Analysis
-
max time kernel
161s -
max time network
179s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
25-11-2022 19:34
Behavioral task
behavioral1
Sample
26b3f94f9365165f82b1ee005a0edd82d2a17736c51929d112b2bc93eda83d96.exe
Resource
win7-20220812-en
General
-
Target
26b3f94f9365165f82b1ee005a0edd82d2a17736c51929d112b2bc93eda83d96.exe
-
Size
500KB
-
MD5
cb33d7a4fc859295229b02ae68616319
-
SHA1
cf50c142931029523b9d9e324007ddc76854ce1a
-
SHA256
26b3f94f9365165f82b1ee005a0edd82d2a17736c51929d112b2bc93eda83d96
-
SHA512
82d0bf6aa5ded0e508a9c8e899fd1e21a117a4123d900a65c30244de2de3cccaa8304dcb288df75da256e29becd83d0f4ad7c828c2f1b3aef53167f962cbc695
-
SSDEEP
12288:8enj9tNRgj7lKLVajxrzBViuU+EoSK5VmuZvYmbV:jfaBKaRljX5VmIQI
Malware Config
Extracted
darkcomet
Guest16
millanman.no-ip.org:200
DC_MUTEX-1K6MQ48
-
InstallPath
MSDCSC\msdcsc.exe
-
gencode
lBPaol2uFc1q
-
install
true
-
offline_keylogger
true
-
persistence
true
-
reg_key
MicroUpdate
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
Processes:
26b3f94f9365165f82b1ee005a0edd82d2a17736c51929d112b2bc93eda83d96.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Users\\Admin\\Documents\\MSDCSC\\msdcsc.exe" 26b3f94f9365165f82b1ee005a0edd82d2a17736c51929d112b2bc93eda83d96.exe -
Executes dropped EXE 2 IoCs
Processes:
msdcsc.exemsdcsc.exepid process 3764 msdcsc.exe 408 msdcsc.exe -
Processes:
resource yara_rule behavioral2/memory/3292-134-0x0000000000400000-0x0000000000530000-memory.dmp upx behavioral2/memory/3292-135-0x0000000000400000-0x0000000000530000-memory.dmp upx behavioral2/memory/220-137-0x0000000000400000-0x00000000004B7000-memory.dmp upx behavioral2/memory/220-138-0x0000000000400000-0x00000000004B7000-memory.dmp upx behavioral2/memory/220-139-0x0000000000400000-0x00000000004B7000-memory.dmp upx behavioral2/memory/220-140-0x0000000000400000-0x00000000004B7000-memory.dmp upx behavioral2/memory/220-141-0x0000000000400000-0x00000000004B7000-memory.dmp upx behavioral2/memory/3292-142-0x0000000000400000-0x0000000000530000-memory.dmp upx C:\Users\Admin\Documents\MSDCSC\msdcsc.exe upx C:\Users\Admin\Documents\MSDCSC\msdcsc.exe upx behavioral2/memory/3764-148-0x0000000000400000-0x0000000000530000-memory.dmp upx behavioral2/memory/220-149-0x0000000000400000-0x00000000004B7000-memory.dmp upx behavioral2/memory/3764-154-0x0000000000400000-0x0000000000530000-memory.dmp upx behavioral2/memory/408-155-0x0000000000400000-0x00000000004B7000-memory.dmp upx behavioral2/memory/408-156-0x0000000000400000-0x00000000004B7000-memory.dmp upx C:\Users\Admin\Documents\MSDCSC\msdcsc.exe upx behavioral2/memory/408-158-0x0000000000400000-0x00000000004B7000-memory.dmp upx behavioral2/memory/408-159-0x0000000000400000-0x00000000004B7000-memory.dmp upx behavioral2/memory/408-160-0x0000000000400000-0x00000000004B7000-memory.dmp upx -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
26b3f94f9365165f82b1ee005a0edd82d2a17736c51929d112b2bc93eda83d96.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation 26b3f94f9365165f82b1ee005a0edd82d2a17736c51929d112b2bc93eda83d96.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
26b3f94f9365165f82b1ee005a0edd82d2a17736c51929d112b2bc93eda83d96.exemsdcsc.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Users\\Admin\\Documents\\MSDCSC\\msdcsc.exe" 26b3f94f9365165f82b1ee005a0edd82d2a17736c51929d112b2bc93eda83d96.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Users\\Admin\\Documents\\MSDCSC\\msdcsc.exe" msdcsc.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
26b3f94f9365165f82b1ee005a0edd82d2a17736c51929d112b2bc93eda83d96.exemsdcsc.exedescription pid process target process PID 3292 set thread context of 220 3292 26b3f94f9365165f82b1ee005a0edd82d2a17736c51929d112b2bc93eda83d96.exe 26b3f94f9365165f82b1ee005a0edd82d2a17736c51929d112b2bc93eda83d96.exe PID 3764 set thread context of 408 3764 msdcsc.exe msdcsc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Modifies registry class 1 IoCs
Processes:
26b3f94f9365165f82b1ee005a0edd82d2a17736c51929d112b2bc93eda83d96.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ 26b3f94f9365165f82b1ee005a0edd82d2a17736c51929d112b2bc93eda83d96.exe -
Suspicious use of AdjustPrivilegeToken 48 IoCs
Processes:
26b3f94f9365165f82b1ee005a0edd82d2a17736c51929d112b2bc93eda83d96.exemsdcsc.exedescription pid process Token: SeIncreaseQuotaPrivilege 220 26b3f94f9365165f82b1ee005a0edd82d2a17736c51929d112b2bc93eda83d96.exe Token: SeSecurityPrivilege 220 26b3f94f9365165f82b1ee005a0edd82d2a17736c51929d112b2bc93eda83d96.exe Token: SeTakeOwnershipPrivilege 220 26b3f94f9365165f82b1ee005a0edd82d2a17736c51929d112b2bc93eda83d96.exe Token: SeLoadDriverPrivilege 220 26b3f94f9365165f82b1ee005a0edd82d2a17736c51929d112b2bc93eda83d96.exe Token: SeSystemProfilePrivilege 220 26b3f94f9365165f82b1ee005a0edd82d2a17736c51929d112b2bc93eda83d96.exe Token: SeSystemtimePrivilege 220 26b3f94f9365165f82b1ee005a0edd82d2a17736c51929d112b2bc93eda83d96.exe Token: SeProfSingleProcessPrivilege 220 26b3f94f9365165f82b1ee005a0edd82d2a17736c51929d112b2bc93eda83d96.exe Token: SeIncBasePriorityPrivilege 220 26b3f94f9365165f82b1ee005a0edd82d2a17736c51929d112b2bc93eda83d96.exe Token: SeCreatePagefilePrivilege 220 26b3f94f9365165f82b1ee005a0edd82d2a17736c51929d112b2bc93eda83d96.exe Token: SeBackupPrivilege 220 26b3f94f9365165f82b1ee005a0edd82d2a17736c51929d112b2bc93eda83d96.exe Token: SeRestorePrivilege 220 26b3f94f9365165f82b1ee005a0edd82d2a17736c51929d112b2bc93eda83d96.exe Token: SeShutdownPrivilege 220 26b3f94f9365165f82b1ee005a0edd82d2a17736c51929d112b2bc93eda83d96.exe Token: SeDebugPrivilege 220 26b3f94f9365165f82b1ee005a0edd82d2a17736c51929d112b2bc93eda83d96.exe Token: SeSystemEnvironmentPrivilege 220 26b3f94f9365165f82b1ee005a0edd82d2a17736c51929d112b2bc93eda83d96.exe Token: SeChangeNotifyPrivilege 220 26b3f94f9365165f82b1ee005a0edd82d2a17736c51929d112b2bc93eda83d96.exe Token: SeRemoteShutdownPrivilege 220 26b3f94f9365165f82b1ee005a0edd82d2a17736c51929d112b2bc93eda83d96.exe Token: SeUndockPrivilege 220 26b3f94f9365165f82b1ee005a0edd82d2a17736c51929d112b2bc93eda83d96.exe Token: SeManageVolumePrivilege 220 26b3f94f9365165f82b1ee005a0edd82d2a17736c51929d112b2bc93eda83d96.exe Token: SeImpersonatePrivilege 220 26b3f94f9365165f82b1ee005a0edd82d2a17736c51929d112b2bc93eda83d96.exe Token: SeCreateGlobalPrivilege 220 26b3f94f9365165f82b1ee005a0edd82d2a17736c51929d112b2bc93eda83d96.exe Token: 33 220 26b3f94f9365165f82b1ee005a0edd82d2a17736c51929d112b2bc93eda83d96.exe Token: 34 220 26b3f94f9365165f82b1ee005a0edd82d2a17736c51929d112b2bc93eda83d96.exe Token: 35 220 26b3f94f9365165f82b1ee005a0edd82d2a17736c51929d112b2bc93eda83d96.exe Token: 36 220 26b3f94f9365165f82b1ee005a0edd82d2a17736c51929d112b2bc93eda83d96.exe Token: SeIncreaseQuotaPrivilege 408 msdcsc.exe Token: SeSecurityPrivilege 408 msdcsc.exe Token: SeTakeOwnershipPrivilege 408 msdcsc.exe Token: SeLoadDriverPrivilege 408 msdcsc.exe Token: SeSystemProfilePrivilege 408 msdcsc.exe Token: SeSystemtimePrivilege 408 msdcsc.exe Token: SeProfSingleProcessPrivilege 408 msdcsc.exe Token: SeIncBasePriorityPrivilege 408 msdcsc.exe Token: SeCreatePagefilePrivilege 408 msdcsc.exe Token: SeBackupPrivilege 408 msdcsc.exe Token: SeRestorePrivilege 408 msdcsc.exe Token: SeShutdownPrivilege 408 msdcsc.exe Token: SeDebugPrivilege 408 msdcsc.exe Token: SeSystemEnvironmentPrivilege 408 msdcsc.exe Token: SeChangeNotifyPrivilege 408 msdcsc.exe Token: SeRemoteShutdownPrivilege 408 msdcsc.exe Token: SeUndockPrivilege 408 msdcsc.exe Token: SeManageVolumePrivilege 408 msdcsc.exe Token: SeImpersonatePrivilege 408 msdcsc.exe Token: SeCreateGlobalPrivilege 408 msdcsc.exe Token: 33 408 msdcsc.exe Token: 34 408 msdcsc.exe Token: 35 408 msdcsc.exe Token: 36 408 msdcsc.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
Processes:
26b3f94f9365165f82b1ee005a0edd82d2a17736c51929d112b2bc93eda83d96.exemsdcsc.exemsdcsc.exepid process 3292 26b3f94f9365165f82b1ee005a0edd82d2a17736c51929d112b2bc93eda83d96.exe 3764 msdcsc.exe 408 msdcsc.exe -
Suspicious use of WriteProcessMemory 41 IoCs
Processes:
26b3f94f9365165f82b1ee005a0edd82d2a17736c51929d112b2bc93eda83d96.exe26b3f94f9365165f82b1ee005a0edd82d2a17736c51929d112b2bc93eda83d96.exemsdcsc.exemsdcsc.exedescription pid process target process PID 3292 wrote to memory of 220 3292 26b3f94f9365165f82b1ee005a0edd82d2a17736c51929d112b2bc93eda83d96.exe 26b3f94f9365165f82b1ee005a0edd82d2a17736c51929d112b2bc93eda83d96.exe PID 3292 wrote to memory of 220 3292 26b3f94f9365165f82b1ee005a0edd82d2a17736c51929d112b2bc93eda83d96.exe 26b3f94f9365165f82b1ee005a0edd82d2a17736c51929d112b2bc93eda83d96.exe PID 3292 wrote to memory of 220 3292 26b3f94f9365165f82b1ee005a0edd82d2a17736c51929d112b2bc93eda83d96.exe 26b3f94f9365165f82b1ee005a0edd82d2a17736c51929d112b2bc93eda83d96.exe PID 3292 wrote to memory of 220 3292 26b3f94f9365165f82b1ee005a0edd82d2a17736c51929d112b2bc93eda83d96.exe 26b3f94f9365165f82b1ee005a0edd82d2a17736c51929d112b2bc93eda83d96.exe PID 3292 wrote to memory of 220 3292 26b3f94f9365165f82b1ee005a0edd82d2a17736c51929d112b2bc93eda83d96.exe 26b3f94f9365165f82b1ee005a0edd82d2a17736c51929d112b2bc93eda83d96.exe PID 3292 wrote to memory of 220 3292 26b3f94f9365165f82b1ee005a0edd82d2a17736c51929d112b2bc93eda83d96.exe 26b3f94f9365165f82b1ee005a0edd82d2a17736c51929d112b2bc93eda83d96.exe PID 3292 wrote to memory of 220 3292 26b3f94f9365165f82b1ee005a0edd82d2a17736c51929d112b2bc93eda83d96.exe 26b3f94f9365165f82b1ee005a0edd82d2a17736c51929d112b2bc93eda83d96.exe PID 3292 wrote to memory of 220 3292 26b3f94f9365165f82b1ee005a0edd82d2a17736c51929d112b2bc93eda83d96.exe 26b3f94f9365165f82b1ee005a0edd82d2a17736c51929d112b2bc93eda83d96.exe PID 220 wrote to memory of 3764 220 26b3f94f9365165f82b1ee005a0edd82d2a17736c51929d112b2bc93eda83d96.exe msdcsc.exe PID 220 wrote to memory of 3764 220 26b3f94f9365165f82b1ee005a0edd82d2a17736c51929d112b2bc93eda83d96.exe msdcsc.exe PID 220 wrote to memory of 3764 220 26b3f94f9365165f82b1ee005a0edd82d2a17736c51929d112b2bc93eda83d96.exe msdcsc.exe PID 3764 wrote to memory of 408 3764 msdcsc.exe msdcsc.exe PID 3764 wrote to memory of 408 3764 msdcsc.exe msdcsc.exe PID 3764 wrote to memory of 408 3764 msdcsc.exe msdcsc.exe PID 3764 wrote to memory of 408 3764 msdcsc.exe msdcsc.exe PID 3764 wrote to memory of 408 3764 msdcsc.exe msdcsc.exe PID 3764 wrote to memory of 408 3764 msdcsc.exe msdcsc.exe PID 3764 wrote to memory of 408 3764 msdcsc.exe msdcsc.exe PID 3764 wrote to memory of 408 3764 msdcsc.exe msdcsc.exe PID 408 wrote to memory of 3484 408 msdcsc.exe notepad.exe PID 408 wrote to memory of 3484 408 msdcsc.exe notepad.exe PID 408 wrote to memory of 3484 408 msdcsc.exe notepad.exe PID 408 wrote to memory of 3484 408 msdcsc.exe notepad.exe PID 408 wrote to memory of 3484 408 msdcsc.exe notepad.exe PID 408 wrote to memory of 3484 408 msdcsc.exe notepad.exe PID 408 wrote to memory of 3484 408 msdcsc.exe notepad.exe PID 408 wrote to memory of 3484 408 msdcsc.exe notepad.exe PID 408 wrote to memory of 3484 408 msdcsc.exe notepad.exe PID 408 wrote to memory of 3484 408 msdcsc.exe notepad.exe PID 408 wrote to memory of 3484 408 msdcsc.exe notepad.exe PID 408 wrote to memory of 3484 408 msdcsc.exe notepad.exe PID 408 wrote to memory of 3484 408 msdcsc.exe notepad.exe PID 408 wrote to memory of 3484 408 msdcsc.exe notepad.exe PID 408 wrote to memory of 3484 408 msdcsc.exe notepad.exe PID 408 wrote to memory of 3484 408 msdcsc.exe notepad.exe PID 408 wrote to memory of 3484 408 msdcsc.exe notepad.exe PID 408 wrote to memory of 3484 408 msdcsc.exe notepad.exe PID 408 wrote to memory of 3484 408 msdcsc.exe notepad.exe PID 408 wrote to memory of 3484 408 msdcsc.exe notepad.exe PID 408 wrote to memory of 3484 408 msdcsc.exe notepad.exe PID 408 wrote to memory of 3484 408 msdcsc.exe notepad.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\26b3f94f9365165f82b1ee005a0edd82d2a17736c51929d112b2bc93eda83d96.exe"C:\Users\Admin\AppData\Local\Temp\26b3f94f9365165f82b1ee005a0edd82d2a17736c51929d112b2bc93eda83d96.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3292 -
C:\Users\Admin\AppData\Local\Temp\26b3f94f9365165f82b1ee005a0edd82d2a17736c51929d112b2bc93eda83d96.exe"C:\Users\Admin\AppData\Local\Temp\26b3f94f9365165f82b1ee005a0edd82d2a17736c51929d112b2bc93eda83d96.exe"2⤵
- Modifies WinLogon for persistence
- Checks computer location settings
- Adds Run key to start application
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:220 -
C:\Users\Admin\Documents\MSDCSC\msdcsc.exe"C:\Users\Admin\Documents\MSDCSC\msdcsc.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3764 -
C:\Users\Admin\Documents\MSDCSC\msdcsc.exe"C:\Users\Admin\Documents\MSDCSC\msdcsc.exe"4⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:408 -
C:\Windows\SysWOW64\notepad.exenotepad5⤵PID:3484
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\Documents\MSDCSC\msdcsc.exeFilesize
500KB
MD5cb33d7a4fc859295229b02ae68616319
SHA1cf50c142931029523b9d9e324007ddc76854ce1a
SHA25626b3f94f9365165f82b1ee005a0edd82d2a17736c51929d112b2bc93eda83d96
SHA51282d0bf6aa5ded0e508a9c8e899fd1e21a117a4123d900a65c30244de2de3cccaa8304dcb288df75da256e29becd83d0f4ad7c828c2f1b3aef53167f962cbc695
-
C:\Users\Admin\Documents\MSDCSC\msdcsc.exeFilesize
500KB
MD5cb33d7a4fc859295229b02ae68616319
SHA1cf50c142931029523b9d9e324007ddc76854ce1a
SHA25626b3f94f9365165f82b1ee005a0edd82d2a17736c51929d112b2bc93eda83d96
SHA51282d0bf6aa5ded0e508a9c8e899fd1e21a117a4123d900a65c30244de2de3cccaa8304dcb288df75da256e29becd83d0f4ad7c828c2f1b3aef53167f962cbc695
-
C:\Users\Admin\Documents\MSDCSC\msdcsc.exeFilesize
500KB
MD5cb33d7a4fc859295229b02ae68616319
SHA1cf50c142931029523b9d9e324007ddc76854ce1a
SHA25626b3f94f9365165f82b1ee005a0edd82d2a17736c51929d112b2bc93eda83d96
SHA51282d0bf6aa5ded0e508a9c8e899fd1e21a117a4123d900a65c30244de2de3cccaa8304dcb288df75da256e29becd83d0f4ad7c828c2f1b3aef53167f962cbc695
-
memory/220-139-0x0000000000400000-0x00000000004B7000-memory.dmpFilesize
732KB
-
memory/220-140-0x0000000000400000-0x00000000004B7000-memory.dmpFilesize
732KB
-
memory/220-141-0x0000000000400000-0x00000000004B7000-memory.dmpFilesize
732KB
-
memory/220-138-0x0000000000400000-0x00000000004B7000-memory.dmpFilesize
732KB
-
memory/220-137-0x0000000000400000-0x00000000004B7000-memory.dmpFilesize
732KB
-
memory/220-136-0x0000000000000000-mapping.dmp
-
memory/220-149-0x0000000000400000-0x00000000004B7000-memory.dmpFilesize
732KB
-
memory/408-155-0x0000000000400000-0x00000000004B7000-memory.dmpFilesize
732KB
-
memory/408-160-0x0000000000400000-0x00000000004B7000-memory.dmpFilesize
732KB
-
memory/408-159-0x0000000000400000-0x00000000004B7000-memory.dmpFilesize
732KB
-
memory/408-158-0x0000000000400000-0x00000000004B7000-memory.dmpFilesize
732KB
-
memory/408-150-0x0000000000000000-mapping.dmp
-
memory/408-156-0x0000000000400000-0x00000000004B7000-memory.dmpFilesize
732KB
-
memory/3292-142-0x0000000000400000-0x0000000000530000-memory.dmpFilesize
1.2MB
-
memory/3292-135-0x0000000000400000-0x0000000000530000-memory.dmpFilesize
1.2MB
-
memory/3292-134-0x0000000000400000-0x0000000000530000-memory.dmpFilesize
1.2MB
-
memory/3484-157-0x0000000000000000-mapping.dmp
-
memory/3764-154-0x0000000000400000-0x0000000000530000-memory.dmpFilesize
1.2MB
-
memory/3764-148-0x0000000000400000-0x0000000000530000-memory.dmpFilesize
1.2MB
-
memory/3764-143-0x0000000000000000-mapping.dmp