Analysis
-
max time kernel
204s -
max time network
209s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
25-11-2022 07:22
Static task
static1
Behavioral task
behavioral1
Sample
9b6c3d60139b681dfdd5d717b24bf1c66ed5b1f5ec0a98468f86b84be6941915.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
9b6c3d60139b681dfdd5d717b24bf1c66ed5b1f5ec0a98468f86b84be6941915.exe
Resource
win10v2004-20221111-en
General
-
Target
9b6c3d60139b681dfdd5d717b24bf1c66ed5b1f5ec0a98468f86b84be6941915.exe
-
Size
787KB
-
MD5
1f037a54c638eb27d5c098326215c750
-
SHA1
af53cbbdbff190aa5e99e381520758f637d27c7f
-
SHA256
9b6c3d60139b681dfdd5d717b24bf1c66ed5b1f5ec0a98468f86b84be6941915
-
SHA512
14de32e1db8976e2e76b01ed54155ad4af5903cb6ffee09fc72eb4ea0bc75cc57c81a89df6a739b308268f98bbb74a54bf74a06909dffe58d7c4794fc74f3d5a
-
SSDEEP
12288:PGopSuXh1gdooZuPLxHldHlY4ub6n+L+egT3/GT6rjo+ncq4ACE:P6MtuT6n+Hgr/GTAjJaACE
Malware Config
Extracted
darkcomet
Testing
izcrackz.ddns.net:1604
DCMIN_MUTEX-8LL9FA3
-
gencode
xrXebsuQ91rd
-
install
false
-
offline_keylogger
true
-
persistence
false
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
9b6c3d60139b681dfdd5d717b24bf1c66ed5b1f5ec0a98468f86b84be6941915.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Control Panel\International\Geo\Nation 9b6c3d60139b681dfdd5d717b24bf1c66ed5b1f5ec0a98468f86b84be6941915.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
reg.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Software\Microsoft\Windows\CurrentVersion\Run reg.exe Set value (str) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\pWWDxxJJmL = "C:\\Users\\Admin\\AppData\\Roaming\\eTTkXyKgim\\SrJnVliUhv.exe.lnk" reg.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
9b6c3d60139b681dfdd5d717b24bf1c66ed5b1f5ec0a98468f86b84be6941915.exedescription pid process target process PID 5108 set thread context of 3048 5108 9b6c3d60139b681dfdd5d717b24bf1c66ed5b1f5ec0a98468f86b84be6941915.exe 9b6c3d60139b681dfdd5d717b24bf1c66ed5b1f5ec0a98468f86b84be6941915.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
9b6c3d60139b681dfdd5d717b24bf1c66ed5b1f5ec0a98468f86b84be6941915.exepid process 5108 9b6c3d60139b681dfdd5d717b24bf1c66ed5b1f5ec0a98468f86b84be6941915.exe 5108 9b6c3d60139b681dfdd5d717b24bf1c66ed5b1f5ec0a98468f86b84be6941915.exe -
Suspicious use of AdjustPrivilegeToken 25 IoCs
Processes:
9b6c3d60139b681dfdd5d717b24bf1c66ed5b1f5ec0a98468f86b84be6941915.exe9b6c3d60139b681dfdd5d717b24bf1c66ed5b1f5ec0a98468f86b84be6941915.exedescription pid process Token: SeDebugPrivilege 5108 9b6c3d60139b681dfdd5d717b24bf1c66ed5b1f5ec0a98468f86b84be6941915.exe Token: SeIncreaseQuotaPrivilege 3048 9b6c3d60139b681dfdd5d717b24bf1c66ed5b1f5ec0a98468f86b84be6941915.exe Token: SeSecurityPrivilege 3048 9b6c3d60139b681dfdd5d717b24bf1c66ed5b1f5ec0a98468f86b84be6941915.exe Token: SeTakeOwnershipPrivilege 3048 9b6c3d60139b681dfdd5d717b24bf1c66ed5b1f5ec0a98468f86b84be6941915.exe Token: SeLoadDriverPrivilege 3048 9b6c3d60139b681dfdd5d717b24bf1c66ed5b1f5ec0a98468f86b84be6941915.exe Token: SeSystemProfilePrivilege 3048 9b6c3d60139b681dfdd5d717b24bf1c66ed5b1f5ec0a98468f86b84be6941915.exe Token: SeSystemtimePrivilege 3048 9b6c3d60139b681dfdd5d717b24bf1c66ed5b1f5ec0a98468f86b84be6941915.exe Token: SeProfSingleProcessPrivilege 3048 9b6c3d60139b681dfdd5d717b24bf1c66ed5b1f5ec0a98468f86b84be6941915.exe Token: SeIncBasePriorityPrivilege 3048 9b6c3d60139b681dfdd5d717b24bf1c66ed5b1f5ec0a98468f86b84be6941915.exe Token: SeCreatePagefilePrivilege 3048 9b6c3d60139b681dfdd5d717b24bf1c66ed5b1f5ec0a98468f86b84be6941915.exe Token: SeBackupPrivilege 3048 9b6c3d60139b681dfdd5d717b24bf1c66ed5b1f5ec0a98468f86b84be6941915.exe Token: SeRestorePrivilege 3048 9b6c3d60139b681dfdd5d717b24bf1c66ed5b1f5ec0a98468f86b84be6941915.exe Token: SeShutdownPrivilege 3048 9b6c3d60139b681dfdd5d717b24bf1c66ed5b1f5ec0a98468f86b84be6941915.exe Token: SeDebugPrivilege 3048 9b6c3d60139b681dfdd5d717b24bf1c66ed5b1f5ec0a98468f86b84be6941915.exe Token: SeSystemEnvironmentPrivilege 3048 9b6c3d60139b681dfdd5d717b24bf1c66ed5b1f5ec0a98468f86b84be6941915.exe Token: SeChangeNotifyPrivilege 3048 9b6c3d60139b681dfdd5d717b24bf1c66ed5b1f5ec0a98468f86b84be6941915.exe Token: SeRemoteShutdownPrivilege 3048 9b6c3d60139b681dfdd5d717b24bf1c66ed5b1f5ec0a98468f86b84be6941915.exe Token: SeUndockPrivilege 3048 9b6c3d60139b681dfdd5d717b24bf1c66ed5b1f5ec0a98468f86b84be6941915.exe Token: SeManageVolumePrivilege 3048 9b6c3d60139b681dfdd5d717b24bf1c66ed5b1f5ec0a98468f86b84be6941915.exe Token: SeImpersonatePrivilege 3048 9b6c3d60139b681dfdd5d717b24bf1c66ed5b1f5ec0a98468f86b84be6941915.exe Token: SeCreateGlobalPrivilege 3048 9b6c3d60139b681dfdd5d717b24bf1c66ed5b1f5ec0a98468f86b84be6941915.exe Token: 33 3048 9b6c3d60139b681dfdd5d717b24bf1c66ed5b1f5ec0a98468f86b84be6941915.exe Token: 34 3048 9b6c3d60139b681dfdd5d717b24bf1c66ed5b1f5ec0a98468f86b84be6941915.exe Token: 35 3048 9b6c3d60139b681dfdd5d717b24bf1c66ed5b1f5ec0a98468f86b84be6941915.exe Token: 36 3048 9b6c3d60139b681dfdd5d717b24bf1c66ed5b1f5ec0a98468f86b84be6941915.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
9b6c3d60139b681dfdd5d717b24bf1c66ed5b1f5ec0a98468f86b84be6941915.exepid process 3048 9b6c3d60139b681dfdd5d717b24bf1c66ed5b1f5ec0a98468f86b84be6941915.exe -
Suspicious use of WriteProcessMemory 18 IoCs
Processes:
9b6c3d60139b681dfdd5d717b24bf1c66ed5b1f5ec0a98468f86b84be6941915.execmd.exedescription pid process target process PID 5108 wrote to memory of 4636 5108 9b6c3d60139b681dfdd5d717b24bf1c66ed5b1f5ec0a98468f86b84be6941915.exe cmd.exe PID 5108 wrote to memory of 4636 5108 9b6c3d60139b681dfdd5d717b24bf1c66ed5b1f5ec0a98468f86b84be6941915.exe cmd.exe PID 5108 wrote to memory of 4636 5108 9b6c3d60139b681dfdd5d717b24bf1c66ed5b1f5ec0a98468f86b84be6941915.exe cmd.exe PID 4636 wrote to memory of 4396 4636 cmd.exe reg.exe PID 4636 wrote to memory of 4396 4636 cmd.exe reg.exe PID 4636 wrote to memory of 4396 4636 cmd.exe reg.exe PID 5108 wrote to memory of 3048 5108 9b6c3d60139b681dfdd5d717b24bf1c66ed5b1f5ec0a98468f86b84be6941915.exe 9b6c3d60139b681dfdd5d717b24bf1c66ed5b1f5ec0a98468f86b84be6941915.exe PID 5108 wrote to memory of 3048 5108 9b6c3d60139b681dfdd5d717b24bf1c66ed5b1f5ec0a98468f86b84be6941915.exe 9b6c3d60139b681dfdd5d717b24bf1c66ed5b1f5ec0a98468f86b84be6941915.exe PID 5108 wrote to memory of 3048 5108 9b6c3d60139b681dfdd5d717b24bf1c66ed5b1f5ec0a98468f86b84be6941915.exe 9b6c3d60139b681dfdd5d717b24bf1c66ed5b1f5ec0a98468f86b84be6941915.exe PID 5108 wrote to memory of 3048 5108 9b6c3d60139b681dfdd5d717b24bf1c66ed5b1f5ec0a98468f86b84be6941915.exe 9b6c3d60139b681dfdd5d717b24bf1c66ed5b1f5ec0a98468f86b84be6941915.exe PID 5108 wrote to memory of 3048 5108 9b6c3d60139b681dfdd5d717b24bf1c66ed5b1f5ec0a98468f86b84be6941915.exe 9b6c3d60139b681dfdd5d717b24bf1c66ed5b1f5ec0a98468f86b84be6941915.exe PID 5108 wrote to memory of 3048 5108 9b6c3d60139b681dfdd5d717b24bf1c66ed5b1f5ec0a98468f86b84be6941915.exe 9b6c3d60139b681dfdd5d717b24bf1c66ed5b1f5ec0a98468f86b84be6941915.exe PID 5108 wrote to memory of 3048 5108 9b6c3d60139b681dfdd5d717b24bf1c66ed5b1f5ec0a98468f86b84be6941915.exe 9b6c3d60139b681dfdd5d717b24bf1c66ed5b1f5ec0a98468f86b84be6941915.exe PID 5108 wrote to memory of 3048 5108 9b6c3d60139b681dfdd5d717b24bf1c66ed5b1f5ec0a98468f86b84be6941915.exe 9b6c3d60139b681dfdd5d717b24bf1c66ed5b1f5ec0a98468f86b84be6941915.exe PID 5108 wrote to memory of 3048 5108 9b6c3d60139b681dfdd5d717b24bf1c66ed5b1f5ec0a98468f86b84be6941915.exe 9b6c3d60139b681dfdd5d717b24bf1c66ed5b1f5ec0a98468f86b84be6941915.exe PID 5108 wrote to memory of 3048 5108 9b6c3d60139b681dfdd5d717b24bf1c66ed5b1f5ec0a98468f86b84be6941915.exe 9b6c3d60139b681dfdd5d717b24bf1c66ed5b1f5ec0a98468f86b84be6941915.exe PID 5108 wrote to memory of 3048 5108 9b6c3d60139b681dfdd5d717b24bf1c66ed5b1f5ec0a98468f86b84be6941915.exe 9b6c3d60139b681dfdd5d717b24bf1c66ed5b1f5ec0a98468f86b84be6941915.exe PID 5108 wrote to memory of 3048 5108 9b6c3d60139b681dfdd5d717b24bf1c66ed5b1f5ec0a98468f86b84be6941915.exe 9b6c3d60139b681dfdd5d717b24bf1c66ed5b1f5ec0a98468f86b84be6941915.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\9b6c3d60139b681dfdd5d717b24bf1c66ed5b1f5ec0a98468f86b84be6941915.exe"C:\Users\Admin\AppData\Local\Temp\9b6c3d60139b681dfdd5d717b24bf1c66ed5b1f5ec0a98468f86b84be6941915.exe"1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5108 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "pWWDxxJJmL" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\eTTkXyKgim\SrJnVliUhv.exe.lnk"2⤵
- Suspicious use of WriteProcessMemory
PID:4636 -
C:\Windows\SysWOW64\reg.exereg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "pWWDxxJJmL" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\eTTkXyKgim\SrJnVliUhv.exe.lnk"3⤵
- Adds Run key to start application
PID:4396 -
C:\Users\Admin\AppData\Local\Temp\9b6c3d60139b681dfdd5d717b24bf1c66ed5b1f5ec0a98468f86b84be6941915.exe"C:\Users\Admin\AppData\Local\Temp\9b6c3d60139b681dfdd5d717b24bf1c66ed5b1f5ec0a98468f86b84be6941915.exe"2⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:3048
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/3048-136-0x0000000000000000-mapping.dmp
-
memory/3048-137-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/3048-138-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/3048-139-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/3048-141-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/3048-142-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/4396-135-0x0000000000000000-mapping.dmp
-
memory/4636-134-0x0000000000000000-mapping.dmp
-
memory/5108-132-0x0000000074DE0000-0x0000000075391000-memory.dmpFilesize
5.7MB
-
memory/5108-133-0x0000000074DE0000-0x0000000075391000-memory.dmpFilesize
5.7MB
-
memory/5108-140-0x0000000074DE0000-0x0000000075391000-memory.dmpFilesize
5.7MB