Analysis
-
max time kernel
151s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
25-11-2022 02:16
Static task
static1
Behavioral task
behavioral1
Sample
4389d5af6fcb92a4b4aa14468339b09ee3bbc5188e568983340380aaa3ed0198.exe
Resource
win7-20221111-en
General
-
Target
4389d5af6fcb92a4b4aa14468339b09ee3bbc5188e568983340380aaa3ed0198.exe
-
Size
604KB
-
MD5
46a36b28a6f07b76ea511a8ae0c2aa3a
-
SHA1
88de3a8bbeff45b802c5f5b19c7aacf88dd235ed
-
SHA256
4389d5af6fcb92a4b4aa14468339b09ee3bbc5188e568983340380aaa3ed0198
-
SHA512
65b7b53c93b35b65d803fb4ba67ebae0fd42aafb5a71d7b14888da49286ef6dd9f731b8d033c9f86ef6bdeb1949ac46230ca6da05b3803419813dc134b79e83c
-
SSDEEP
12288:qDboBfrFT0u7kkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkk:7Bfr/HiJw7DxD
Malware Config
Extracted
darkcomet
REPAIRED
susanrosanne.ddns.net:8991
DC_MUTEX-MTLJCHX
-
InstallPath
MSDCSC\msdcsc.exe
-
gencode
v3RMsCdzjW76
-
install
true
-
offline_keylogger
true
-
persistence
true
-
reg_key
MicroUpdate
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
Processes:
Terms.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Users\\Admin\\Documents\\MSDCSC\\msdcsc.exe" Terms.exe -
Executes dropped EXE 5 IoCs
Processes:
Terms.exeTerms.exemsdcsc.exeTerms.exeTerms.exepid process 1688 Terms.exe 1352 Terms.exe 892 msdcsc.exe 1764 Terms.exe 676 Terms.exe -
Processes:
resource yara_rule behavioral1/memory/1352-61-0x0000000000400000-0x00000000004B7000-memory.dmp upx behavioral1/memory/1352-63-0x0000000000400000-0x00000000004B7000-memory.dmp upx behavioral1/memory/1352-68-0x0000000000400000-0x00000000004B7000-memory.dmp upx behavioral1/memory/676-77-0x0000000000400000-0x00000000004B7000-memory.dmp upx behavioral1/memory/676-78-0x0000000000400000-0x00000000004B7000-memory.dmp upx -
Drops startup file 1 IoCs
Processes:
4389d5af6fcb92a4b4aa14468339b09ee3bbc5188e568983340380aaa3ed0198.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Create Pain.vbs 4389d5af6fcb92a4b4aa14468339b09ee3bbc5188e568983340380aaa3ed0198.exe -
Loads dropped DLL 2 IoCs
Processes:
4389d5af6fcb92a4b4aa14468339b09ee3bbc5188e568983340380aaa3ed0198.exeTerms.exepid process 1728 4389d5af6fcb92a4b4aa14468339b09ee3bbc5188e568983340380aaa3ed0198.exe 1352 Terms.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
Terms.exeTerms.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Users\\Admin\\Documents\\MSDCSC\\msdcsc.exe" Terms.exe Set value (str) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Users\\Admin\\Documents\\MSDCSC\\msdcsc.exe" Terms.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
Terms.exeTerms.exedescription pid process target process PID 1688 set thread context of 1352 1688 Terms.exe Terms.exe PID 1764 set thread context of 676 1764 Terms.exe Terms.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: MapViewOfSection 4 IoCs
Processes:
Terms.exeTerms.exepid process 1688 Terms.exe 1688 Terms.exe 1764 Terms.exe 1764 Terms.exe -
Suspicious use of AdjustPrivilegeToken 46 IoCs
Processes:
Terms.exeTerms.exedescription pid process Token: SeIncreaseQuotaPrivilege 1352 Terms.exe Token: SeSecurityPrivilege 1352 Terms.exe Token: SeTakeOwnershipPrivilege 1352 Terms.exe Token: SeLoadDriverPrivilege 1352 Terms.exe Token: SeSystemProfilePrivilege 1352 Terms.exe Token: SeSystemtimePrivilege 1352 Terms.exe Token: SeProfSingleProcessPrivilege 1352 Terms.exe Token: SeIncBasePriorityPrivilege 1352 Terms.exe Token: SeCreatePagefilePrivilege 1352 Terms.exe Token: SeBackupPrivilege 1352 Terms.exe Token: SeRestorePrivilege 1352 Terms.exe Token: SeShutdownPrivilege 1352 Terms.exe Token: SeDebugPrivilege 1352 Terms.exe Token: SeSystemEnvironmentPrivilege 1352 Terms.exe Token: SeChangeNotifyPrivilege 1352 Terms.exe Token: SeRemoteShutdownPrivilege 1352 Terms.exe Token: SeUndockPrivilege 1352 Terms.exe Token: SeManageVolumePrivilege 1352 Terms.exe Token: SeImpersonatePrivilege 1352 Terms.exe Token: SeCreateGlobalPrivilege 1352 Terms.exe Token: 33 1352 Terms.exe Token: 34 1352 Terms.exe Token: 35 1352 Terms.exe Token: SeIncreaseQuotaPrivilege 676 Terms.exe Token: SeSecurityPrivilege 676 Terms.exe Token: SeTakeOwnershipPrivilege 676 Terms.exe Token: SeLoadDriverPrivilege 676 Terms.exe Token: SeSystemProfilePrivilege 676 Terms.exe Token: SeSystemtimePrivilege 676 Terms.exe Token: SeProfSingleProcessPrivilege 676 Terms.exe Token: SeIncBasePriorityPrivilege 676 Terms.exe Token: SeCreatePagefilePrivilege 676 Terms.exe Token: SeBackupPrivilege 676 Terms.exe Token: SeRestorePrivilege 676 Terms.exe Token: SeShutdownPrivilege 676 Terms.exe Token: SeDebugPrivilege 676 Terms.exe Token: SeSystemEnvironmentPrivilege 676 Terms.exe Token: SeChangeNotifyPrivilege 676 Terms.exe Token: SeRemoteShutdownPrivilege 676 Terms.exe Token: SeUndockPrivilege 676 Terms.exe Token: SeManageVolumePrivilege 676 Terms.exe Token: SeImpersonatePrivilege 676 Terms.exe Token: SeCreateGlobalPrivilege 676 Terms.exe Token: 33 676 Terms.exe Token: 34 676 Terms.exe Token: 35 676 Terms.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
Terms.exepid process 676 Terms.exe -
Suspicious use of WriteProcessMemory 20 IoCs
Processes:
4389d5af6fcb92a4b4aa14468339b09ee3bbc5188e568983340380aaa3ed0198.exeTerms.exeTerms.exemsdcsc.exeTerms.exedescription pid process target process PID 1728 wrote to memory of 1688 1728 4389d5af6fcb92a4b4aa14468339b09ee3bbc5188e568983340380aaa3ed0198.exe Terms.exe PID 1728 wrote to memory of 1688 1728 4389d5af6fcb92a4b4aa14468339b09ee3bbc5188e568983340380aaa3ed0198.exe Terms.exe PID 1728 wrote to memory of 1688 1728 4389d5af6fcb92a4b4aa14468339b09ee3bbc5188e568983340380aaa3ed0198.exe Terms.exe PID 1728 wrote to memory of 1688 1728 4389d5af6fcb92a4b4aa14468339b09ee3bbc5188e568983340380aaa3ed0198.exe Terms.exe PID 1688 wrote to memory of 1352 1688 Terms.exe Terms.exe PID 1688 wrote to memory of 1352 1688 Terms.exe Terms.exe PID 1688 wrote to memory of 1352 1688 Terms.exe Terms.exe PID 1688 wrote to memory of 1352 1688 Terms.exe Terms.exe PID 1352 wrote to memory of 892 1352 Terms.exe msdcsc.exe PID 1352 wrote to memory of 892 1352 Terms.exe msdcsc.exe PID 1352 wrote to memory of 892 1352 Terms.exe msdcsc.exe PID 1352 wrote to memory of 892 1352 Terms.exe msdcsc.exe PID 892 wrote to memory of 1764 892 msdcsc.exe Terms.exe PID 892 wrote to memory of 1764 892 msdcsc.exe Terms.exe PID 892 wrote to memory of 1764 892 msdcsc.exe Terms.exe PID 892 wrote to memory of 1764 892 msdcsc.exe Terms.exe PID 1764 wrote to memory of 676 1764 Terms.exe Terms.exe PID 1764 wrote to memory of 676 1764 Terms.exe Terms.exe PID 1764 wrote to memory of 676 1764 Terms.exe Terms.exe PID 1764 wrote to memory of 676 1764 Terms.exe Terms.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\4389d5af6fcb92a4b4aa14468339b09ee3bbc5188e568983340380aaa3ed0198.exe"C:\Users\Admin\AppData\Local\Temp\4389d5af6fcb92a4b4aa14468339b09ee3bbc5188e568983340380aaa3ed0198.exe"1⤵
- Drops startup file
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Create Pain\Terms.exe"C:\Users\Admin\AppData\Roaming\Create Pain\Terms.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Create Pain\Terms.exe"C:\Users\Admin\AppData\Roaming\Create Pain\Terms.exe"3⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\Documents\MSDCSC\msdcsc.exe"C:\Users\Admin\Documents\MSDCSC\msdcsc.exe"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Create Pain\Terms.exe"C:\Users\Admin\AppData\Roaming\Create Pain\Terms.exe"5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Create Pain\Terms.exe"C:\Users\Admin\AppData\Roaming\Create Pain\Terms.exe"6⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\Create Pain\Terms.exeFilesize
604KB
MD546a36b28a6f07b76ea511a8ae0c2aa3a
SHA188de3a8bbeff45b802c5f5b19c7aacf88dd235ed
SHA2564389d5af6fcb92a4b4aa14468339b09ee3bbc5188e568983340380aaa3ed0198
SHA51265b7b53c93b35b65d803fb4ba67ebae0fd42aafb5a71d7b14888da49286ef6dd9f731b8d033c9f86ef6bdeb1949ac46230ca6da05b3803419813dc134b79e83c
-
C:\Users\Admin\AppData\Roaming\Create Pain\Terms.exeFilesize
604KB
MD546a36b28a6f07b76ea511a8ae0c2aa3a
SHA188de3a8bbeff45b802c5f5b19c7aacf88dd235ed
SHA2564389d5af6fcb92a4b4aa14468339b09ee3bbc5188e568983340380aaa3ed0198
SHA51265b7b53c93b35b65d803fb4ba67ebae0fd42aafb5a71d7b14888da49286ef6dd9f731b8d033c9f86ef6bdeb1949ac46230ca6da05b3803419813dc134b79e83c
-
C:\Users\Admin\AppData\Roaming\Create Pain\Terms.exeFilesize
604KB
MD546a36b28a6f07b76ea511a8ae0c2aa3a
SHA188de3a8bbeff45b802c5f5b19c7aacf88dd235ed
SHA2564389d5af6fcb92a4b4aa14468339b09ee3bbc5188e568983340380aaa3ed0198
SHA51265b7b53c93b35b65d803fb4ba67ebae0fd42aafb5a71d7b14888da49286ef6dd9f731b8d033c9f86ef6bdeb1949ac46230ca6da05b3803419813dc134b79e83c
-
C:\Users\Admin\AppData\Roaming\Create Pain\Terms.exeFilesize
604KB
MD546a36b28a6f07b76ea511a8ae0c2aa3a
SHA188de3a8bbeff45b802c5f5b19c7aacf88dd235ed
SHA2564389d5af6fcb92a4b4aa14468339b09ee3bbc5188e568983340380aaa3ed0198
SHA51265b7b53c93b35b65d803fb4ba67ebae0fd42aafb5a71d7b14888da49286ef6dd9f731b8d033c9f86ef6bdeb1949ac46230ca6da05b3803419813dc134b79e83c
-
C:\Users\Admin\AppData\Roaming\Create Pain\Terms.exeFilesize
604KB
MD546a36b28a6f07b76ea511a8ae0c2aa3a
SHA188de3a8bbeff45b802c5f5b19c7aacf88dd235ed
SHA2564389d5af6fcb92a4b4aa14468339b09ee3bbc5188e568983340380aaa3ed0198
SHA51265b7b53c93b35b65d803fb4ba67ebae0fd42aafb5a71d7b14888da49286ef6dd9f731b8d033c9f86ef6bdeb1949ac46230ca6da05b3803419813dc134b79e83c
-
C:\Users\Admin\Documents\MSDCSC\msdcsc.exeFilesize
604KB
MD546a36b28a6f07b76ea511a8ae0c2aa3a
SHA188de3a8bbeff45b802c5f5b19c7aacf88dd235ed
SHA2564389d5af6fcb92a4b4aa14468339b09ee3bbc5188e568983340380aaa3ed0198
SHA51265b7b53c93b35b65d803fb4ba67ebae0fd42aafb5a71d7b14888da49286ef6dd9f731b8d033c9f86ef6bdeb1949ac46230ca6da05b3803419813dc134b79e83c
-
C:\Users\Admin\Documents\MSDCSC\msdcsc.exeFilesize
604KB
MD546a36b28a6f07b76ea511a8ae0c2aa3a
SHA188de3a8bbeff45b802c5f5b19c7aacf88dd235ed
SHA2564389d5af6fcb92a4b4aa14468339b09ee3bbc5188e568983340380aaa3ed0198
SHA51265b7b53c93b35b65d803fb4ba67ebae0fd42aafb5a71d7b14888da49286ef6dd9f731b8d033c9f86ef6bdeb1949ac46230ca6da05b3803419813dc134b79e83c
-
\Users\Admin\AppData\Roaming\Create Pain\Terms.exeFilesize
604KB
MD546a36b28a6f07b76ea511a8ae0c2aa3a
SHA188de3a8bbeff45b802c5f5b19c7aacf88dd235ed
SHA2564389d5af6fcb92a4b4aa14468339b09ee3bbc5188e568983340380aaa3ed0198
SHA51265b7b53c93b35b65d803fb4ba67ebae0fd42aafb5a71d7b14888da49286ef6dd9f731b8d033c9f86ef6bdeb1949ac46230ca6da05b3803419813dc134b79e83c
-
\Users\Admin\Documents\MSDCSC\msdcsc.exeFilesize
604KB
MD546a36b28a6f07b76ea511a8ae0c2aa3a
SHA188de3a8bbeff45b802c5f5b19c7aacf88dd235ed
SHA2564389d5af6fcb92a4b4aa14468339b09ee3bbc5188e568983340380aaa3ed0198
SHA51265b7b53c93b35b65d803fb4ba67ebae0fd42aafb5a71d7b14888da49286ef6dd9f731b8d033c9f86ef6bdeb1949ac46230ca6da05b3803419813dc134b79e83c
-
memory/676-78-0x0000000000400000-0x00000000004B7000-memory.dmpFilesize
732KB
-
memory/676-77-0x0000000000400000-0x00000000004B7000-memory.dmpFilesize
732KB
-
memory/676-73-0x00000000004B5770-mapping.dmp
-
memory/892-66-0x0000000000000000-mapping.dmp
-
memory/1352-61-0x0000000000400000-0x00000000004B7000-memory.dmpFilesize
732KB
-
memory/1352-63-0x0000000000400000-0x00000000004B7000-memory.dmpFilesize
732KB
-
memory/1352-59-0x00000000004B5770-mapping.dmp
-
memory/1352-68-0x0000000000400000-0x00000000004B7000-memory.dmpFilesize
732KB
-
memory/1688-56-0x0000000000000000-mapping.dmp
-
memory/1728-54-0x0000000075FF1000-0x0000000075FF3000-memory.dmpFilesize
8KB
-
memory/1764-70-0x0000000000000000-mapping.dmp