Analysis
-
max time kernel
190s -
max time network
212s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
25-11-2022 03:36
Static task
static1
Behavioral task
behavioral1
Sample
28711e96e760a3e740d1bfa3304d86504970fbf8b2184b675774ab3a2148a2f5.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
28711e96e760a3e740d1bfa3304d86504970fbf8b2184b675774ab3a2148a2f5.exe
Resource
win10v2004-20221111-en
General
-
Target
28711e96e760a3e740d1bfa3304d86504970fbf8b2184b675774ab3a2148a2f5.exe
-
Size
900KB
-
MD5
dc9d7b6a5110abb328bf595d056ce40d
-
SHA1
efab84b08c63cfe9fb703462a24a9961daa05b08
-
SHA256
28711e96e760a3e740d1bfa3304d86504970fbf8b2184b675774ab3a2148a2f5
-
SHA512
053179b603c513c7be82a355c9b7f0b7bf5edf4ccf083f533d8bf7a9da19dfe558c7ff08d3f7d61c4db28a2f2d72a1af5ce40cb580662ce1440bf97e35f7a16f
-
SSDEEP
12288:k0l9Cga3LAdaU+zV44yzQ9Jf/opEpZI5yRXyoQZDhQruxXV/9rPTzgbLgXy+Vo0K:j4iUCaLRpFX2WuxXVtPTEgC+60K
Malware Config
Extracted
darkcomet
summer
qsab98.no-ip.biz:1604
DC_MUTEX-6G9L12L
-
InstallPath
MSDCSC\msdcsc.exe
-
gencode
6QgnJweVD4dH
-
install
true
-
offline_keylogger
true
-
persistence
true
-
reg_key
MicroUpdate
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
Processes:
vbc.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Users\\Admin\\Documents\\MSDCSC\\msdcsc.exe" vbc.exe -
Executes dropped EXE 1 IoCs
Processes:
msdcsc.exepid process 3744 msdcsc.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
28711e96e760a3e740d1bfa3304d86504970fbf8b2184b675774ab3a2148a2f5.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-4060001867-1434967833-2212371794-1000\Control Panel\International\Geo\Nation 28711e96e760a3e740d1bfa3304d86504970fbf8b2184b675774ab3a2148a2f5.exe -
Uses the VBS compiler for execution 1 TTPs
-
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
vbc.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-4060001867-1434967833-2212371794-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Users\\Admin\\Documents\\MSDCSC\\msdcsc.exe" vbc.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
28711e96e760a3e740d1bfa3304d86504970fbf8b2184b675774ab3a2148a2f5.exedescription pid process target process PID 1636 set thread context of 1016 1636 28711e96e760a3e740d1bfa3304d86504970fbf8b2184b675774ab3a2148a2f5.exe vbc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of AdjustPrivilegeToken 24 IoCs
Processes:
vbc.exedescription pid process Token: SeIncreaseQuotaPrivilege 1016 vbc.exe Token: SeSecurityPrivilege 1016 vbc.exe Token: SeTakeOwnershipPrivilege 1016 vbc.exe Token: SeLoadDriverPrivilege 1016 vbc.exe Token: SeSystemProfilePrivilege 1016 vbc.exe Token: SeSystemtimePrivilege 1016 vbc.exe Token: SeProfSingleProcessPrivilege 1016 vbc.exe Token: SeIncBasePriorityPrivilege 1016 vbc.exe Token: SeCreatePagefilePrivilege 1016 vbc.exe Token: SeBackupPrivilege 1016 vbc.exe Token: SeRestorePrivilege 1016 vbc.exe Token: SeShutdownPrivilege 1016 vbc.exe Token: SeDebugPrivilege 1016 vbc.exe Token: SeSystemEnvironmentPrivilege 1016 vbc.exe Token: SeChangeNotifyPrivilege 1016 vbc.exe Token: SeRemoteShutdownPrivilege 1016 vbc.exe Token: SeUndockPrivilege 1016 vbc.exe Token: SeManageVolumePrivilege 1016 vbc.exe Token: SeImpersonatePrivilege 1016 vbc.exe Token: SeCreateGlobalPrivilege 1016 vbc.exe Token: 33 1016 vbc.exe Token: 34 1016 vbc.exe Token: 35 1016 vbc.exe Token: 36 1016 vbc.exe -
Suspicious use of WriteProcessMemory 23 IoCs
Processes:
28711e96e760a3e740d1bfa3304d86504970fbf8b2184b675774ab3a2148a2f5.execmd.exevbc.exedescription pid process target process PID 1636 wrote to memory of 4360 1636 28711e96e760a3e740d1bfa3304d86504970fbf8b2184b675774ab3a2148a2f5.exe cmd.exe PID 1636 wrote to memory of 4360 1636 28711e96e760a3e740d1bfa3304d86504970fbf8b2184b675774ab3a2148a2f5.exe cmd.exe PID 1636 wrote to memory of 4360 1636 28711e96e760a3e740d1bfa3304d86504970fbf8b2184b675774ab3a2148a2f5.exe cmd.exe PID 4360 wrote to memory of 808 4360 cmd.exe choice.exe PID 4360 wrote to memory of 808 4360 cmd.exe choice.exe PID 4360 wrote to memory of 808 4360 cmd.exe choice.exe PID 1636 wrote to memory of 1016 1636 28711e96e760a3e740d1bfa3304d86504970fbf8b2184b675774ab3a2148a2f5.exe vbc.exe PID 1636 wrote to memory of 1016 1636 28711e96e760a3e740d1bfa3304d86504970fbf8b2184b675774ab3a2148a2f5.exe vbc.exe PID 1636 wrote to memory of 1016 1636 28711e96e760a3e740d1bfa3304d86504970fbf8b2184b675774ab3a2148a2f5.exe vbc.exe PID 1636 wrote to memory of 1016 1636 28711e96e760a3e740d1bfa3304d86504970fbf8b2184b675774ab3a2148a2f5.exe vbc.exe PID 1636 wrote to memory of 1016 1636 28711e96e760a3e740d1bfa3304d86504970fbf8b2184b675774ab3a2148a2f5.exe vbc.exe PID 1636 wrote to memory of 1016 1636 28711e96e760a3e740d1bfa3304d86504970fbf8b2184b675774ab3a2148a2f5.exe vbc.exe PID 1636 wrote to memory of 1016 1636 28711e96e760a3e740d1bfa3304d86504970fbf8b2184b675774ab3a2148a2f5.exe vbc.exe PID 1636 wrote to memory of 1016 1636 28711e96e760a3e740d1bfa3304d86504970fbf8b2184b675774ab3a2148a2f5.exe vbc.exe PID 1636 wrote to memory of 1016 1636 28711e96e760a3e740d1bfa3304d86504970fbf8b2184b675774ab3a2148a2f5.exe vbc.exe PID 1636 wrote to memory of 1016 1636 28711e96e760a3e740d1bfa3304d86504970fbf8b2184b675774ab3a2148a2f5.exe vbc.exe PID 1636 wrote to memory of 1016 1636 28711e96e760a3e740d1bfa3304d86504970fbf8b2184b675774ab3a2148a2f5.exe vbc.exe PID 1636 wrote to memory of 1016 1636 28711e96e760a3e740d1bfa3304d86504970fbf8b2184b675774ab3a2148a2f5.exe vbc.exe PID 1636 wrote to memory of 1016 1636 28711e96e760a3e740d1bfa3304d86504970fbf8b2184b675774ab3a2148a2f5.exe vbc.exe PID 1636 wrote to memory of 1016 1636 28711e96e760a3e740d1bfa3304d86504970fbf8b2184b675774ab3a2148a2f5.exe vbc.exe PID 1016 wrote to memory of 3744 1016 vbc.exe msdcsc.exe PID 1016 wrote to memory of 3744 1016 vbc.exe msdcsc.exe PID 1016 wrote to memory of 3744 1016 vbc.exe msdcsc.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\28711e96e760a3e740d1bfa3304d86504970fbf8b2184b675774ab3a2148a2f5.exe"C:\Users\Admin\AppData\Local\Temp\28711e96e760a3e740d1bfa3304d86504970fbf8b2184b675774ab3a2148a2f5.exe"1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del C:\Users\Admin\AppData\Local\Temp\28711e96e760a3e740d1bfa3304d86504970fbf8b2184b675774ab3a2148a2f5.exe2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\choice.exechoice /C Y /N /D Y /T 33⤵
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeC:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe2⤵
- Modifies WinLogon for persistence
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\Documents\MSDCSC\msdcsc.exe"C:\Users\Admin\Documents\MSDCSC\msdcsc.exe"3⤵
- Executes dropped EXE
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\Documents\MSDCSC\msdcsc.exeFilesize
1.1MB
MD5d881de17aa8f2e2c08cbb7b265f928f9
SHA108936aebc87decf0af6e8eada191062b5e65ac2a
SHA256b3a37093609f9a20ad60b85a9fa9de2ba674cba9b5bd687729440c70ba619ca0
SHA5125f23bfb1b8740247b36ed0ab741738c7d4c949736129e767213e321607d1ccd3e3a8428e4ba44bd28a275b5e3f6206285b1a522514b7ef7ea5e698d90a713d34
-
C:\Users\Admin\Documents\MSDCSC\msdcsc.exeFilesize
1.1MB
MD5d881de17aa8f2e2c08cbb7b265f928f9
SHA108936aebc87decf0af6e8eada191062b5e65ac2a
SHA256b3a37093609f9a20ad60b85a9fa9de2ba674cba9b5bd687729440c70ba619ca0
SHA5125f23bfb1b8740247b36ed0ab741738c7d4c949736129e767213e321607d1ccd3e3a8428e4ba44bd28a275b5e3f6206285b1a522514b7ef7ea5e698d90a713d34
-
memory/808-136-0x0000000000000000-mapping.dmp
-
memory/1016-139-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/1016-137-0x0000000000000000-mapping.dmp
-
memory/1016-138-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/1016-140-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/1016-145-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/1636-133-0x0000000075120000-0x00000000756D1000-memory.dmpFilesize
5.7MB
-
memory/1636-141-0x0000000075120000-0x00000000756D1000-memory.dmpFilesize
5.7MB
-
memory/1636-134-0x0000000075120000-0x00000000756D1000-memory.dmpFilesize
5.7MB
-
memory/3744-142-0x0000000000000000-mapping.dmp
-
memory/4360-135-0x0000000000000000-mapping.dmp