Analysis

  • max time kernel
    150s
  • max time network
    49s
  • platform
    windows7_x64
  • resource
    win7-20220901-en
  • resource tags

    arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
  • submitted
    25-11-2022 19:34

General

  • Target

    d64c5845a7fee27ab6942e582101c6a7c02e8df5341eaeaf6e71b7a4cb9f4e5d.exe

  • Size

    1.1MB

  • MD5

    5215daaf249f78c9b132f1563bc4248e

  • SHA1

    a5e64d9f47c56f8aa9ad5ad5bf8f52ab66da9ec5

  • SHA256

    d64c5845a7fee27ab6942e582101c6a7c02e8df5341eaeaf6e71b7a4cb9f4e5d

  • SHA512

    9da26d64021173bdaf4460d6f926e8af4a9af99f0ed9721e5df90fc7b20b687bf200b58b9faa2f0d4e5cff58e847abd16714d22120a29f82c760971c096b5f2e

  • SSDEEP

    12288:ACrnoS0SkBEkazsG2sBpAY9QxLmpl2Ofe8KFFU0H/42fG31oVekukHzIOI8AAf3k:3CA+4pAYnKFFVH/01ytYf8Amse/edoa

Malware Config

Extracted

Family

darkcomet

Botnet

BOT

C2

webshark.sytes.net:42250

Mutex

DC_MUTEX-9KT7NBA

Attributes
  • InstallPath

    MSDCSC\msdcsc.exe

  • gencode

    ptRibxwp6WD9

  • install

    true

  • offline_keylogger

    false

  • password

    pignouf64

  • persistence

    false

  • reg_key

    MicroUpdate

Signatures

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

  • ISR Stealer

    ISR Stealer is a modified version of Hackhound Stealer written in visual basic.

  • ISR Stealer payload 7 IoCs
  • Modifies WinLogon for persistence 2 TTPs 1 IoCs
  • Executes dropped EXE 4 IoCs
  • UPX packed file 13 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Loads dropped DLL 6 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious use of AdjustPrivilegeToken 46 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of WriteProcessMemory 28 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\d64c5845a7fee27ab6942e582101c6a7c02e8df5341eaeaf6e71b7a4cb9f4e5d.exe
    "C:\Users\Admin\AppData\Local\Temp\d64c5845a7fee27ab6942e582101c6a7c02e8df5341eaeaf6e71b7a4cb9f4e5d.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of SetThreadContext
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1492
    • C:\Users\Admin\AppData\Local\Temp\ISR 0.4.exe
      "C:\Users\Admin\AppData\Local\Temp\ISR 0.4.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of SetWindowsHookEx
      PID:1684
    • C:\Users\Admin\AppData\Local\Temp\d64c5845a7fee27ab6942e582101c6a7c02e8df5341eaeaf6e71b7a4cb9f4e5d.exe
      "C:\Users\Admin\AppData\Local\Temp\d64c5845a7fee27ab6942e582101c6a7c02e8df5341eaeaf6e71b7a4cb9f4e5d.exe"
      2⤵
      • Modifies WinLogon for persistence
      • Loads dropped DLL
      • Adds Run key to start application
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:296
      • C:\Users\Admin\Documents\MSDCSC\msdcsc.exe
        "C:\Users\Admin\Documents\MSDCSC\msdcsc.exe"
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious use of SetThreadContext
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:1136
        • C:\Users\Admin\AppData\Local\Temp\ISR 0.4.exe
          "C:\Users\Admin\AppData\Local\Temp\ISR 0.4.exe"
          4⤵
          • Executes dropped EXE
          • Suspicious use of SetWindowsHookEx
          PID:560
        • C:\Users\Admin\Documents\MSDCSC\msdcsc.exe
          "C:\Users\Admin\Documents\MSDCSC\msdcsc.exe"
          4⤵
          • Executes dropped EXE
          • Suspicious use of AdjustPrivilegeToken
          PID:1568

Network

MITRE ATT&CK Matrix ATT&CK v6

Persistence

Winlogon Helper DLL

1
T1004

Registry Run Keys / Startup Folder

1
T1060

Defense Evasion

Modify Registry

2
T1112

Discovery

System Information Discovery

1
T1082

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\ISR 0.4.exe
    Filesize

    736KB

    MD5

    929d26941c8ef2a5cdd46df11d9c178f

    SHA1

    58e24462fcb894599010d32187b72416cd939590

    SHA256

    cecd0ff74e6bde2773bbea2a2f00de02799d45c050a4eecba9e53afa7c1cb625

    SHA512

    21f2cf0b8560dbde07de6460f85725f589e5d560650bb892f38cca589534618c7567b9935a07f0f4212720f0bc729e5b2e87ed7895c53293f743b1f5a5bd2327

  • C:\Users\Admin\AppData\Local\Temp\ISR 0.4.exe
    Filesize

    736KB

    MD5

    929d26941c8ef2a5cdd46df11d9c178f

    SHA1

    58e24462fcb894599010d32187b72416cd939590

    SHA256

    cecd0ff74e6bde2773bbea2a2f00de02799d45c050a4eecba9e53afa7c1cb625

    SHA512

    21f2cf0b8560dbde07de6460f85725f589e5d560650bb892f38cca589534618c7567b9935a07f0f4212720f0bc729e5b2e87ed7895c53293f743b1f5a5bd2327

  • C:\Users\Admin\AppData\Local\Temp\ISR 0.4.exe
    Filesize

    736KB

    MD5

    929d26941c8ef2a5cdd46df11d9c178f

    SHA1

    58e24462fcb894599010d32187b72416cd939590

    SHA256

    cecd0ff74e6bde2773bbea2a2f00de02799d45c050a4eecba9e53afa7c1cb625

    SHA512

    21f2cf0b8560dbde07de6460f85725f589e5d560650bb892f38cca589534618c7567b9935a07f0f4212720f0bc729e5b2e87ed7895c53293f743b1f5a5bd2327

  • C:\Users\Admin\Documents\MSDCSC\msdcsc.exe
    Filesize

    1.1MB

    MD5

    5215daaf249f78c9b132f1563bc4248e

    SHA1

    a5e64d9f47c56f8aa9ad5ad5bf8f52ab66da9ec5

    SHA256

    d64c5845a7fee27ab6942e582101c6a7c02e8df5341eaeaf6e71b7a4cb9f4e5d

    SHA512

    9da26d64021173bdaf4460d6f926e8af4a9af99f0ed9721e5df90fc7b20b687bf200b58b9faa2f0d4e5cff58e847abd16714d22120a29f82c760971c096b5f2e

  • C:\Users\Admin\Documents\MSDCSC\msdcsc.exe
    Filesize

    1.1MB

    MD5

    5215daaf249f78c9b132f1563bc4248e

    SHA1

    a5e64d9f47c56f8aa9ad5ad5bf8f52ab66da9ec5

    SHA256

    d64c5845a7fee27ab6942e582101c6a7c02e8df5341eaeaf6e71b7a4cb9f4e5d

    SHA512

    9da26d64021173bdaf4460d6f926e8af4a9af99f0ed9721e5df90fc7b20b687bf200b58b9faa2f0d4e5cff58e847abd16714d22120a29f82c760971c096b5f2e

  • C:\Users\Admin\Documents\MSDCSC\msdcsc.exe
    Filesize

    1.1MB

    MD5

    5215daaf249f78c9b132f1563bc4248e

    SHA1

    a5e64d9f47c56f8aa9ad5ad5bf8f52ab66da9ec5

    SHA256

    d64c5845a7fee27ab6942e582101c6a7c02e8df5341eaeaf6e71b7a4cb9f4e5d

    SHA512

    9da26d64021173bdaf4460d6f926e8af4a9af99f0ed9721e5df90fc7b20b687bf200b58b9faa2f0d4e5cff58e847abd16714d22120a29f82c760971c096b5f2e

  • \Users\Admin\AppData\Local\Temp\ISR 0.4.exe
    Filesize

    736KB

    MD5

    929d26941c8ef2a5cdd46df11d9c178f

    SHA1

    58e24462fcb894599010d32187b72416cd939590

    SHA256

    cecd0ff74e6bde2773bbea2a2f00de02799d45c050a4eecba9e53afa7c1cb625

    SHA512

    21f2cf0b8560dbde07de6460f85725f589e5d560650bb892f38cca589534618c7567b9935a07f0f4212720f0bc729e5b2e87ed7895c53293f743b1f5a5bd2327

  • \Users\Admin\AppData\Local\Temp\ISR 0.4.exe
    Filesize

    736KB

    MD5

    929d26941c8ef2a5cdd46df11d9c178f

    SHA1

    58e24462fcb894599010d32187b72416cd939590

    SHA256

    cecd0ff74e6bde2773bbea2a2f00de02799d45c050a4eecba9e53afa7c1cb625

    SHA512

    21f2cf0b8560dbde07de6460f85725f589e5d560650bb892f38cca589534618c7567b9935a07f0f4212720f0bc729e5b2e87ed7895c53293f743b1f5a5bd2327

  • \Users\Admin\AppData\Local\Temp\ISR 0.4.exe
    Filesize

    736KB

    MD5

    929d26941c8ef2a5cdd46df11d9c178f

    SHA1

    58e24462fcb894599010d32187b72416cd939590

    SHA256

    cecd0ff74e6bde2773bbea2a2f00de02799d45c050a4eecba9e53afa7c1cb625

    SHA512

    21f2cf0b8560dbde07de6460f85725f589e5d560650bb892f38cca589534618c7567b9935a07f0f4212720f0bc729e5b2e87ed7895c53293f743b1f5a5bd2327

  • \Users\Admin\AppData\Local\Temp\ISR 0.4.exe
    Filesize

    736KB

    MD5

    929d26941c8ef2a5cdd46df11d9c178f

    SHA1

    58e24462fcb894599010d32187b72416cd939590

    SHA256

    cecd0ff74e6bde2773bbea2a2f00de02799d45c050a4eecba9e53afa7c1cb625

    SHA512

    21f2cf0b8560dbde07de6460f85725f589e5d560650bb892f38cca589534618c7567b9935a07f0f4212720f0bc729e5b2e87ed7895c53293f743b1f5a5bd2327

  • \Users\Admin\Documents\MSDCSC\msdcsc.exe
    Filesize

    1.1MB

    MD5

    5215daaf249f78c9b132f1563bc4248e

    SHA1

    a5e64d9f47c56f8aa9ad5ad5bf8f52ab66da9ec5

    SHA256

    d64c5845a7fee27ab6942e582101c6a7c02e8df5341eaeaf6e71b7a4cb9f4e5d

    SHA512

    9da26d64021173bdaf4460d6f926e8af4a9af99f0ed9721e5df90fc7b20b687bf200b58b9faa2f0d4e5cff58e847abd16714d22120a29f82c760971c096b5f2e

  • \Users\Admin\Documents\MSDCSC\msdcsc.exe
    Filesize

    1.1MB

    MD5

    5215daaf249f78c9b132f1563bc4248e

    SHA1

    a5e64d9f47c56f8aa9ad5ad5bf8f52ab66da9ec5

    SHA256

    d64c5845a7fee27ab6942e582101c6a7c02e8df5341eaeaf6e71b7a4cb9f4e5d

    SHA512

    9da26d64021173bdaf4460d6f926e8af4a9af99f0ed9721e5df90fc7b20b687bf200b58b9faa2f0d4e5cff58e847abd16714d22120a29f82c760971c096b5f2e

  • memory/296-78-0x0000000000400000-0x00000000004BA000-memory.dmp
    Filesize

    744KB

  • memory/296-73-0x0000000000400000-0x00000000004BA000-memory.dmp
    Filesize

    744KB

  • memory/296-64-0x0000000000400000-0x00000000004BA000-memory.dmp
    Filesize

    744KB

  • memory/296-72-0x0000000000400000-0x00000000004BA000-memory.dmp
    Filesize

    744KB

  • memory/296-65-0x0000000000400000-0x00000000004BA000-memory.dmp
    Filesize

    744KB

  • memory/296-70-0x0000000000400000-0x00000000004BA000-memory.dmp
    Filesize

    744KB

  • memory/296-69-0x00000000004B8CC0-mapping.dmp
  • memory/296-68-0x0000000000400000-0x00000000004BA000-memory.dmp
    Filesize

    744KB

  • memory/296-67-0x0000000000400000-0x00000000004BA000-memory.dmp
    Filesize

    744KB

  • memory/560-85-0x0000000000000000-mapping.dmp
  • memory/1136-76-0x0000000000000000-mapping.dmp
  • memory/1492-56-0x0000000076BA1000-0x0000000076BA3000-memory.dmp
    Filesize

    8KB

  • memory/1568-96-0x00000000004B8CC0-mapping.dmp
  • memory/1568-100-0x0000000000400000-0x00000000004BA000-memory.dmp
    Filesize

    744KB

  • memory/1568-101-0x0000000000400000-0x00000000004BA000-memory.dmp
    Filesize

    744KB

  • memory/1568-102-0x0000000000400000-0x00000000004BA000-memory.dmp
    Filesize

    744KB

  • memory/1568-103-0x0000000000400000-0x00000000004BA000-memory.dmp
    Filesize

    744KB

  • memory/1568-104-0x0000000000400000-0x00000000004BA000-memory.dmp
    Filesize

    744KB

  • memory/1568-105-0x0000000000400000-0x00000000004BA000-memory.dmp
    Filesize

    744KB

  • memory/1684-59-0x0000000000000000-mapping.dmp