Analysis
-
max time kernel
151s -
max time network
53s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
25-11-2022 07:26
Static task
static1
Behavioral task
behavioral1
Sample
94083535c21ab05d2f041cf7b99da107adb38c8a871163305f4027ebf389c686.exe
Resource
win7-20220812-en
General
-
Target
94083535c21ab05d2f041cf7b99da107adb38c8a871163305f4027ebf389c686.exe
-
Size
873KB
-
MD5
30579e0d9d850264acc6019518fcd1a8
-
SHA1
4b978cdfbe709286814040d65b757db967d3897a
-
SHA256
94083535c21ab05d2f041cf7b99da107adb38c8a871163305f4027ebf389c686
-
SHA512
44a3bdf0c26e727b96a88e9d35616a5b6efabdd228c590fed2107dbdac02cfc47b9722bae805cc3fef863913b0e18b34e02e3d6837cbd9ca9fd84aa08ed7eff3
-
SSDEEP
12288:2GopSuXh1gducHobZ5TTXraU4RFH4nQFAvQsg1W98a/Xcg5P0wf7:2x7baPF6QFAvSW986j007
Malware Config
Extracted
darkcomet
Guest16
kelvindrk.no-ip.biz:1008
DC_MUTEX-DXAW4U7
-
InstallPath
MSDCSC\msdcsc.exe
-
gencode
B7nmveDZ5jn1
-
install
true
-
offline_keylogger
true
-
persistence
true
-
reg_key
MicroUpdate
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
Processes:
94083535c21ab05d2f041cf7b99da107adb38c8a871163305f4027ebf389c686.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Users\\Admin\\Documents\\MSDCSC\\msdcsc.exe" 94083535c21ab05d2f041cf7b99da107adb38c8a871163305f4027ebf389c686.exe -
Executes dropped EXE 2 IoCs
Processes:
msdcsc.exemsdcsc.exepid process 556 msdcsc.exe 1044 msdcsc.exe -
Loads dropped DLL 1 IoCs
Processes:
94083535c21ab05d2f041cf7b99da107adb38c8a871163305f4027ebf389c686.exepid process 1928 94083535c21ab05d2f041cf7b99da107adb38c8a871163305f4027ebf389c686.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
94083535c21ab05d2f041cf7b99da107adb38c8a871163305f4027ebf389c686.exemsdcsc.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Users\\Admin\\Documents\\MSDCSC\\msdcsc.exe" 94083535c21ab05d2f041cf7b99da107adb38c8a871163305f4027ebf389c686.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Users\\Admin\\Documents\\MSDCSC\\msdcsc.exe" msdcsc.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
94083535c21ab05d2f041cf7b99da107adb38c8a871163305f4027ebf389c686.exemsdcsc.exedescription pid process target process PID 1972 set thread context of 1928 1972 94083535c21ab05d2f041cf7b99da107adb38c8a871163305f4027ebf389c686.exe 94083535c21ab05d2f041cf7b99da107adb38c8a871163305f4027ebf389c686.exe PID 556 set thread context of 1044 556 msdcsc.exe msdcsc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
94083535c21ab05d2f041cf7b99da107adb38c8a871163305f4027ebf389c686.exemsdcsc.exepid process 1972 94083535c21ab05d2f041cf7b99da107adb38c8a871163305f4027ebf389c686.exe 556 msdcsc.exe -
Suspicious use of AdjustPrivilegeToken 48 IoCs
Processes:
94083535c21ab05d2f041cf7b99da107adb38c8a871163305f4027ebf389c686.exe94083535c21ab05d2f041cf7b99da107adb38c8a871163305f4027ebf389c686.exemsdcsc.exemsdcsc.exedescription pid process Token: SeDebugPrivilege 1972 94083535c21ab05d2f041cf7b99da107adb38c8a871163305f4027ebf389c686.exe Token: SeIncreaseQuotaPrivilege 1928 94083535c21ab05d2f041cf7b99da107adb38c8a871163305f4027ebf389c686.exe Token: SeSecurityPrivilege 1928 94083535c21ab05d2f041cf7b99da107adb38c8a871163305f4027ebf389c686.exe Token: SeTakeOwnershipPrivilege 1928 94083535c21ab05d2f041cf7b99da107adb38c8a871163305f4027ebf389c686.exe Token: SeLoadDriverPrivilege 1928 94083535c21ab05d2f041cf7b99da107adb38c8a871163305f4027ebf389c686.exe Token: SeSystemProfilePrivilege 1928 94083535c21ab05d2f041cf7b99da107adb38c8a871163305f4027ebf389c686.exe Token: SeSystemtimePrivilege 1928 94083535c21ab05d2f041cf7b99da107adb38c8a871163305f4027ebf389c686.exe Token: SeProfSingleProcessPrivilege 1928 94083535c21ab05d2f041cf7b99da107adb38c8a871163305f4027ebf389c686.exe Token: SeIncBasePriorityPrivilege 1928 94083535c21ab05d2f041cf7b99da107adb38c8a871163305f4027ebf389c686.exe Token: SeCreatePagefilePrivilege 1928 94083535c21ab05d2f041cf7b99da107adb38c8a871163305f4027ebf389c686.exe Token: SeBackupPrivilege 1928 94083535c21ab05d2f041cf7b99da107adb38c8a871163305f4027ebf389c686.exe Token: SeRestorePrivilege 1928 94083535c21ab05d2f041cf7b99da107adb38c8a871163305f4027ebf389c686.exe Token: SeShutdownPrivilege 1928 94083535c21ab05d2f041cf7b99da107adb38c8a871163305f4027ebf389c686.exe Token: SeDebugPrivilege 1928 94083535c21ab05d2f041cf7b99da107adb38c8a871163305f4027ebf389c686.exe Token: SeSystemEnvironmentPrivilege 1928 94083535c21ab05d2f041cf7b99da107adb38c8a871163305f4027ebf389c686.exe Token: SeChangeNotifyPrivilege 1928 94083535c21ab05d2f041cf7b99da107adb38c8a871163305f4027ebf389c686.exe Token: SeRemoteShutdownPrivilege 1928 94083535c21ab05d2f041cf7b99da107adb38c8a871163305f4027ebf389c686.exe Token: SeUndockPrivilege 1928 94083535c21ab05d2f041cf7b99da107adb38c8a871163305f4027ebf389c686.exe Token: SeManageVolumePrivilege 1928 94083535c21ab05d2f041cf7b99da107adb38c8a871163305f4027ebf389c686.exe Token: SeImpersonatePrivilege 1928 94083535c21ab05d2f041cf7b99da107adb38c8a871163305f4027ebf389c686.exe Token: SeCreateGlobalPrivilege 1928 94083535c21ab05d2f041cf7b99da107adb38c8a871163305f4027ebf389c686.exe Token: 33 1928 94083535c21ab05d2f041cf7b99da107adb38c8a871163305f4027ebf389c686.exe Token: 34 1928 94083535c21ab05d2f041cf7b99da107adb38c8a871163305f4027ebf389c686.exe Token: 35 1928 94083535c21ab05d2f041cf7b99da107adb38c8a871163305f4027ebf389c686.exe Token: SeDebugPrivilege 556 msdcsc.exe Token: SeIncreaseQuotaPrivilege 1044 msdcsc.exe Token: SeSecurityPrivilege 1044 msdcsc.exe Token: SeTakeOwnershipPrivilege 1044 msdcsc.exe Token: SeLoadDriverPrivilege 1044 msdcsc.exe Token: SeSystemProfilePrivilege 1044 msdcsc.exe Token: SeSystemtimePrivilege 1044 msdcsc.exe Token: SeProfSingleProcessPrivilege 1044 msdcsc.exe Token: SeIncBasePriorityPrivilege 1044 msdcsc.exe Token: SeCreatePagefilePrivilege 1044 msdcsc.exe Token: SeBackupPrivilege 1044 msdcsc.exe Token: SeRestorePrivilege 1044 msdcsc.exe Token: SeShutdownPrivilege 1044 msdcsc.exe Token: SeDebugPrivilege 1044 msdcsc.exe Token: SeSystemEnvironmentPrivilege 1044 msdcsc.exe Token: SeChangeNotifyPrivilege 1044 msdcsc.exe Token: SeRemoteShutdownPrivilege 1044 msdcsc.exe Token: SeUndockPrivilege 1044 msdcsc.exe Token: SeManageVolumePrivilege 1044 msdcsc.exe Token: SeImpersonatePrivilege 1044 msdcsc.exe Token: SeCreateGlobalPrivilege 1044 msdcsc.exe Token: 33 1044 msdcsc.exe Token: 34 1044 msdcsc.exe Token: 35 1044 msdcsc.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
msdcsc.exepid process 1044 msdcsc.exe -
Suspicious use of WriteProcessMemory 30 IoCs
Processes:
94083535c21ab05d2f041cf7b99da107adb38c8a871163305f4027ebf389c686.exe94083535c21ab05d2f041cf7b99da107adb38c8a871163305f4027ebf389c686.exemsdcsc.exedescription pid process target process PID 1972 wrote to memory of 1928 1972 94083535c21ab05d2f041cf7b99da107adb38c8a871163305f4027ebf389c686.exe 94083535c21ab05d2f041cf7b99da107adb38c8a871163305f4027ebf389c686.exe PID 1972 wrote to memory of 1928 1972 94083535c21ab05d2f041cf7b99da107adb38c8a871163305f4027ebf389c686.exe 94083535c21ab05d2f041cf7b99da107adb38c8a871163305f4027ebf389c686.exe PID 1972 wrote to memory of 1928 1972 94083535c21ab05d2f041cf7b99da107adb38c8a871163305f4027ebf389c686.exe 94083535c21ab05d2f041cf7b99da107adb38c8a871163305f4027ebf389c686.exe PID 1972 wrote to memory of 1928 1972 94083535c21ab05d2f041cf7b99da107adb38c8a871163305f4027ebf389c686.exe 94083535c21ab05d2f041cf7b99da107adb38c8a871163305f4027ebf389c686.exe PID 1972 wrote to memory of 1928 1972 94083535c21ab05d2f041cf7b99da107adb38c8a871163305f4027ebf389c686.exe 94083535c21ab05d2f041cf7b99da107adb38c8a871163305f4027ebf389c686.exe PID 1972 wrote to memory of 1928 1972 94083535c21ab05d2f041cf7b99da107adb38c8a871163305f4027ebf389c686.exe 94083535c21ab05d2f041cf7b99da107adb38c8a871163305f4027ebf389c686.exe PID 1972 wrote to memory of 1928 1972 94083535c21ab05d2f041cf7b99da107adb38c8a871163305f4027ebf389c686.exe 94083535c21ab05d2f041cf7b99da107adb38c8a871163305f4027ebf389c686.exe PID 1972 wrote to memory of 1928 1972 94083535c21ab05d2f041cf7b99da107adb38c8a871163305f4027ebf389c686.exe 94083535c21ab05d2f041cf7b99da107adb38c8a871163305f4027ebf389c686.exe PID 1972 wrote to memory of 1928 1972 94083535c21ab05d2f041cf7b99da107adb38c8a871163305f4027ebf389c686.exe 94083535c21ab05d2f041cf7b99da107adb38c8a871163305f4027ebf389c686.exe PID 1972 wrote to memory of 1928 1972 94083535c21ab05d2f041cf7b99da107adb38c8a871163305f4027ebf389c686.exe 94083535c21ab05d2f041cf7b99da107adb38c8a871163305f4027ebf389c686.exe PID 1972 wrote to memory of 1928 1972 94083535c21ab05d2f041cf7b99da107adb38c8a871163305f4027ebf389c686.exe 94083535c21ab05d2f041cf7b99da107adb38c8a871163305f4027ebf389c686.exe PID 1972 wrote to memory of 1928 1972 94083535c21ab05d2f041cf7b99da107adb38c8a871163305f4027ebf389c686.exe 94083535c21ab05d2f041cf7b99da107adb38c8a871163305f4027ebf389c686.exe PID 1972 wrote to memory of 1928 1972 94083535c21ab05d2f041cf7b99da107adb38c8a871163305f4027ebf389c686.exe 94083535c21ab05d2f041cf7b99da107adb38c8a871163305f4027ebf389c686.exe PID 1928 wrote to memory of 556 1928 94083535c21ab05d2f041cf7b99da107adb38c8a871163305f4027ebf389c686.exe msdcsc.exe PID 1928 wrote to memory of 556 1928 94083535c21ab05d2f041cf7b99da107adb38c8a871163305f4027ebf389c686.exe msdcsc.exe PID 1928 wrote to memory of 556 1928 94083535c21ab05d2f041cf7b99da107adb38c8a871163305f4027ebf389c686.exe msdcsc.exe PID 1928 wrote to memory of 556 1928 94083535c21ab05d2f041cf7b99da107adb38c8a871163305f4027ebf389c686.exe msdcsc.exe PID 556 wrote to memory of 1044 556 msdcsc.exe msdcsc.exe PID 556 wrote to memory of 1044 556 msdcsc.exe msdcsc.exe PID 556 wrote to memory of 1044 556 msdcsc.exe msdcsc.exe PID 556 wrote to memory of 1044 556 msdcsc.exe msdcsc.exe PID 556 wrote to memory of 1044 556 msdcsc.exe msdcsc.exe PID 556 wrote to memory of 1044 556 msdcsc.exe msdcsc.exe PID 556 wrote to memory of 1044 556 msdcsc.exe msdcsc.exe PID 556 wrote to memory of 1044 556 msdcsc.exe msdcsc.exe PID 556 wrote to memory of 1044 556 msdcsc.exe msdcsc.exe PID 556 wrote to memory of 1044 556 msdcsc.exe msdcsc.exe PID 556 wrote to memory of 1044 556 msdcsc.exe msdcsc.exe PID 556 wrote to memory of 1044 556 msdcsc.exe msdcsc.exe PID 556 wrote to memory of 1044 556 msdcsc.exe msdcsc.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\94083535c21ab05d2f041cf7b99da107adb38c8a871163305f4027ebf389c686.exe"C:\Users\Admin\AppData\Local\Temp\94083535c21ab05d2f041cf7b99da107adb38c8a871163305f4027ebf389c686.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\94083535c21ab05d2f041cf7b99da107adb38c8a871163305f4027ebf389c686.exe"C:\Users\Admin\AppData\Local\Temp\94083535c21ab05d2f041cf7b99da107adb38c8a871163305f4027ebf389c686.exe"2⤵
- Modifies WinLogon for persistence
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\Documents\MSDCSC\msdcsc.exe"C:\Users\Admin\Documents\MSDCSC\msdcsc.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\Documents\MSDCSC\msdcsc.exe"C:\Users\Admin\Documents\MSDCSC\msdcsc.exe"4⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\Documents\MSDCSC\msdcsc.exeFilesize
873KB
MD530579e0d9d850264acc6019518fcd1a8
SHA14b978cdfbe709286814040d65b757db967d3897a
SHA25694083535c21ab05d2f041cf7b99da107adb38c8a871163305f4027ebf389c686
SHA51244a3bdf0c26e727b96a88e9d35616a5b6efabdd228c590fed2107dbdac02cfc47b9722bae805cc3fef863913b0e18b34e02e3d6837cbd9ca9fd84aa08ed7eff3
-
C:\Users\Admin\Documents\MSDCSC\msdcsc.exeFilesize
873KB
MD530579e0d9d850264acc6019518fcd1a8
SHA14b978cdfbe709286814040d65b757db967d3897a
SHA25694083535c21ab05d2f041cf7b99da107adb38c8a871163305f4027ebf389c686
SHA51244a3bdf0c26e727b96a88e9d35616a5b6efabdd228c590fed2107dbdac02cfc47b9722bae805cc3fef863913b0e18b34e02e3d6837cbd9ca9fd84aa08ed7eff3
-
C:\Users\Admin\Documents\MSDCSC\msdcsc.exeFilesize
873KB
MD530579e0d9d850264acc6019518fcd1a8
SHA14b978cdfbe709286814040d65b757db967d3897a
SHA25694083535c21ab05d2f041cf7b99da107adb38c8a871163305f4027ebf389c686
SHA51244a3bdf0c26e727b96a88e9d35616a5b6efabdd228c590fed2107dbdac02cfc47b9722bae805cc3fef863913b0e18b34e02e3d6837cbd9ca9fd84aa08ed7eff3
-
\Users\Admin\Documents\MSDCSC\msdcsc.exeFilesize
873KB
MD530579e0d9d850264acc6019518fcd1a8
SHA14b978cdfbe709286814040d65b757db967d3897a
SHA25694083535c21ab05d2f041cf7b99da107adb38c8a871163305f4027ebf389c686
SHA51244a3bdf0c26e727b96a88e9d35616a5b6efabdd228c590fed2107dbdac02cfc47b9722bae805cc3fef863913b0e18b34e02e3d6837cbd9ca9fd84aa08ed7eff3
-
memory/556-102-0x0000000073D10000-0x00000000742BB000-memory.dmpFilesize
5.7MB
-
memory/556-80-0x0000000000000000-mapping.dmp
-
memory/556-104-0x00000000008C5000-0x00000000008D6000-memory.dmpFilesize
68KB
-
memory/1044-106-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/1044-108-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/1044-99-0x000000000048F888-mapping.dmp
-
memory/1928-63-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/1928-78-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/1928-72-0x000000000048F888-mapping.dmp
-
memory/1928-73-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/1928-69-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/1928-67-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/1928-77-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/1928-71-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/1928-66-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/1928-107-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/1928-61-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/1928-59-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/1928-57-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/1928-56-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/1972-65-0x0000000002225000-0x0000000002236000-memory.dmpFilesize
68KB
-
memory/1972-76-0x0000000002225000-0x0000000002236000-memory.dmpFilesize
68KB
-
memory/1972-75-0x0000000074340000-0x00000000748EB000-memory.dmpFilesize
5.7MB
-
memory/1972-54-0x0000000075981000-0x0000000075983000-memory.dmpFilesize
8KB
-
memory/1972-55-0x0000000074340000-0x00000000748EB000-memory.dmpFilesize
5.7MB