Analysis
-
max time kernel
148s -
max time network
47s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
25-11-2022 22:57
Behavioral task
behavioral1
Sample
2cfe915e1498dd8ac3643ddc5812f5731d6ecc7d0efde6ad9a9bf35bcb735d0a.exe
Resource
win7-20220812-en
General
-
Target
2cfe915e1498dd8ac3643ddc5812f5731d6ecc7d0efde6ad9a9bf35bcb735d0a.exe
-
Size
5.5MB
-
MD5
564218aa29b51a220144e9d060d1252a
-
SHA1
9168cca0beea91546fb15a7b936e66d1668015e1
-
SHA256
2cfe915e1498dd8ac3643ddc5812f5731d6ecc7d0efde6ad9a9bf35bcb735d0a
-
SHA512
2cd1418e7611b40c524a01d8e3ba6684c96b462690b0915c807ddb60b5d49090125e8fdc8c4bffc435d1add68d82d4094d48c74bd689f00e05d486cbfe6c03bc
-
SSDEEP
98304:rwaQ8ZDJgyslyzoXmaErfYCNmkv5D2PFpuxvnkyyhAuax5O1RVidVSe8+QU/:rwaQ8ZDJw/WdftNnv5D29p0kyVuaO1Rn
Malware Config
Extracted
darkcomet
Danijela
jebozovan.no-ip.org:81
DC_MUTEX-KQRQZPG
-
InstallPath
MSDCSC\msdcsc.exe
-
gencode
v7PAnw881ZWq
-
install
true
-
offline_keylogger
true
-
persistence
true
-
reg_key
MicroUpdate
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
Processes:
MP4.EXEdescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Users\\Admin\\Documents\\MSDCSC\\msdcsc.exe" MP4.EXE -
Executes dropped EXE 2 IoCs
Processes:
MP4.EXEmsdcsc.exepid process 1752 MP4.EXE 1608 msdcsc.exe -
Sets file to hidden 1 TTPs 2 IoCs
Modifies file attributes to stop it showing in Explorer etc.
Processes:
attrib.exeattrib.exepid process 1344 attrib.exe 1700 attrib.exe -
Loads dropped DLL 4 IoCs
Processes:
2cfe915e1498dd8ac3643ddc5812f5731d6ecc7d0efde6ad9a9bf35bcb735d0a.exeMP4.EXEpid process 1732 2cfe915e1498dd8ac3643ddc5812f5731d6ecc7d0efde6ad9a9bf35bcb735d0a.exe 1732 2cfe915e1498dd8ac3643ddc5812f5731d6ecc7d0efde6ad9a9bf35bcb735d0a.exe 1752 MP4.EXE 1752 MP4.EXE -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
MP4.EXEmsdcsc.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Users\\Admin\\Documents\\MSDCSC\\msdcsc.exe" MP4.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Users\\Admin\\Documents\\MSDCSC\\msdcsc.exe" msdcsc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
vlc.exepid process 960 vlc.exe -
Suspicious behavior: GetForegroundWindowSpam 2 IoCs
Processes:
vlc.exemsdcsc.exepid process 960 vlc.exe 1608 msdcsc.exe -
Suspicious use of AdjustPrivilegeToken 52 IoCs
Processes:
MP4.EXEmsdcsc.exeAUDIODG.EXEvlc.exedescription pid process Token: SeIncreaseQuotaPrivilege 1752 MP4.EXE Token: SeSecurityPrivilege 1752 MP4.EXE Token: SeTakeOwnershipPrivilege 1752 MP4.EXE Token: SeLoadDriverPrivilege 1752 MP4.EXE Token: SeSystemProfilePrivilege 1752 MP4.EXE Token: SeSystemtimePrivilege 1752 MP4.EXE Token: SeProfSingleProcessPrivilege 1752 MP4.EXE Token: SeIncBasePriorityPrivilege 1752 MP4.EXE Token: SeCreatePagefilePrivilege 1752 MP4.EXE Token: SeBackupPrivilege 1752 MP4.EXE Token: SeRestorePrivilege 1752 MP4.EXE Token: SeShutdownPrivilege 1752 MP4.EXE Token: SeDebugPrivilege 1752 MP4.EXE Token: SeSystemEnvironmentPrivilege 1752 MP4.EXE Token: SeChangeNotifyPrivilege 1752 MP4.EXE Token: SeRemoteShutdownPrivilege 1752 MP4.EXE Token: SeUndockPrivilege 1752 MP4.EXE Token: SeManageVolumePrivilege 1752 MP4.EXE Token: SeImpersonatePrivilege 1752 MP4.EXE Token: SeCreateGlobalPrivilege 1752 MP4.EXE Token: 33 1752 MP4.EXE Token: 34 1752 MP4.EXE Token: 35 1752 MP4.EXE Token: SeIncreaseQuotaPrivilege 1608 msdcsc.exe Token: SeSecurityPrivilege 1608 msdcsc.exe Token: SeTakeOwnershipPrivilege 1608 msdcsc.exe Token: SeLoadDriverPrivilege 1608 msdcsc.exe Token: SeSystemProfilePrivilege 1608 msdcsc.exe Token: SeSystemtimePrivilege 1608 msdcsc.exe Token: SeProfSingleProcessPrivilege 1608 msdcsc.exe Token: SeIncBasePriorityPrivilege 1608 msdcsc.exe Token: SeCreatePagefilePrivilege 1608 msdcsc.exe Token: SeBackupPrivilege 1608 msdcsc.exe Token: SeRestorePrivilege 1608 msdcsc.exe Token: SeShutdownPrivilege 1608 msdcsc.exe Token: SeDebugPrivilege 1608 msdcsc.exe Token: SeSystemEnvironmentPrivilege 1608 msdcsc.exe Token: SeChangeNotifyPrivilege 1608 msdcsc.exe Token: SeRemoteShutdownPrivilege 1608 msdcsc.exe Token: SeUndockPrivilege 1608 msdcsc.exe Token: SeManageVolumePrivilege 1608 msdcsc.exe Token: SeImpersonatePrivilege 1608 msdcsc.exe Token: SeCreateGlobalPrivilege 1608 msdcsc.exe Token: 33 1608 msdcsc.exe Token: 34 1608 msdcsc.exe Token: 35 1608 msdcsc.exe Token: 33 808 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 808 AUDIODG.EXE Token: 33 808 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 808 AUDIODG.EXE Token: 33 960 vlc.exe Token: SeIncBasePriorityPrivilege 960 vlc.exe -
Suspicious use of FindShellTrayWindow 28 IoCs
Processes:
vlc.exepid process 960 vlc.exe 960 vlc.exe 960 vlc.exe 960 vlc.exe 960 vlc.exe 960 vlc.exe 960 vlc.exe 960 vlc.exe 960 vlc.exe 960 vlc.exe 960 vlc.exe 960 vlc.exe 960 vlc.exe 960 vlc.exe 960 vlc.exe 960 vlc.exe 960 vlc.exe 960 vlc.exe 960 vlc.exe 960 vlc.exe 960 vlc.exe 960 vlc.exe 960 vlc.exe 960 vlc.exe 960 vlc.exe 960 vlc.exe 960 vlc.exe 960 vlc.exe -
Suspicious use of SendNotifyMessage 8 IoCs
Processes:
vlc.exepid process 960 vlc.exe 960 vlc.exe 960 vlc.exe 960 vlc.exe 960 vlc.exe 960 vlc.exe 960 vlc.exe 960 vlc.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
vlc.exemsdcsc.exepid process 960 vlc.exe 1608 msdcsc.exe -
Suspicious use of WriteProcessMemory 51 IoCs
Processes:
2cfe915e1498dd8ac3643ddc5812f5731d6ecc7d0efde6ad9a9bf35bcb735d0a.exeMP4.EXEcmd.execmd.exemsdcsc.exedescription pid process target process PID 1732 wrote to memory of 960 1732 2cfe915e1498dd8ac3643ddc5812f5731d6ecc7d0efde6ad9a9bf35bcb735d0a.exe vlc.exe PID 1732 wrote to memory of 960 1732 2cfe915e1498dd8ac3643ddc5812f5731d6ecc7d0efde6ad9a9bf35bcb735d0a.exe vlc.exe PID 1732 wrote to memory of 960 1732 2cfe915e1498dd8ac3643ddc5812f5731d6ecc7d0efde6ad9a9bf35bcb735d0a.exe vlc.exe PID 1732 wrote to memory of 960 1732 2cfe915e1498dd8ac3643ddc5812f5731d6ecc7d0efde6ad9a9bf35bcb735d0a.exe vlc.exe PID 1732 wrote to memory of 1752 1732 2cfe915e1498dd8ac3643ddc5812f5731d6ecc7d0efde6ad9a9bf35bcb735d0a.exe MP4.EXE PID 1732 wrote to memory of 1752 1732 2cfe915e1498dd8ac3643ddc5812f5731d6ecc7d0efde6ad9a9bf35bcb735d0a.exe MP4.EXE PID 1732 wrote to memory of 1752 1732 2cfe915e1498dd8ac3643ddc5812f5731d6ecc7d0efde6ad9a9bf35bcb735d0a.exe MP4.EXE PID 1732 wrote to memory of 1752 1732 2cfe915e1498dd8ac3643ddc5812f5731d6ecc7d0efde6ad9a9bf35bcb735d0a.exe MP4.EXE PID 1752 wrote to memory of 1016 1752 MP4.EXE cmd.exe PID 1752 wrote to memory of 1016 1752 MP4.EXE cmd.exe PID 1752 wrote to memory of 1016 1752 MP4.EXE cmd.exe PID 1752 wrote to memory of 1016 1752 MP4.EXE cmd.exe PID 1752 wrote to memory of 896 1752 MP4.EXE cmd.exe PID 1752 wrote to memory of 896 1752 MP4.EXE cmd.exe PID 1752 wrote to memory of 896 1752 MP4.EXE cmd.exe PID 1752 wrote to memory of 896 1752 MP4.EXE cmd.exe PID 896 wrote to memory of 1344 896 cmd.exe attrib.exe PID 896 wrote to memory of 1344 896 cmd.exe attrib.exe PID 896 wrote to memory of 1344 896 cmd.exe attrib.exe PID 896 wrote to memory of 1344 896 cmd.exe attrib.exe PID 1016 wrote to memory of 1700 1016 cmd.exe attrib.exe PID 1016 wrote to memory of 1700 1016 cmd.exe attrib.exe PID 1016 wrote to memory of 1700 1016 cmd.exe attrib.exe PID 1016 wrote to memory of 1700 1016 cmd.exe attrib.exe PID 1752 wrote to memory of 1608 1752 MP4.EXE msdcsc.exe PID 1752 wrote to memory of 1608 1752 MP4.EXE msdcsc.exe PID 1752 wrote to memory of 1608 1752 MP4.EXE msdcsc.exe PID 1752 wrote to memory of 1608 1752 MP4.EXE msdcsc.exe PID 1608 wrote to memory of 1988 1608 msdcsc.exe notepad.exe PID 1608 wrote to memory of 1988 1608 msdcsc.exe notepad.exe PID 1608 wrote to memory of 1988 1608 msdcsc.exe notepad.exe PID 1608 wrote to memory of 1988 1608 msdcsc.exe notepad.exe PID 1608 wrote to memory of 1988 1608 msdcsc.exe notepad.exe PID 1608 wrote to memory of 1988 1608 msdcsc.exe notepad.exe PID 1608 wrote to memory of 1988 1608 msdcsc.exe notepad.exe PID 1608 wrote to memory of 1988 1608 msdcsc.exe notepad.exe PID 1608 wrote to memory of 1988 1608 msdcsc.exe notepad.exe PID 1608 wrote to memory of 1988 1608 msdcsc.exe notepad.exe PID 1608 wrote to memory of 1988 1608 msdcsc.exe notepad.exe PID 1608 wrote to memory of 1988 1608 msdcsc.exe notepad.exe PID 1608 wrote to memory of 1988 1608 msdcsc.exe notepad.exe PID 1608 wrote to memory of 1988 1608 msdcsc.exe notepad.exe PID 1608 wrote to memory of 1988 1608 msdcsc.exe notepad.exe PID 1608 wrote to memory of 1988 1608 msdcsc.exe notepad.exe PID 1608 wrote to memory of 1988 1608 msdcsc.exe notepad.exe PID 1608 wrote to memory of 1988 1608 msdcsc.exe notepad.exe PID 1608 wrote to memory of 1988 1608 msdcsc.exe notepad.exe PID 1608 wrote to memory of 1988 1608 msdcsc.exe notepad.exe PID 1608 wrote to memory of 1988 1608 msdcsc.exe notepad.exe PID 1608 wrote to memory of 1988 1608 msdcsc.exe notepad.exe PID 1608 wrote to memory of 1988 1608 msdcsc.exe notepad.exe -
Views/modifies file attributes 1 TTPs 2 IoCs
Processes:
attrib.exeattrib.exepid process 1344 attrib.exe 1700 attrib.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2cfe915e1498dd8ac3643ddc5812f5731d6ecc7d0efde6ad9a9bf35bcb735d0a.exe"C:\Users\Admin\AppData\Local\Temp\2cfe915e1498dd8ac3643ddc5812f5731d6ecc7d0efde6ad9a9bf35bcb735d0a.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Program Files\VideoLAN\VLC\vlc.exe"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Local\Temp\10659678_611934625585217_1729858071_N.MP4"2⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\MP4.EXE"C:\Users\Admin\AppData\Local\Temp\MP4.EXE"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp\MP4.EXE" +s +h3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Users\Admin\AppData\Local\Temp\MP4.EXE" +s +h4⤵
- Sets file to hidden
- Views/modifies file attributes
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp" +s +h3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Users\Admin\AppData\Local\Temp" +s +h4⤵
- Sets file to hidden
- Views/modifies file attributes
-
C:\Users\Admin\Documents\MSDCSC\msdcsc.exe"C:\Users\Admin\Documents\MSDCSC\msdcsc.exe"3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\notepad.exenotepad4⤵
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x2ec1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\10659678_611934625585217_1729858071_N.MP4Filesize
4.8MB
MD559b96cc342be62284bbb61034ecac637
SHA108c3cd9dff1e984d404c6d27713b3c6240c303fe
SHA256a53fb6945371857d91ff6af4ff5ed4e5209a085a78590b0aaf508bf9866a64d8
SHA512857fa98335f8312193ec5ab8a86ed7d231c9f2eaebe5390ce7e42332e59555935610d351081bbb42bd77f8365a61fb35b2da185f0ab2cd599109243a0d69dd3f
-
C:\Users\Admin\AppData\Local\Temp\MP4.EXEFilesize
658KB
MD52be3505116f8113795bf495486b94e35
SHA1a5e3be49d4cf80c22e0dc7af491340fc1181e029
SHA2569b56811a9e3d61828afaf142f95164cd31ca7f9f55f097f11c4ac05f3d9d5bec
SHA5120a91560d262d86935c126af1a7cefb1ef454c97dc19ec7eeee65026872af7c2e998535c23c845adc6b6cbce7ba1afd26b4d04567794607e7f80d3ed35d97c452
-
C:\Users\Admin\AppData\Local\Temp\MP4.EXEFilesize
658KB
MD52be3505116f8113795bf495486b94e35
SHA1a5e3be49d4cf80c22e0dc7af491340fc1181e029
SHA2569b56811a9e3d61828afaf142f95164cd31ca7f9f55f097f11c4ac05f3d9d5bec
SHA5120a91560d262d86935c126af1a7cefb1ef454c97dc19ec7eeee65026872af7c2e998535c23c845adc6b6cbce7ba1afd26b4d04567794607e7f80d3ed35d97c452
-
C:\Users\Admin\Documents\MSDCSC\msdcsc.exeFilesize
658KB
MD52be3505116f8113795bf495486b94e35
SHA1a5e3be49d4cf80c22e0dc7af491340fc1181e029
SHA2569b56811a9e3d61828afaf142f95164cd31ca7f9f55f097f11c4ac05f3d9d5bec
SHA5120a91560d262d86935c126af1a7cefb1ef454c97dc19ec7eeee65026872af7c2e998535c23c845adc6b6cbce7ba1afd26b4d04567794607e7f80d3ed35d97c452
-
C:\Users\Admin\Documents\MSDCSC\msdcsc.exeFilesize
658KB
MD52be3505116f8113795bf495486b94e35
SHA1a5e3be49d4cf80c22e0dc7af491340fc1181e029
SHA2569b56811a9e3d61828afaf142f95164cd31ca7f9f55f097f11c4ac05f3d9d5bec
SHA5120a91560d262d86935c126af1a7cefb1ef454c97dc19ec7eeee65026872af7c2e998535c23c845adc6b6cbce7ba1afd26b4d04567794607e7f80d3ed35d97c452
-
\Users\Admin\AppData\Local\Temp\MP4.EXEFilesize
658KB
MD52be3505116f8113795bf495486b94e35
SHA1a5e3be49d4cf80c22e0dc7af491340fc1181e029
SHA2569b56811a9e3d61828afaf142f95164cd31ca7f9f55f097f11c4ac05f3d9d5bec
SHA5120a91560d262d86935c126af1a7cefb1ef454c97dc19ec7eeee65026872af7c2e998535c23c845adc6b6cbce7ba1afd26b4d04567794607e7f80d3ed35d97c452
-
\Users\Admin\AppData\Local\Temp\MP4.EXEFilesize
658KB
MD52be3505116f8113795bf495486b94e35
SHA1a5e3be49d4cf80c22e0dc7af491340fc1181e029
SHA2569b56811a9e3d61828afaf142f95164cd31ca7f9f55f097f11c4ac05f3d9d5bec
SHA5120a91560d262d86935c126af1a7cefb1ef454c97dc19ec7eeee65026872af7c2e998535c23c845adc6b6cbce7ba1afd26b4d04567794607e7f80d3ed35d97c452
-
\Users\Admin\Documents\MSDCSC\msdcsc.exeFilesize
658KB
MD52be3505116f8113795bf495486b94e35
SHA1a5e3be49d4cf80c22e0dc7af491340fc1181e029
SHA2569b56811a9e3d61828afaf142f95164cd31ca7f9f55f097f11c4ac05f3d9d5bec
SHA5120a91560d262d86935c126af1a7cefb1ef454c97dc19ec7eeee65026872af7c2e998535c23c845adc6b6cbce7ba1afd26b4d04567794607e7f80d3ed35d97c452
-
\Users\Admin\Documents\MSDCSC\msdcsc.exeFilesize
658KB
MD52be3505116f8113795bf495486b94e35
SHA1a5e3be49d4cf80c22e0dc7af491340fc1181e029
SHA2569b56811a9e3d61828afaf142f95164cd31ca7f9f55f097f11c4ac05f3d9d5bec
SHA5120a91560d262d86935c126af1a7cefb1ef454c97dc19ec7eeee65026872af7c2e998535c23c845adc6b6cbce7ba1afd26b4d04567794607e7f80d3ed35d97c452
-
memory/896-65-0x0000000000000000-mapping.dmp
-
memory/960-62-0x000007FEFB6A1000-0x000007FEFB6A3000-memory.dmpFilesize
8KB
-
memory/960-55-0x0000000000000000-mapping.dmp
-
memory/1016-64-0x0000000000000000-mapping.dmp
-
memory/1344-66-0x0000000000000000-mapping.dmp
-
memory/1608-70-0x0000000000000000-mapping.dmp
-
memory/1700-67-0x0000000000000000-mapping.dmp
-
memory/1732-54-0x0000000075771000-0x0000000075773000-memory.dmpFilesize
8KB
-
memory/1752-58-0x0000000000000000-mapping.dmp
-
memory/1988-74-0x0000000000000000-mapping.dmp