Analysis
-
max time kernel
202s -
max time network
237s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
25-11-2022 02:16
Static task
static1
Behavioral task
behavioral1
Sample
4389d5af6fcb92a4b4aa14468339b09ee3bbc5188e568983340380aaa3ed0198.exe
Resource
win7-20221111-en
General
-
Target
4389d5af6fcb92a4b4aa14468339b09ee3bbc5188e568983340380aaa3ed0198.exe
-
Size
604KB
-
MD5
46a36b28a6f07b76ea511a8ae0c2aa3a
-
SHA1
88de3a8bbeff45b802c5f5b19c7aacf88dd235ed
-
SHA256
4389d5af6fcb92a4b4aa14468339b09ee3bbc5188e568983340380aaa3ed0198
-
SHA512
65b7b53c93b35b65d803fb4ba67ebae0fd42aafb5a71d7b14888da49286ef6dd9f731b8d033c9f86ef6bdeb1949ac46230ca6da05b3803419813dc134b79e83c
-
SSDEEP
12288:qDboBfrFT0u7kkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkk:7Bfr/HiJw7DxD
Malware Config
Extracted
darkcomet
REPAIRED
susanrosanne.ddns.net:8991
DC_MUTEX-MTLJCHX
-
InstallPath
MSDCSC\msdcsc.exe
-
gencode
v3RMsCdzjW76
-
install
true
-
offline_keylogger
true
-
persistence
true
-
reg_key
MicroUpdate
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
Processes:
Terms.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Users\\Admin\\Documents\\MSDCSC\\msdcsc.exe" Terms.exe -
Executes dropped EXE 5 IoCs
Processes:
Terms.exeTerms.exemsdcsc.exeTerms.exeTerms.exepid process 752 Terms.exe 4156 Terms.exe 4852 msdcsc.exe 4660 Terms.exe 1396 Terms.exe -
Processes:
resource yara_rule behavioral2/memory/4156-137-0x0000000000400000-0x00000000004B7000-memory.dmp upx behavioral2/memory/4156-138-0x0000000000400000-0x00000000004B7000-memory.dmp upx behavioral2/memory/4156-139-0x0000000000400000-0x00000000004B7000-memory.dmp upx behavioral2/memory/4156-143-0x0000000000400000-0x00000000004B7000-memory.dmp upx behavioral2/memory/1396-148-0x0000000000400000-0x00000000004B7000-memory.dmp upx behavioral2/memory/1396-149-0x0000000000400000-0x00000000004B7000-memory.dmp upx -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
Terms.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Control Panel\International\Geo\Nation Terms.exe -
Drops startup file 1 IoCs
Processes:
4389d5af6fcb92a4b4aa14468339b09ee3bbc5188e568983340380aaa3ed0198.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Create Pain.vbs 4389d5af6fcb92a4b4aa14468339b09ee3bbc5188e568983340380aaa3ed0198.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
Terms.exeTerms.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Users\\Admin\\Documents\\MSDCSC\\msdcsc.exe" Terms.exe Set value (str) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Users\\Admin\\Documents\\MSDCSC\\msdcsc.exe" Terms.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
Terms.exeTerms.exedescription pid process target process PID 752 set thread context of 4156 752 Terms.exe Terms.exe PID 4660 set thread context of 1396 4660 Terms.exe Terms.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Modifies registry class 1 IoCs
Processes:
Terms.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Terms.exe -
Suspicious behavior: MapViewOfSection 4 IoCs
Processes:
Terms.exeTerms.exepid process 752 Terms.exe 752 Terms.exe 4660 Terms.exe 4660 Terms.exe -
Suspicious use of AdjustPrivilegeToken 48 IoCs
Processes:
Terms.exeTerms.exedescription pid process Token: SeIncreaseQuotaPrivilege 4156 Terms.exe Token: SeSecurityPrivilege 4156 Terms.exe Token: SeTakeOwnershipPrivilege 4156 Terms.exe Token: SeLoadDriverPrivilege 4156 Terms.exe Token: SeSystemProfilePrivilege 4156 Terms.exe Token: SeSystemtimePrivilege 4156 Terms.exe Token: SeProfSingleProcessPrivilege 4156 Terms.exe Token: SeIncBasePriorityPrivilege 4156 Terms.exe Token: SeCreatePagefilePrivilege 4156 Terms.exe Token: SeBackupPrivilege 4156 Terms.exe Token: SeRestorePrivilege 4156 Terms.exe Token: SeShutdownPrivilege 4156 Terms.exe Token: SeDebugPrivilege 4156 Terms.exe Token: SeSystemEnvironmentPrivilege 4156 Terms.exe Token: SeChangeNotifyPrivilege 4156 Terms.exe Token: SeRemoteShutdownPrivilege 4156 Terms.exe Token: SeUndockPrivilege 4156 Terms.exe Token: SeManageVolumePrivilege 4156 Terms.exe Token: SeImpersonatePrivilege 4156 Terms.exe Token: SeCreateGlobalPrivilege 4156 Terms.exe Token: 33 4156 Terms.exe Token: 34 4156 Terms.exe Token: 35 4156 Terms.exe Token: 36 4156 Terms.exe Token: SeIncreaseQuotaPrivilege 1396 Terms.exe Token: SeSecurityPrivilege 1396 Terms.exe Token: SeTakeOwnershipPrivilege 1396 Terms.exe Token: SeLoadDriverPrivilege 1396 Terms.exe Token: SeSystemProfilePrivilege 1396 Terms.exe Token: SeSystemtimePrivilege 1396 Terms.exe Token: SeProfSingleProcessPrivilege 1396 Terms.exe Token: SeIncBasePriorityPrivilege 1396 Terms.exe Token: SeCreatePagefilePrivilege 1396 Terms.exe Token: SeBackupPrivilege 1396 Terms.exe Token: SeRestorePrivilege 1396 Terms.exe Token: SeShutdownPrivilege 1396 Terms.exe Token: SeDebugPrivilege 1396 Terms.exe Token: SeSystemEnvironmentPrivilege 1396 Terms.exe Token: SeChangeNotifyPrivilege 1396 Terms.exe Token: SeRemoteShutdownPrivilege 1396 Terms.exe Token: SeUndockPrivilege 1396 Terms.exe Token: SeManageVolumePrivilege 1396 Terms.exe Token: SeImpersonatePrivilege 1396 Terms.exe Token: SeCreateGlobalPrivilege 1396 Terms.exe Token: 33 1396 Terms.exe Token: 34 1396 Terms.exe Token: 35 1396 Terms.exe Token: 36 1396 Terms.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
Terms.exepid process 1396 Terms.exe -
Suspicious use of WriteProcessMemory 15 IoCs
Processes:
4389d5af6fcb92a4b4aa14468339b09ee3bbc5188e568983340380aaa3ed0198.exeTerms.exeTerms.exemsdcsc.exeTerms.exedescription pid process target process PID 4968 wrote to memory of 752 4968 4389d5af6fcb92a4b4aa14468339b09ee3bbc5188e568983340380aaa3ed0198.exe Terms.exe PID 4968 wrote to memory of 752 4968 4389d5af6fcb92a4b4aa14468339b09ee3bbc5188e568983340380aaa3ed0198.exe Terms.exe PID 4968 wrote to memory of 752 4968 4389d5af6fcb92a4b4aa14468339b09ee3bbc5188e568983340380aaa3ed0198.exe Terms.exe PID 752 wrote to memory of 4156 752 Terms.exe Terms.exe PID 752 wrote to memory of 4156 752 Terms.exe Terms.exe PID 752 wrote to memory of 4156 752 Terms.exe Terms.exe PID 4156 wrote to memory of 4852 4156 Terms.exe msdcsc.exe PID 4156 wrote to memory of 4852 4156 Terms.exe msdcsc.exe PID 4156 wrote to memory of 4852 4156 Terms.exe msdcsc.exe PID 4852 wrote to memory of 4660 4852 msdcsc.exe Terms.exe PID 4852 wrote to memory of 4660 4852 msdcsc.exe Terms.exe PID 4852 wrote to memory of 4660 4852 msdcsc.exe Terms.exe PID 4660 wrote to memory of 1396 4660 Terms.exe Terms.exe PID 4660 wrote to memory of 1396 4660 Terms.exe Terms.exe PID 4660 wrote to memory of 1396 4660 Terms.exe Terms.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\4389d5af6fcb92a4b4aa14468339b09ee3bbc5188e568983340380aaa3ed0198.exe"C:\Users\Admin\AppData\Local\Temp\4389d5af6fcb92a4b4aa14468339b09ee3bbc5188e568983340380aaa3ed0198.exe"1⤵
- Drops startup file
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Create Pain\Terms.exe"C:\Users\Admin\AppData\Roaming\Create Pain\Terms.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Create Pain\Terms.exe"C:\Users\Admin\AppData\Roaming\Create Pain\Terms.exe"3⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Checks computer location settings
- Adds Run key to start application
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\Documents\MSDCSC\msdcsc.exe"C:\Users\Admin\Documents\MSDCSC\msdcsc.exe"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Create Pain\Terms.exe"C:\Users\Admin\AppData\Roaming\Create Pain\Terms.exe"5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Create Pain\Terms.exe"C:\Users\Admin\AppData\Roaming\Create Pain\Terms.exe"6⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\Create Pain\Terms.exeFilesize
604KB
MD546a36b28a6f07b76ea511a8ae0c2aa3a
SHA188de3a8bbeff45b802c5f5b19c7aacf88dd235ed
SHA2564389d5af6fcb92a4b4aa14468339b09ee3bbc5188e568983340380aaa3ed0198
SHA51265b7b53c93b35b65d803fb4ba67ebae0fd42aafb5a71d7b14888da49286ef6dd9f731b8d033c9f86ef6bdeb1949ac46230ca6da05b3803419813dc134b79e83c
-
C:\Users\Admin\AppData\Roaming\Create Pain\Terms.exeFilesize
604KB
MD546a36b28a6f07b76ea511a8ae0c2aa3a
SHA188de3a8bbeff45b802c5f5b19c7aacf88dd235ed
SHA2564389d5af6fcb92a4b4aa14468339b09ee3bbc5188e568983340380aaa3ed0198
SHA51265b7b53c93b35b65d803fb4ba67ebae0fd42aafb5a71d7b14888da49286ef6dd9f731b8d033c9f86ef6bdeb1949ac46230ca6da05b3803419813dc134b79e83c
-
C:\Users\Admin\AppData\Roaming\Create Pain\Terms.exeFilesize
604KB
MD546a36b28a6f07b76ea511a8ae0c2aa3a
SHA188de3a8bbeff45b802c5f5b19c7aacf88dd235ed
SHA2564389d5af6fcb92a4b4aa14468339b09ee3bbc5188e568983340380aaa3ed0198
SHA51265b7b53c93b35b65d803fb4ba67ebae0fd42aafb5a71d7b14888da49286ef6dd9f731b8d033c9f86ef6bdeb1949ac46230ca6da05b3803419813dc134b79e83c
-
C:\Users\Admin\AppData\Roaming\Create Pain\Terms.exeFilesize
604KB
MD546a36b28a6f07b76ea511a8ae0c2aa3a
SHA188de3a8bbeff45b802c5f5b19c7aacf88dd235ed
SHA2564389d5af6fcb92a4b4aa14468339b09ee3bbc5188e568983340380aaa3ed0198
SHA51265b7b53c93b35b65d803fb4ba67ebae0fd42aafb5a71d7b14888da49286ef6dd9f731b8d033c9f86ef6bdeb1949ac46230ca6da05b3803419813dc134b79e83c
-
C:\Users\Admin\AppData\Roaming\Create Pain\Terms.exeFilesize
604KB
MD546a36b28a6f07b76ea511a8ae0c2aa3a
SHA188de3a8bbeff45b802c5f5b19c7aacf88dd235ed
SHA2564389d5af6fcb92a4b4aa14468339b09ee3bbc5188e568983340380aaa3ed0198
SHA51265b7b53c93b35b65d803fb4ba67ebae0fd42aafb5a71d7b14888da49286ef6dd9f731b8d033c9f86ef6bdeb1949ac46230ca6da05b3803419813dc134b79e83c
-
C:\Users\Admin\Documents\MSDCSC\msdcsc.exeFilesize
604KB
MD546a36b28a6f07b76ea511a8ae0c2aa3a
SHA188de3a8bbeff45b802c5f5b19c7aacf88dd235ed
SHA2564389d5af6fcb92a4b4aa14468339b09ee3bbc5188e568983340380aaa3ed0198
SHA51265b7b53c93b35b65d803fb4ba67ebae0fd42aafb5a71d7b14888da49286ef6dd9f731b8d033c9f86ef6bdeb1949ac46230ca6da05b3803419813dc134b79e83c
-
C:\Users\Admin\Documents\MSDCSC\msdcsc.exeFilesize
604KB
MD546a36b28a6f07b76ea511a8ae0c2aa3a
SHA188de3a8bbeff45b802c5f5b19c7aacf88dd235ed
SHA2564389d5af6fcb92a4b4aa14468339b09ee3bbc5188e568983340380aaa3ed0198
SHA51265b7b53c93b35b65d803fb4ba67ebae0fd42aafb5a71d7b14888da49286ef6dd9f731b8d033c9f86ef6bdeb1949ac46230ca6da05b3803419813dc134b79e83c
-
memory/752-132-0x0000000000000000-mapping.dmp
-
memory/1396-149-0x0000000000400000-0x00000000004B7000-memory.dmpFilesize
732KB
-
memory/1396-148-0x0000000000400000-0x00000000004B7000-memory.dmpFilesize
732KB
-
memory/1396-146-0x0000000000000000-mapping.dmp
-
memory/4156-139-0x0000000000400000-0x00000000004B7000-memory.dmpFilesize
732KB
-
memory/4156-143-0x0000000000400000-0x00000000004B7000-memory.dmpFilesize
732KB
-
memory/4156-135-0x0000000000000000-mapping.dmp
-
memory/4156-138-0x0000000000400000-0x00000000004B7000-memory.dmpFilesize
732KB
-
memory/4156-137-0x0000000000400000-0x00000000004B7000-memory.dmpFilesize
732KB
-
memory/4660-144-0x0000000000000000-mapping.dmp
-
memory/4852-140-0x0000000000000000-mapping.dmp