawGTZuUG6CAzQIQn:hadeFdK1iSjQQ2cawQkUG63M
Malware Config
Extracted
darkcomet
Guest16
212.253.69.142:81
DC_MUTEX-TVELAZ0
-
InstallPath
MSDCSC\msdcsc.exe
-
gencode
j9iS5ANHsKQh
-
install
true
-
offline_keylogger
true
-
persistence
false
-
reg_key
MicroUpdate
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
Processes:
2c9f925fbe8a4fff4ec605d0fab5af44f7b5f5b97b3063b27a7a598685292aa7.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Users\\Admin\\Documents\\MSDCSC\\msdcsc.exe" 2c9f925fbe8a4fff4ec605d0fab5af44f7b5f5b97b3063b27a7a598685292aa7.exe -
Modifies security service 2 TTPs 1 IoCs
Processes:
msdcsc.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wscsvc\Start = "4" msdcsc.exe -
Processes:
msdcsc.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" msdcsc.exe -
Executes dropped EXE 2 IoCs
Processes:
msdcsc.exemsdcsc.exepid process 1780 msdcsc.exe 1940 msdcsc.exe -
Processes:
resource yara_rule behavioral2/memory/1844-135-0x0000000000400000-0x00000000004B7000-memory.dmp upx behavioral2/memory/1844-136-0x0000000000400000-0x00000000004B7000-memory.dmp upx behavioral2/memory/1844-137-0x0000000000400000-0x00000000004B7000-memory.dmp upx behavioral2/memory/1844-138-0x0000000000400000-0x00000000004B7000-memory.dmp upx behavioral2/memory/1844-139-0x0000000000400000-0x00000000004B7000-memory.dmp upx behavioral2/memory/1940-151-0x0000000000400000-0x00000000004B7000-memory.dmp upx behavioral2/memory/1844-152-0x0000000000400000-0x00000000004B7000-memory.dmp upx behavioral2/memory/1940-153-0x0000000000400000-0x00000000004B7000-memory.dmp upx -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
2c9f925fbe8a4fff4ec605d0fab5af44f7b5f5b97b3063b27a7a598685292aa7.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation 2c9f925fbe8a4fff4ec605d0fab5af44f7b5f5b97b3063b27a7a598685292aa7.exe -
Processes:
msdcsc.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" msdcsc.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
2c9f925fbe8a4fff4ec605d0fab5af44f7b5f5b97b3063b27a7a598685292aa7.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Users\\Admin\\Documents\\MSDCSC\\msdcsc.exe" 2c9f925fbe8a4fff4ec605d0fab5af44f7b5f5b97b3063b27a7a598685292aa7.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
2c9f925fbe8a4fff4ec605d0fab5af44f7b5f5b97b3063b27a7a598685292aa7.exemsdcsc.exedescription pid process target process PID 388 set thread context of 1844 388 2c9f925fbe8a4fff4ec605d0fab5af44f7b5f5b97b3063b27a7a598685292aa7.exe 2c9f925fbe8a4fff4ec605d0fab5af44f7b5f5b97b3063b27a7a598685292aa7.exe PID 1780 set thread context of 1940 1780 msdcsc.exe msdcsc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Modifies registry class 1 IoCs
Processes:
2c9f925fbe8a4fff4ec605d0fab5af44f7b5f5b97b3063b27a7a598685292aa7.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ 2c9f925fbe8a4fff4ec605d0fab5af44f7b5f5b97b3063b27a7a598685292aa7.exe -
Suspicious use of AdjustPrivilegeToken 48 IoCs
Processes:
2c9f925fbe8a4fff4ec605d0fab5af44f7b5f5b97b3063b27a7a598685292aa7.exemsdcsc.exedescription pid process Token: SeIncreaseQuotaPrivilege 1844 2c9f925fbe8a4fff4ec605d0fab5af44f7b5f5b97b3063b27a7a598685292aa7.exe Token: SeSecurityPrivilege 1844 2c9f925fbe8a4fff4ec605d0fab5af44f7b5f5b97b3063b27a7a598685292aa7.exe Token: SeTakeOwnershipPrivilege 1844 2c9f925fbe8a4fff4ec605d0fab5af44f7b5f5b97b3063b27a7a598685292aa7.exe Token: SeLoadDriverPrivilege 1844 2c9f925fbe8a4fff4ec605d0fab5af44f7b5f5b97b3063b27a7a598685292aa7.exe Token: SeSystemProfilePrivilege 1844 2c9f925fbe8a4fff4ec605d0fab5af44f7b5f5b97b3063b27a7a598685292aa7.exe Token: SeSystemtimePrivilege 1844 2c9f925fbe8a4fff4ec605d0fab5af44f7b5f5b97b3063b27a7a598685292aa7.exe Token: SeProfSingleProcessPrivilege 1844 2c9f925fbe8a4fff4ec605d0fab5af44f7b5f5b97b3063b27a7a598685292aa7.exe Token: SeIncBasePriorityPrivilege 1844 2c9f925fbe8a4fff4ec605d0fab5af44f7b5f5b97b3063b27a7a598685292aa7.exe Token: SeCreatePagefilePrivilege 1844 2c9f925fbe8a4fff4ec605d0fab5af44f7b5f5b97b3063b27a7a598685292aa7.exe Token: SeBackupPrivilege 1844 2c9f925fbe8a4fff4ec605d0fab5af44f7b5f5b97b3063b27a7a598685292aa7.exe Token: SeRestorePrivilege 1844 2c9f925fbe8a4fff4ec605d0fab5af44f7b5f5b97b3063b27a7a598685292aa7.exe Token: SeShutdownPrivilege 1844 2c9f925fbe8a4fff4ec605d0fab5af44f7b5f5b97b3063b27a7a598685292aa7.exe Token: SeDebugPrivilege 1844 2c9f925fbe8a4fff4ec605d0fab5af44f7b5f5b97b3063b27a7a598685292aa7.exe Token: SeSystemEnvironmentPrivilege 1844 2c9f925fbe8a4fff4ec605d0fab5af44f7b5f5b97b3063b27a7a598685292aa7.exe Token: SeChangeNotifyPrivilege 1844 2c9f925fbe8a4fff4ec605d0fab5af44f7b5f5b97b3063b27a7a598685292aa7.exe Token: SeRemoteShutdownPrivilege 1844 2c9f925fbe8a4fff4ec605d0fab5af44f7b5f5b97b3063b27a7a598685292aa7.exe Token: SeUndockPrivilege 1844 2c9f925fbe8a4fff4ec605d0fab5af44f7b5f5b97b3063b27a7a598685292aa7.exe Token: SeManageVolumePrivilege 1844 2c9f925fbe8a4fff4ec605d0fab5af44f7b5f5b97b3063b27a7a598685292aa7.exe Token: SeImpersonatePrivilege 1844 2c9f925fbe8a4fff4ec605d0fab5af44f7b5f5b97b3063b27a7a598685292aa7.exe Token: SeCreateGlobalPrivilege 1844 2c9f925fbe8a4fff4ec605d0fab5af44f7b5f5b97b3063b27a7a598685292aa7.exe Token: 33 1844 2c9f925fbe8a4fff4ec605d0fab5af44f7b5f5b97b3063b27a7a598685292aa7.exe Token: 34 1844 2c9f925fbe8a4fff4ec605d0fab5af44f7b5f5b97b3063b27a7a598685292aa7.exe Token: 35 1844 2c9f925fbe8a4fff4ec605d0fab5af44f7b5f5b97b3063b27a7a598685292aa7.exe Token: 36 1844 2c9f925fbe8a4fff4ec605d0fab5af44f7b5f5b97b3063b27a7a598685292aa7.exe Token: SeIncreaseQuotaPrivilege 1940 msdcsc.exe Token: SeSecurityPrivilege 1940 msdcsc.exe Token: SeTakeOwnershipPrivilege 1940 msdcsc.exe Token: SeLoadDriverPrivilege 1940 msdcsc.exe Token: SeSystemProfilePrivilege 1940 msdcsc.exe Token: SeSystemtimePrivilege 1940 msdcsc.exe Token: SeProfSingleProcessPrivilege 1940 msdcsc.exe Token: SeIncBasePriorityPrivilege 1940 msdcsc.exe Token: SeCreatePagefilePrivilege 1940 msdcsc.exe Token: SeBackupPrivilege 1940 msdcsc.exe Token: SeRestorePrivilege 1940 msdcsc.exe Token: SeShutdownPrivilege 1940 msdcsc.exe Token: SeDebugPrivilege 1940 msdcsc.exe Token: SeSystemEnvironmentPrivilege 1940 msdcsc.exe Token: SeChangeNotifyPrivilege 1940 msdcsc.exe Token: SeRemoteShutdownPrivilege 1940 msdcsc.exe Token: SeUndockPrivilege 1940 msdcsc.exe Token: SeManageVolumePrivilege 1940 msdcsc.exe Token: SeImpersonatePrivilege 1940 msdcsc.exe Token: SeCreateGlobalPrivilege 1940 msdcsc.exe Token: 33 1940 msdcsc.exe Token: 34 1940 msdcsc.exe Token: 35 1940 msdcsc.exe Token: 36 1940 msdcsc.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
Processes:
2c9f925fbe8a4fff4ec605d0fab5af44f7b5f5b97b3063b27a7a598685292aa7.exemsdcsc.exemsdcsc.exepid process 388 2c9f925fbe8a4fff4ec605d0fab5af44f7b5f5b97b3063b27a7a598685292aa7.exe 1780 msdcsc.exe 1940 msdcsc.exe -
Suspicious use of WriteProcessMemory 19 IoCs
Processes:
2c9f925fbe8a4fff4ec605d0fab5af44f7b5f5b97b3063b27a7a598685292aa7.exe2c9f925fbe8a4fff4ec605d0fab5af44f7b5f5b97b3063b27a7a598685292aa7.exemsdcsc.exedescription pid process target process PID 388 wrote to memory of 1844 388 2c9f925fbe8a4fff4ec605d0fab5af44f7b5f5b97b3063b27a7a598685292aa7.exe 2c9f925fbe8a4fff4ec605d0fab5af44f7b5f5b97b3063b27a7a598685292aa7.exe PID 388 wrote to memory of 1844 388 2c9f925fbe8a4fff4ec605d0fab5af44f7b5f5b97b3063b27a7a598685292aa7.exe 2c9f925fbe8a4fff4ec605d0fab5af44f7b5f5b97b3063b27a7a598685292aa7.exe PID 388 wrote to memory of 1844 388 2c9f925fbe8a4fff4ec605d0fab5af44f7b5f5b97b3063b27a7a598685292aa7.exe 2c9f925fbe8a4fff4ec605d0fab5af44f7b5f5b97b3063b27a7a598685292aa7.exe PID 388 wrote to memory of 1844 388 2c9f925fbe8a4fff4ec605d0fab5af44f7b5f5b97b3063b27a7a598685292aa7.exe 2c9f925fbe8a4fff4ec605d0fab5af44f7b5f5b97b3063b27a7a598685292aa7.exe PID 388 wrote to memory of 1844 388 2c9f925fbe8a4fff4ec605d0fab5af44f7b5f5b97b3063b27a7a598685292aa7.exe 2c9f925fbe8a4fff4ec605d0fab5af44f7b5f5b97b3063b27a7a598685292aa7.exe PID 388 wrote to memory of 1844 388 2c9f925fbe8a4fff4ec605d0fab5af44f7b5f5b97b3063b27a7a598685292aa7.exe 2c9f925fbe8a4fff4ec605d0fab5af44f7b5f5b97b3063b27a7a598685292aa7.exe PID 388 wrote to memory of 1844 388 2c9f925fbe8a4fff4ec605d0fab5af44f7b5f5b97b3063b27a7a598685292aa7.exe 2c9f925fbe8a4fff4ec605d0fab5af44f7b5f5b97b3063b27a7a598685292aa7.exe PID 388 wrote to memory of 1844 388 2c9f925fbe8a4fff4ec605d0fab5af44f7b5f5b97b3063b27a7a598685292aa7.exe 2c9f925fbe8a4fff4ec605d0fab5af44f7b5f5b97b3063b27a7a598685292aa7.exe PID 1844 wrote to memory of 1780 1844 2c9f925fbe8a4fff4ec605d0fab5af44f7b5f5b97b3063b27a7a598685292aa7.exe msdcsc.exe PID 1844 wrote to memory of 1780 1844 2c9f925fbe8a4fff4ec605d0fab5af44f7b5f5b97b3063b27a7a598685292aa7.exe msdcsc.exe PID 1844 wrote to memory of 1780 1844 2c9f925fbe8a4fff4ec605d0fab5af44f7b5f5b97b3063b27a7a598685292aa7.exe msdcsc.exe PID 1780 wrote to memory of 1940 1780 msdcsc.exe msdcsc.exe PID 1780 wrote to memory of 1940 1780 msdcsc.exe msdcsc.exe PID 1780 wrote to memory of 1940 1780 msdcsc.exe msdcsc.exe PID 1780 wrote to memory of 1940 1780 msdcsc.exe msdcsc.exe PID 1780 wrote to memory of 1940 1780 msdcsc.exe msdcsc.exe PID 1780 wrote to memory of 1940 1780 msdcsc.exe msdcsc.exe PID 1780 wrote to memory of 1940 1780 msdcsc.exe msdcsc.exe PID 1780 wrote to memory of 1940 1780 msdcsc.exe msdcsc.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2c9f925fbe8a4fff4ec605d0fab5af44f7b5f5b97b3063b27a7a598685292aa7.exe"C:\Users\Admin\AppData\Local\Temp\2c9f925fbe8a4fff4ec605d0fab5af44f7b5f5b97b3063b27a7a598685292aa7.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2c9f925fbe8a4fff4ec605d0fab5af44f7b5f5b97b3063b27a7a598685292aa7.exe"C:\Users\Admin\AppData\Local\Temp\2c9f925fbe8a4fff4ec605d0fab5af44f7b5f5b97b3063b27a7a598685292aa7.exe"2⤵
- Modifies WinLogon for persistence
- Checks computer location settings
- Adds Run key to start application
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\Documents\MSDCSC\msdcsc.exe"C:\Users\Admin\Documents\MSDCSC\msdcsc.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\Documents\MSDCSC\msdcsc.exe"C:\Users\Admin\Documents\MSDCSC\msdcsc.exe"4⤵
- Modifies security service
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\Documents\MSDCSC\msdcsc.exeFilesize
464KB
MD5455a2fad3532faddf2835a8022988081
SHA18d5d184f381a175fff723458fda8999bde0d9438
SHA2562c9f925fbe8a4fff4ec605d0fab5af44f7b5f5b97b3063b27a7a598685292aa7
SHA512e6559c5076ec9d4ccdff2926fa5161b398c462457c6242cd079dfeecc263bc7d1d0b319397aa0d2f6a10579966aa5b020bccd1dc48bf2335c6b266268113cb2f
-
C:\Users\Admin\Documents\MSDCSC\msdcsc.exeFilesize
464KB
MD5455a2fad3532faddf2835a8022988081
SHA18d5d184f381a175fff723458fda8999bde0d9438
SHA2562c9f925fbe8a4fff4ec605d0fab5af44f7b5f5b97b3063b27a7a598685292aa7
SHA512e6559c5076ec9d4ccdff2926fa5161b398c462457c6242cd079dfeecc263bc7d1d0b319397aa0d2f6a10579966aa5b020bccd1dc48bf2335c6b266268113cb2f
-
C:\Users\Admin\Documents\MSDCSC\msdcsc.exeFilesize
464KB
MD5455a2fad3532faddf2835a8022988081
SHA18d5d184f381a175fff723458fda8999bde0d9438
SHA2562c9f925fbe8a4fff4ec605d0fab5af44f7b5f5b97b3063b27a7a598685292aa7
SHA512e6559c5076ec9d4ccdff2926fa5161b398c462457c6242cd079dfeecc263bc7d1d0b319397aa0d2f6a10579966aa5b020bccd1dc48bf2335c6b266268113cb2f
-
memory/1780-140-0x0000000000000000-mapping.dmp
-
memory/1844-137-0x0000000000400000-0x00000000004B7000-memory.dmpFilesize
732KB
-
memory/1844-139-0x0000000000400000-0x00000000004B7000-memory.dmpFilesize
732KB
-
memory/1844-138-0x0000000000400000-0x00000000004B7000-memory.dmpFilesize
732KB
-
memory/1844-134-0x0000000000000000-mapping.dmp
-
memory/1844-136-0x0000000000400000-0x00000000004B7000-memory.dmpFilesize
732KB
-
memory/1844-135-0x0000000000400000-0x00000000004B7000-memory.dmpFilesize
732KB
-
memory/1844-152-0x0000000000400000-0x00000000004B7000-memory.dmpFilesize
732KB
-
memory/1940-145-0x0000000000000000-mapping.dmp
-
memory/1940-151-0x0000000000400000-0x00000000004B7000-memory.dmpFilesize
732KB
-
memory/1940-153-0x0000000000400000-0x00000000004B7000-memory.dmpFilesize
732KB