Analysis
-
max time kernel
150s -
max time network
34s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
24-11-2022 03:56
Behavioral task
behavioral1
Sample
3226f5e44317bd84e9ea048972e42b756a856c358defe87e737fc02e4f9ad78f.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
3226f5e44317bd84e9ea048972e42b756a856c358defe87e737fc02e4f9ad78f.exe
Resource
win10v2004-20220812-en
General
-
Target
3226f5e44317bd84e9ea048972e42b756a856c358defe87e737fc02e4f9ad78f.exe
-
Size
658KB
-
MD5
41140b64da737d999d6b06763b8de287
-
SHA1
ec5ebd2a21e81961b97f8ddbde0ac5b28b452f49
-
SHA256
3226f5e44317bd84e9ea048972e42b756a856c358defe87e737fc02e4f9ad78f
-
SHA512
dd880450a8b477b24801dd8e1b067b1b7a0604367ac8c861aad86a89270507ee5dfc989f382ca633908e41949e5561860e5991f69ba2cab356915df095f84c50
-
SSDEEP
12288:y9HFJ9rJxRX1uVVjoaWSoynxdO1FVBaOiRZTERfIhNkNCCLo9Ek5C/ht:eZ1xuVVjfFoynPaVBUR8f+kN10EBr
Malware Config
Extracted
darkcomet
asdf
noname1231.no-ip.org:1604
DCMIN_MUTEX-2XGL6JH
-
InstallPath
DCSCMIN\IMDCSC.exe
-
gencode
hDbhnXrnGv4R
-
install
true
-
offline_keylogger
true
-
persistence
false
-
reg_key
DarkComet RAT
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
Processes:
3226f5e44317bd84e9ea048972e42b756a856c358defe87e737fc02e4f9ad78f.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Users\\Admin\\Documents\\DCSCMIN\\IMDCSC.exe" 3226f5e44317bd84e9ea048972e42b756a856c358defe87e737fc02e4f9ad78f.exe -
Executes dropped EXE 1 IoCs
Processes:
IMDCSC.exepid process 680 IMDCSC.exe -
Loads dropped DLL 2 IoCs
Processes:
3226f5e44317bd84e9ea048972e42b756a856c358defe87e737fc02e4f9ad78f.exepid process 1756 3226f5e44317bd84e9ea048972e42b756a856c358defe87e737fc02e4f9ad78f.exe 1756 3226f5e44317bd84e9ea048972e42b756a856c358defe87e737fc02e4f9ad78f.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
3226f5e44317bd84e9ea048972e42b756a856c358defe87e737fc02e4f9ad78f.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Run\DarkComet RAT = "C:\\Users\\Admin\\Documents\\DCSCMIN\\IMDCSC.exe" 3226f5e44317bd84e9ea048972e42b756a856c358defe87e737fc02e4f9ad78f.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of AdjustPrivilegeToken 46 IoCs
Processes:
3226f5e44317bd84e9ea048972e42b756a856c358defe87e737fc02e4f9ad78f.exeIMDCSC.exedescription pid process Token: SeIncreaseQuotaPrivilege 1756 3226f5e44317bd84e9ea048972e42b756a856c358defe87e737fc02e4f9ad78f.exe Token: SeSecurityPrivilege 1756 3226f5e44317bd84e9ea048972e42b756a856c358defe87e737fc02e4f9ad78f.exe Token: SeTakeOwnershipPrivilege 1756 3226f5e44317bd84e9ea048972e42b756a856c358defe87e737fc02e4f9ad78f.exe Token: SeLoadDriverPrivilege 1756 3226f5e44317bd84e9ea048972e42b756a856c358defe87e737fc02e4f9ad78f.exe Token: SeSystemProfilePrivilege 1756 3226f5e44317bd84e9ea048972e42b756a856c358defe87e737fc02e4f9ad78f.exe Token: SeSystemtimePrivilege 1756 3226f5e44317bd84e9ea048972e42b756a856c358defe87e737fc02e4f9ad78f.exe Token: SeProfSingleProcessPrivilege 1756 3226f5e44317bd84e9ea048972e42b756a856c358defe87e737fc02e4f9ad78f.exe Token: SeIncBasePriorityPrivilege 1756 3226f5e44317bd84e9ea048972e42b756a856c358defe87e737fc02e4f9ad78f.exe Token: SeCreatePagefilePrivilege 1756 3226f5e44317bd84e9ea048972e42b756a856c358defe87e737fc02e4f9ad78f.exe Token: SeBackupPrivilege 1756 3226f5e44317bd84e9ea048972e42b756a856c358defe87e737fc02e4f9ad78f.exe Token: SeRestorePrivilege 1756 3226f5e44317bd84e9ea048972e42b756a856c358defe87e737fc02e4f9ad78f.exe Token: SeShutdownPrivilege 1756 3226f5e44317bd84e9ea048972e42b756a856c358defe87e737fc02e4f9ad78f.exe Token: SeDebugPrivilege 1756 3226f5e44317bd84e9ea048972e42b756a856c358defe87e737fc02e4f9ad78f.exe Token: SeSystemEnvironmentPrivilege 1756 3226f5e44317bd84e9ea048972e42b756a856c358defe87e737fc02e4f9ad78f.exe Token: SeChangeNotifyPrivilege 1756 3226f5e44317bd84e9ea048972e42b756a856c358defe87e737fc02e4f9ad78f.exe Token: SeRemoteShutdownPrivilege 1756 3226f5e44317bd84e9ea048972e42b756a856c358defe87e737fc02e4f9ad78f.exe Token: SeUndockPrivilege 1756 3226f5e44317bd84e9ea048972e42b756a856c358defe87e737fc02e4f9ad78f.exe Token: SeManageVolumePrivilege 1756 3226f5e44317bd84e9ea048972e42b756a856c358defe87e737fc02e4f9ad78f.exe Token: SeImpersonatePrivilege 1756 3226f5e44317bd84e9ea048972e42b756a856c358defe87e737fc02e4f9ad78f.exe Token: SeCreateGlobalPrivilege 1756 3226f5e44317bd84e9ea048972e42b756a856c358defe87e737fc02e4f9ad78f.exe Token: 33 1756 3226f5e44317bd84e9ea048972e42b756a856c358defe87e737fc02e4f9ad78f.exe Token: 34 1756 3226f5e44317bd84e9ea048972e42b756a856c358defe87e737fc02e4f9ad78f.exe Token: 35 1756 3226f5e44317bd84e9ea048972e42b756a856c358defe87e737fc02e4f9ad78f.exe Token: SeIncreaseQuotaPrivilege 680 IMDCSC.exe Token: SeSecurityPrivilege 680 IMDCSC.exe Token: SeTakeOwnershipPrivilege 680 IMDCSC.exe Token: SeLoadDriverPrivilege 680 IMDCSC.exe Token: SeSystemProfilePrivilege 680 IMDCSC.exe Token: SeSystemtimePrivilege 680 IMDCSC.exe Token: SeProfSingleProcessPrivilege 680 IMDCSC.exe Token: SeIncBasePriorityPrivilege 680 IMDCSC.exe Token: SeCreatePagefilePrivilege 680 IMDCSC.exe Token: SeBackupPrivilege 680 IMDCSC.exe Token: SeRestorePrivilege 680 IMDCSC.exe Token: SeShutdownPrivilege 680 IMDCSC.exe Token: SeDebugPrivilege 680 IMDCSC.exe Token: SeSystemEnvironmentPrivilege 680 IMDCSC.exe Token: SeChangeNotifyPrivilege 680 IMDCSC.exe Token: SeRemoteShutdownPrivilege 680 IMDCSC.exe Token: SeUndockPrivilege 680 IMDCSC.exe Token: SeManageVolumePrivilege 680 IMDCSC.exe Token: SeImpersonatePrivilege 680 IMDCSC.exe Token: SeCreateGlobalPrivilege 680 IMDCSC.exe Token: 33 680 IMDCSC.exe Token: 34 680 IMDCSC.exe Token: 35 680 IMDCSC.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
IMDCSC.exepid process 680 IMDCSC.exe -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
3226f5e44317bd84e9ea048972e42b756a856c358defe87e737fc02e4f9ad78f.exedescription pid process target process PID 1756 wrote to memory of 680 1756 3226f5e44317bd84e9ea048972e42b756a856c358defe87e737fc02e4f9ad78f.exe IMDCSC.exe PID 1756 wrote to memory of 680 1756 3226f5e44317bd84e9ea048972e42b756a856c358defe87e737fc02e4f9ad78f.exe IMDCSC.exe PID 1756 wrote to memory of 680 1756 3226f5e44317bd84e9ea048972e42b756a856c358defe87e737fc02e4f9ad78f.exe IMDCSC.exe PID 1756 wrote to memory of 680 1756 3226f5e44317bd84e9ea048972e42b756a856c358defe87e737fc02e4f9ad78f.exe IMDCSC.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\3226f5e44317bd84e9ea048972e42b756a856c358defe87e737fc02e4f9ad78f.exe"C:\Users\Admin\AppData\Local\Temp\3226f5e44317bd84e9ea048972e42b756a856c358defe87e737fc02e4f9ad78f.exe"1⤵
- Modifies WinLogon for persistence
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1756 -
C:\Users\Admin\Documents\DCSCMIN\IMDCSC.exe"C:\Users\Admin\Documents\DCSCMIN\IMDCSC.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:680
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
658KB
MD541140b64da737d999d6b06763b8de287
SHA1ec5ebd2a21e81961b97f8ddbde0ac5b28b452f49
SHA2563226f5e44317bd84e9ea048972e42b756a856c358defe87e737fc02e4f9ad78f
SHA512dd880450a8b477b24801dd8e1b067b1b7a0604367ac8c861aad86a89270507ee5dfc989f382ca633908e41949e5561860e5991f69ba2cab356915df095f84c50
-
Filesize
658KB
MD541140b64da737d999d6b06763b8de287
SHA1ec5ebd2a21e81961b97f8ddbde0ac5b28b452f49
SHA2563226f5e44317bd84e9ea048972e42b756a856c358defe87e737fc02e4f9ad78f
SHA512dd880450a8b477b24801dd8e1b067b1b7a0604367ac8c861aad86a89270507ee5dfc989f382ca633908e41949e5561860e5991f69ba2cab356915df095f84c50
-
Filesize
658KB
MD541140b64da737d999d6b06763b8de287
SHA1ec5ebd2a21e81961b97f8ddbde0ac5b28b452f49
SHA2563226f5e44317bd84e9ea048972e42b756a856c358defe87e737fc02e4f9ad78f
SHA512dd880450a8b477b24801dd8e1b067b1b7a0604367ac8c861aad86a89270507ee5dfc989f382ca633908e41949e5561860e5991f69ba2cab356915df095f84c50
-
Filesize
658KB
MD541140b64da737d999d6b06763b8de287
SHA1ec5ebd2a21e81961b97f8ddbde0ac5b28b452f49
SHA2563226f5e44317bd84e9ea048972e42b756a856c358defe87e737fc02e4f9ad78f
SHA512dd880450a8b477b24801dd8e1b067b1b7a0604367ac8c861aad86a89270507ee5dfc989f382ca633908e41949e5561860e5991f69ba2cab356915df095f84c50