Analysis
-
max time kernel
172s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
25-11-2022 07:22
Static task
static1
Behavioral task
behavioral1
Sample
9b6c3d60139b681dfdd5d717b24bf1c66ed5b1f5ec0a98468f86b84be6941915.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
9b6c3d60139b681dfdd5d717b24bf1c66ed5b1f5ec0a98468f86b84be6941915.exe
Resource
win10v2004-20221111-en
General
-
Target
9b6c3d60139b681dfdd5d717b24bf1c66ed5b1f5ec0a98468f86b84be6941915.exe
-
Size
787KB
-
MD5
1f037a54c638eb27d5c098326215c750
-
SHA1
af53cbbdbff190aa5e99e381520758f637d27c7f
-
SHA256
9b6c3d60139b681dfdd5d717b24bf1c66ed5b1f5ec0a98468f86b84be6941915
-
SHA512
14de32e1db8976e2e76b01ed54155ad4af5903cb6ffee09fc72eb4ea0bc75cc57c81a89df6a739b308268f98bbb74a54bf74a06909dffe58d7c4794fc74f3d5a
-
SSDEEP
12288:PGopSuXh1gdooZuPLxHldHlY4ub6n+L+egT3/GT6rjo+ncq4ACE:P6MtuT6n+Hgr/GTAjJaACE
Malware Config
Extracted
darkcomet
Testing
izcrackz.ddns.net:1604
DCMIN_MUTEX-8LL9FA3
-
gencode
xrXebsuQ91rd
-
install
false
-
offline_keylogger
true
-
persistence
false
Signatures
-
Loads dropped DLL 1 IoCs
Processes:
9b6c3d60139b681dfdd5d717b24bf1c66ed5b1f5ec0a98468f86b84be6941915.exepid process 864 9b6c3d60139b681dfdd5d717b24bf1c66ed5b1f5ec0a98468f86b84be6941915.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
reg.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run reg.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\pWWDxxJJmL = "C:\\Users\\Admin\\AppData\\Roaming\\eTTkXyKgim\\SrJnVliUhv.exe.lnk" reg.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
9b6c3d60139b681dfdd5d717b24bf1c66ed5b1f5ec0a98468f86b84be6941915.exedescription pid process target process PID 864 set thread context of 1868 864 9b6c3d60139b681dfdd5d717b24bf1c66ed5b1f5ec0a98468f86b84be6941915.exe 9b6c3d60139b681dfdd5d717b24bf1c66ed5b1f5ec0a98468f86b84be6941915.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
9b6c3d60139b681dfdd5d717b24bf1c66ed5b1f5ec0a98468f86b84be6941915.exepid process 864 9b6c3d60139b681dfdd5d717b24bf1c66ed5b1f5ec0a98468f86b84be6941915.exe -
Suspicious use of AdjustPrivilegeToken 24 IoCs
Processes:
9b6c3d60139b681dfdd5d717b24bf1c66ed5b1f5ec0a98468f86b84be6941915.exe9b6c3d60139b681dfdd5d717b24bf1c66ed5b1f5ec0a98468f86b84be6941915.exedescription pid process Token: SeDebugPrivilege 864 9b6c3d60139b681dfdd5d717b24bf1c66ed5b1f5ec0a98468f86b84be6941915.exe Token: SeIncreaseQuotaPrivilege 1868 9b6c3d60139b681dfdd5d717b24bf1c66ed5b1f5ec0a98468f86b84be6941915.exe Token: SeSecurityPrivilege 1868 9b6c3d60139b681dfdd5d717b24bf1c66ed5b1f5ec0a98468f86b84be6941915.exe Token: SeTakeOwnershipPrivilege 1868 9b6c3d60139b681dfdd5d717b24bf1c66ed5b1f5ec0a98468f86b84be6941915.exe Token: SeLoadDriverPrivilege 1868 9b6c3d60139b681dfdd5d717b24bf1c66ed5b1f5ec0a98468f86b84be6941915.exe Token: SeSystemProfilePrivilege 1868 9b6c3d60139b681dfdd5d717b24bf1c66ed5b1f5ec0a98468f86b84be6941915.exe Token: SeSystemtimePrivilege 1868 9b6c3d60139b681dfdd5d717b24bf1c66ed5b1f5ec0a98468f86b84be6941915.exe Token: SeProfSingleProcessPrivilege 1868 9b6c3d60139b681dfdd5d717b24bf1c66ed5b1f5ec0a98468f86b84be6941915.exe Token: SeIncBasePriorityPrivilege 1868 9b6c3d60139b681dfdd5d717b24bf1c66ed5b1f5ec0a98468f86b84be6941915.exe Token: SeCreatePagefilePrivilege 1868 9b6c3d60139b681dfdd5d717b24bf1c66ed5b1f5ec0a98468f86b84be6941915.exe Token: SeBackupPrivilege 1868 9b6c3d60139b681dfdd5d717b24bf1c66ed5b1f5ec0a98468f86b84be6941915.exe Token: SeRestorePrivilege 1868 9b6c3d60139b681dfdd5d717b24bf1c66ed5b1f5ec0a98468f86b84be6941915.exe Token: SeShutdownPrivilege 1868 9b6c3d60139b681dfdd5d717b24bf1c66ed5b1f5ec0a98468f86b84be6941915.exe Token: SeDebugPrivilege 1868 9b6c3d60139b681dfdd5d717b24bf1c66ed5b1f5ec0a98468f86b84be6941915.exe Token: SeSystemEnvironmentPrivilege 1868 9b6c3d60139b681dfdd5d717b24bf1c66ed5b1f5ec0a98468f86b84be6941915.exe Token: SeChangeNotifyPrivilege 1868 9b6c3d60139b681dfdd5d717b24bf1c66ed5b1f5ec0a98468f86b84be6941915.exe Token: SeRemoteShutdownPrivilege 1868 9b6c3d60139b681dfdd5d717b24bf1c66ed5b1f5ec0a98468f86b84be6941915.exe Token: SeUndockPrivilege 1868 9b6c3d60139b681dfdd5d717b24bf1c66ed5b1f5ec0a98468f86b84be6941915.exe Token: SeManageVolumePrivilege 1868 9b6c3d60139b681dfdd5d717b24bf1c66ed5b1f5ec0a98468f86b84be6941915.exe Token: SeImpersonatePrivilege 1868 9b6c3d60139b681dfdd5d717b24bf1c66ed5b1f5ec0a98468f86b84be6941915.exe Token: SeCreateGlobalPrivilege 1868 9b6c3d60139b681dfdd5d717b24bf1c66ed5b1f5ec0a98468f86b84be6941915.exe Token: 33 1868 9b6c3d60139b681dfdd5d717b24bf1c66ed5b1f5ec0a98468f86b84be6941915.exe Token: 34 1868 9b6c3d60139b681dfdd5d717b24bf1c66ed5b1f5ec0a98468f86b84be6941915.exe Token: 35 1868 9b6c3d60139b681dfdd5d717b24bf1c66ed5b1f5ec0a98468f86b84be6941915.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
9b6c3d60139b681dfdd5d717b24bf1c66ed5b1f5ec0a98468f86b84be6941915.exepid process 1868 9b6c3d60139b681dfdd5d717b24bf1c66ed5b1f5ec0a98468f86b84be6941915.exe -
Suspicious use of WriteProcessMemory 21 IoCs
Processes:
9b6c3d60139b681dfdd5d717b24bf1c66ed5b1f5ec0a98468f86b84be6941915.execmd.exedescription pid process target process PID 864 wrote to memory of 2028 864 9b6c3d60139b681dfdd5d717b24bf1c66ed5b1f5ec0a98468f86b84be6941915.exe cmd.exe PID 864 wrote to memory of 2028 864 9b6c3d60139b681dfdd5d717b24bf1c66ed5b1f5ec0a98468f86b84be6941915.exe cmd.exe PID 864 wrote to memory of 2028 864 9b6c3d60139b681dfdd5d717b24bf1c66ed5b1f5ec0a98468f86b84be6941915.exe cmd.exe PID 864 wrote to memory of 2028 864 9b6c3d60139b681dfdd5d717b24bf1c66ed5b1f5ec0a98468f86b84be6941915.exe cmd.exe PID 2028 wrote to memory of 892 2028 cmd.exe reg.exe PID 2028 wrote to memory of 892 2028 cmd.exe reg.exe PID 2028 wrote to memory of 892 2028 cmd.exe reg.exe PID 2028 wrote to memory of 892 2028 cmd.exe reg.exe PID 864 wrote to memory of 1868 864 9b6c3d60139b681dfdd5d717b24bf1c66ed5b1f5ec0a98468f86b84be6941915.exe 9b6c3d60139b681dfdd5d717b24bf1c66ed5b1f5ec0a98468f86b84be6941915.exe PID 864 wrote to memory of 1868 864 9b6c3d60139b681dfdd5d717b24bf1c66ed5b1f5ec0a98468f86b84be6941915.exe 9b6c3d60139b681dfdd5d717b24bf1c66ed5b1f5ec0a98468f86b84be6941915.exe PID 864 wrote to memory of 1868 864 9b6c3d60139b681dfdd5d717b24bf1c66ed5b1f5ec0a98468f86b84be6941915.exe 9b6c3d60139b681dfdd5d717b24bf1c66ed5b1f5ec0a98468f86b84be6941915.exe PID 864 wrote to memory of 1868 864 9b6c3d60139b681dfdd5d717b24bf1c66ed5b1f5ec0a98468f86b84be6941915.exe 9b6c3d60139b681dfdd5d717b24bf1c66ed5b1f5ec0a98468f86b84be6941915.exe PID 864 wrote to memory of 1868 864 9b6c3d60139b681dfdd5d717b24bf1c66ed5b1f5ec0a98468f86b84be6941915.exe 9b6c3d60139b681dfdd5d717b24bf1c66ed5b1f5ec0a98468f86b84be6941915.exe PID 864 wrote to memory of 1868 864 9b6c3d60139b681dfdd5d717b24bf1c66ed5b1f5ec0a98468f86b84be6941915.exe 9b6c3d60139b681dfdd5d717b24bf1c66ed5b1f5ec0a98468f86b84be6941915.exe PID 864 wrote to memory of 1868 864 9b6c3d60139b681dfdd5d717b24bf1c66ed5b1f5ec0a98468f86b84be6941915.exe 9b6c3d60139b681dfdd5d717b24bf1c66ed5b1f5ec0a98468f86b84be6941915.exe PID 864 wrote to memory of 1868 864 9b6c3d60139b681dfdd5d717b24bf1c66ed5b1f5ec0a98468f86b84be6941915.exe 9b6c3d60139b681dfdd5d717b24bf1c66ed5b1f5ec0a98468f86b84be6941915.exe PID 864 wrote to memory of 1868 864 9b6c3d60139b681dfdd5d717b24bf1c66ed5b1f5ec0a98468f86b84be6941915.exe 9b6c3d60139b681dfdd5d717b24bf1c66ed5b1f5ec0a98468f86b84be6941915.exe PID 864 wrote to memory of 1868 864 9b6c3d60139b681dfdd5d717b24bf1c66ed5b1f5ec0a98468f86b84be6941915.exe 9b6c3d60139b681dfdd5d717b24bf1c66ed5b1f5ec0a98468f86b84be6941915.exe PID 864 wrote to memory of 1868 864 9b6c3d60139b681dfdd5d717b24bf1c66ed5b1f5ec0a98468f86b84be6941915.exe 9b6c3d60139b681dfdd5d717b24bf1c66ed5b1f5ec0a98468f86b84be6941915.exe PID 864 wrote to memory of 1868 864 9b6c3d60139b681dfdd5d717b24bf1c66ed5b1f5ec0a98468f86b84be6941915.exe 9b6c3d60139b681dfdd5d717b24bf1c66ed5b1f5ec0a98468f86b84be6941915.exe PID 864 wrote to memory of 1868 864 9b6c3d60139b681dfdd5d717b24bf1c66ed5b1f5ec0a98468f86b84be6941915.exe 9b6c3d60139b681dfdd5d717b24bf1c66ed5b1f5ec0a98468f86b84be6941915.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\9b6c3d60139b681dfdd5d717b24bf1c66ed5b1f5ec0a98468f86b84be6941915.exe"C:\Users\Admin\AppData\Local\Temp\9b6c3d60139b681dfdd5d717b24bf1c66ed5b1f5ec0a98468f86b84be6941915.exe"1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "pWWDxxJJmL" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\eTTkXyKgim\SrJnVliUhv.exe.lnk"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\reg.exereg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "pWWDxxJJmL" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\eTTkXyKgim\SrJnVliUhv.exe.lnk"3⤵
- Adds Run key to start application
-
C:\Users\Admin\AppData\Local\Temp\9b6c3d60139b681dfdd5d717b24bf1c66ed5b1f5ec0a98468f86b84be6941915.exe"C:\Users\Admin\AppData\Local\Temp\9b6c3d60139b681dfdd5d717b24bf1c66ed5b1f5ec0a98468f86b84be6941915.exe"2⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
\Users\Admin\AppData\Roaming\eTTkXyKgim\SrJnVliUhv.exeFilesize
787KB
MD51f037a54c638eb27d5c098326215c750
SHA1af53cbbdbff190aa5e99e381520758f637d27c7f
SHA2569b6c3d60139b681dfdd5d717b24bf1c66ed5b1f5ec0a98468f86b84be6941915
SHA51214de32e1db8976e2e76b01ed54155ad4af5903cb6ffee09fc72eb4ea0bc75cc57c81a89df6a739b308268f98bbb74a54bf74a06909dffe58d7c4794fc74f3d5a
-
memory/864-54-0x0000000075FB1000-0x0000000075FB3000-memory.dmpFilesize
8KB
-
memory/864-55-0x0000000074800000-0x0000000074DAB000-memory.dmpFilesize
5.7MB
-
memory/864-56-0x0000000000505000-0x0000000000516000-memory.dmpFilesize
68KB
-
memory/864-57-0x0000000074800000-0x0000000074DAB000-memory.dmpFilesize
5.7MB
-
memory/864-79-0x0000000000505000-0x0000000000516000-memory.dmpFilesize
68KB
-
memory/864-78-0x0000000074800000-0x0000000074DAB000-memory.dmpFilesize
5.7MB
-
memory/892-60-0x0000000000000000-mapping.dmp
-
memory/1868-75-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/1868-62-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/1868-66-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/1868-68-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/1868-70-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/1868-71-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/1868-73-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/1868-64-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/1868-76-0x000000000048F888-mapping.dmp
-
memory/1868-77-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/1868-61-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/1868-83-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/1868-81-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/1868-82-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/2028-59-0x0000000000000000-mapping.dmp