Analysis
-
max time kernel
21s -
max time network
29s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
25-11-2022 03:36
Static task
static1
Behavioral task
behavioral1
Sample
28711e96e760a3e740d1bfa3304d86504970fbf8b2184b675774ab3a2148a2f5.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
28711e96e760a3e740d1bfa3304d86504970fbf8b2184b675774ab3a2148a2f5.exe
Resource
win10v2004-20221111-en
General
-
Target
28711e96e760a3e740d1bfa3304d86504970fbf8b2184b675774ab3a2148a2f5.exe
-
Size
900KB
-
MD5
dc9d7b6a5110abb328bf595d056ce40d
-
SHA1
efab84b08c63cfe9fb703462a24a9961daa05b08
-
SHA256
28711e96e760a3e740d1bfa3304d86504970fbf8b2184b675774ab3a2148a2f5
-
SHA512
053179b603c513c7be82a355c9b7f0b7bf5edf4ccf083f533d8bf7a9da19dfe558c7ff08d3f7d61c4db28a2f2d72a1af5ce40cb580662ce1440bf97e35f7a16f
-
SSDEEP
12288:k0l9Cga3LAdaU+zV44yzQ9Jf/opEpZI5yRXyoQZDhQruxXV/9rPTzgbLgXy+Vo0K:j4iUCaLRpFX2WuxXVtPTEgC+60K
Malware Config
Extracted
darkcomet
summer
qsab98.no-ip.biz:1604
DC_MUTEX-6G9L12L
-
InstallPath
MSDCSC\msdcsc.exe
-
gencode
6QgnJweVD4dH
-
install
true
-
offline_keylogger
true
-
persistence
true
-
reg_key
MicroUpdate
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
Processes:
vbc.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Users\\Admin\\Documents\\MSDCSC\\msdcsc.exe" vbc.exe -
Executes dropped EXE 1 IoCs
Processes:
msdcsc.exepid process 1360 msdcsc.exe -
Loads dropped DLL 1 IoCs
Processes:
vbc.exepid process 1280 vbc.exe -
Uses the VBS compiler for execution 1 TTPs
-
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
vbc.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Users\\Admin\\Documents\\MSDCSC\\msdcsc.exe" vbc.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
28711e96e760a3e740d1bfa3304d86504970fbf8b2184b675774ab3a2148a2f5.exedescription pid process target process PID 1616 set thread context of 1280 1616 28711e96e760a3e740d1bfa3304d86504970fbf8b2184b675774ab3a2148a2f5.exe vbc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of AdjustPrivilegeToken 23 IoCs
Processes:
vbc.exedescription pid process Token: SeIncreaseQuotaPrivilege 1280 vbc.exe Token: SeSecurityPrivilege 1280 vbc.exe Token: SeTakeOwnershipPrivilege 1280 vbc.exe Token: SeLoadDriverPrivilege 1280 vbc.exe Token: SeSystemProfilePrivilege 1280 vbc.exe Token: SeSystemtimePrivilege 1280 vbc.exe Token: SeProfSingleProcessPrivilege 1280 vbc.exe Token: SeIncBasePriorityPrivilege 1280 vbc.exe Token: SeCreatePagefilePrivilege 1280 vbc.exe Token: SeBackupPrivilege 1280 vbc.exe Token: SeRestorePrivilege 1280 vbc.exe Token: SeShutdownPrivilege 1280 vbc.exe Token: SeDebugPrivilege 1280 vbc.exe Token: SeSystemEnvironmentPrivilege 1280 vbc.exe Token: SeChangeNotifyPrivilege 1280 vbc.exe Token: SeRemoteShutdownPrivilege 1280 vbc.exe Token: SeUndockPrivilege 1280 vbc.exe Token: SeManageVolumePrivilege 1280 vbc.exe Token: SeImpersonatePrivilege 1280 vbc.exe Token: SeCreateGlobalPrivilege 1280 vbc.exe Token: 33 1280 vbc.exe Token: 34 1280 vbc.exe Token: 35 1280 vbc.exe -
Suspicious use of WriteProcessMemory 25 IoCs
Processes:
28711e96e760a3e740d1bfa3304d86504970fbf8b2184b675774ab3a2148a2f5.execmd.exevbc.exedescription pid process target process PID 1616 wrote to memory of 2040 1616 28711e96e760a3e740d1bfa3304d86504970fbf8b2184b675774ab3a2148a2f5.exe cmd.exe PID 1616 wrote to memory of 2040 1616 28711e96e760a3e740d1bfa3304d86504970fbf8b2184b675774ab3a2148a2f5.exe cmd.exe PID 1616 wrote to memory of 2040 1616 28711e96e760a3e740d1bfa3304d86504970fbf8b2184b675774ab3a2148a2f5.exe cmd.exe PID 1616 wrote to memory of 2040 1616 28711e96e760a3e740d1bfa3304d86504970fbf8b2184b675774ab3a2148a2f5.exe cmd.exe PID 2040 wrote to memory of 1320 2040 cmd.exe choice.exe PID 2040 wrote to memory of 1320 2040 cmd.exe choice.exe PID 2040 wrote to memory of 1320 2040 cmd.exe choice.exe PID 2040 wrote to memory of 1320 2040 cmd.exe choice.exe PID 1616 wrote to memory of 1280 1616 28711e96e760a3e740d1bfa3304d86504970fbf8b2184b675774ab3a2148a2f5.exe vbc.exe PID 1616 wrote to memory of 1280 1616 28711e96e760a3e740d1bfa3304d86504970fbf8b2184b675774ab3a2148a2f5.exe vbc.exe PID 1616 wrote to memory of 1280 1616 28711e96e760a3e740d1bfa3304d86504970fbf8b2184b675774ab3a2148a2f5.exe vbc.exe PID 1616 wrote to memory of 1280 1616 28711e96e760a3e740d1bfa3304d86504970fbf8b2184b675774ab3a2148a2f5.exe vbc.exe PID 1616 wrote to memory of 1280 1616 28711e96e760a3e740d1bfa3304d86504970fbf8b2184b675774ab3a2148a2f5.exe vbc.exe PID 1616 wrote to memory of 1280 1616 28711e96e760a3e740d1bfa3304d86504970fbf8b2184b675774ab3a2148a2f5.exe vbc.exe PID 1616 wrote to memory of 1280 1616 28711e96e760a3e740d1bfa3304d86504970fbf8b2184b675774ab3a2148a2f5.exe vbc.exe PID 1616 wrote to memory of 1280 1616 28711e96e760a3e740d1bfa3304d86504970fbf8b2184b675774ab3a2148a2f5.exe vbc.exe PID 1616 wrote to memory of 1280 1616 28711e96e760a3e740d1bfa3304d86504970fbf8b2184b675774ab3a2148a2f5.exe vbc.exe PID 1616 wrote to memory of 1280 1616 28711e96e760a3e740d1bfa3304d86504970fbf8b2184b675774ab3a2148a2f5.exe vbc.exe PID 1616 wrote to memory of 1280 1616 28711e96e760a3e740d1bfa3304d86504970fbf8b2184b675774ab3a2148a2f5.exe vbc.exe PID 1616 wrote to memory of 1280 1616 28711e96e760a3e740d1bfa3304d86504970fbf8b2184b675774ab3a2148a2f5.exe vbc.exe PID 1616 wrote to memory of 1280 1616 28711e96e760a3e740d1bfa3304d86504970fbf8b2184b675774ab3a2148a2f5.exe vbc.exe PID 1280 wrote to memory of 1360 1280 vbc.exe msdcsc.exe PID 1280 wrote to memory of 1360 1280 vbc.exe msdcsc.exe PID 1280 wrote to memory of 1360 1280 vbc.exe msdcsc.exe PID 1280 wrote to memory of 1360 1280 vbc.exe msdcsc.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\28711e96e760a3e740d1bfa3304d86504970fbf8b2184b675774ab3a2148a2f5.exe"C:\Users\Admin\AppData\Local\Temp\28711e96e760a3e740d1bfa3304d86504970fbf8b2184b675774ab3a2148a2f5.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del C:\Users\Admin\AppData\Local\Temp\28711e96e760a3e740d1bfa3304d86504970fbf8b2184b675774ab3a2148a2f5.exe2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\choice.exechoice /C Y /N /D Y /T 33⤵
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeC:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe2⤵
- Modifies WinLogon for persistence
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\Documents\MSDCSC\msdcsc.exe"C:\Users\Admin\Documents\MSDCSC\msdcsc.exe"3⤵
- Executes dropped EXE
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\Documents\MSDCSC\msdcsc.exeFilesize
1.1MB
MD534aa912defa18c2c129f1e09d75c1d7e
SHA19c3046324657505a30ecd9b1fdb46c05bde7d470
SHA2566df94b7fa33f1b87142adc39b3db0613fc520d9e7a5fd6a5301dd7f51f8d0386
SHA512d1ea9368f5d7166180612fd763c87afb647d088498887961f5e7fb0a10f4a808bd5928e8a3666d70ff794093c51ecca8816f75dd47652fd4eb23dce7f9aa1f98
-
C:\Users\Admin\Documents\MSDCSC\msdcsc.exeFilesize
1.1MB
MD534aa912defa18c2c129f1e09d75c1d7e
SHA19c3046324657505a30ecd9b1fdb46c05bde7d470
SHA2566df94b7fa33f1b87142adc39b3db0613fc520d9e7a5fd6a5301dd7f51f8d0386
SHA512d1ea9368f5d7166180612fd763c87afb647d088498887961f5e7fb0a10f4a808bd5928e8a3666d70ff794093c51ecca8816f75dd47652fd4eb23dce7f9aa1f98
-
\Users\Admin\Documents\MSDCSC\msdcsc.exeFilesize
1.1MB
MD534aa912defa18c2c129f1e09d75c1d7e
SHA19c3046324657505a30ecd9b1fdb46c05bde7d470
SHA2566df94b7fa33f1b87142adc39b3db0613fc520d9e7a5fd6a5301dd7f51f8d0386
SHA512d1ea9368f5d7166180612fd763c87afb647d088498887961f5e7fb0a10f4a808bd5928e8a3666d70ff794093c51ecca8816f75dd47652fd4eb23dce7f9aa1f98
-
memory/1280-65-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/1280-59-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/1280-58-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/1280-61-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/1280-63-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/1280-77-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/1280-67-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/1280-68-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/1280-70-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/1280-72-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/1280-73-0x000000000048F888-mapping.dmp
-
memory/1280-74-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/1280-78-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/1320-57-0x0000000000000000-mapping.dmp
-
memory/1360-80-0x0000000000000000-mapping.dmp
-
memory/1616-75-0x0000000074740000-0x0000000074CEB000-memory.dmpFilesize
5.7MB
-
memory/1616-54-0x0000000075781000-0x0000000075783000-memory.dmpFilesize
8KB
-
memory/1616-55-0x0000000074740000-0x0000000074CEB000-memory.dmpFilesize
5.7MB
-
memory/2040-56-0x0000000000000000-mapping.dmp