Analysis
-
max time kernel
150s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20220901-en -
resource tags
arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system -
submitted
26-11-2022 12:37
Behavioral task
behavioral1
Sample
626dab42d424d40c23ae40bed02f3d826e404e964cca3877979a18b13a852c14.exe
Resource
win7-20220812-en
General
-
Target
626dab42d424d40c23ae40bed02f3d826e404e964cca3877979a18b13a852c14.exe
-
Size
658KB
-
MD5
77877cbf3a974a22942251639c9b4f44
-
SHA1
8592457a1ed0d904845d9c4bc3434b30bcd626ff
-
SHA256
626dab42d424d40c23ae40bed02f3d826e404e964cca3877979a18b13a852c14
-
SHA512
6a8a1ec91f2482b7ea0211d41cf611b6ebe983c21211b875783362bcb02b03f3a1b4def2b41b6d0073cb65ec3a186585d2004795abc486a518db1c6769da7739
-
SSDEEP
12288:+9HFJ9rJxRX1uVVjoaWSoynxdO1FVBaOiRZTERfIhNkNCCLo9Ek5C/h5:KZ1xuVVjfFoynPaVBUR8f+kN10EBH
Malware Config
Extracted
darkcomet
DC
platrat.no-ip.biz:200
DC_MUTEX-V7T9GZM
-
InstallPath
MSDCSC\msdcsc.exe
-
gencode
ZsFDKmYnrqzM
-
install
true
-
offline_keylogger
true
-
persistence
true
-
reg_key
rundll32
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
Processes:
626dab42d424d40c23ae40bed02f3d826e404e964cca3877979a18b13a852c14.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Users\\Admin\\AppData\\Local\\Temp\\MSDCSC\\msdcsc.exe" 626dab42d424d40c23ae40bed02f3d826e404e964cca3877979a18b13a852c14.exe -
Executes dropped EXE 1 IoCs
Processes:
msdcsc.exepid process 1876 msdcsc.exe -
Sets file to hidden 1 TTPs 2 IoCs
Modifies file attributes to stop it showing in Explorer etc.
Processes:
attrib.exeattrib.exepid process 2384 attrib.exe 3996 attrib.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
626dab42d424d40c23ae40bed02f3d826e404e964cca3877979a18b13a852c14.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation 626dab42d424d40c23ae40bed02f3d826e404e964cca3877979a18b13a852c14.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
626dab42d424d40c23ae40bed02f3d826e404e964cca3877979a18b13a852c14.exemsdcsc.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\rundll32 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\MSDCSC\\msdcsc.exe" 626dab42d424d40c23ae40bed02f3d826e404e964cca3877979a18b13a852c14.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\rundll32 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\MSDCSC\\msdcsc.exe" msdcsc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Modifies registry class 1 IoCs
Processes:
626dab42d424d40c23ae40bed02f3d826e404e964cca3877979a18b13a852c14.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ 626dab42d424d40c23ae40bed02f3d826e404e964cca3877979a18b13a852c14.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
msdcsc.exepid process 1876 msdcsc.exe -
Suspicious use of AdjustPrivilegeToken 48 IoCs
Processes:
626dab42d424d40c23ae40bed02f3d826e404e964cca3877979a18b13a852c14.exemsdcsc.exedescription pid process Token: SeIncreaseQuotaPrivilege 2808 626dab42d424d40c23ae40bed02f3d826e404e964cca3877979a18b13a852c14.exe Token: SeSecurityPrivilege 2808 626dab42d424d40c23ae40bed02f3d826e404e964cca3877979a18b13a852c14.exe Token: SeTakeOwnershipPrivilege 2808 626dab42d424d40c23ae40bed02f3d826e404e964cca3877979a18b13a852c14.exe Token: SeLoadDriverPrivilege 2808 626dab42d424d40c23ae40bed02f3d826e404e964cca3877979a18b13a852c14.exe Token: SeSystemProfilePrivilege 2808 626dab42d424d40c23ae40bed02f3d826e404e964cca3877979a18b13a852c14.exe Token: SeSystemtimePrivilege 2808 626dab42d424d40c23ae40bed02f3d826e404e964cca3877979a18b13a852c14.exe Token: SeProfSingleProcessPrivilege 2808 626dab42d424d40c23ae40bed02f3d826e404e964cca3877979a18b13a852c14.exe Token: SeIncBasePriorityPrivilege 2808 626dab42d424d40c23ae40bed02f3d826e404e964cca3877979a18b13a852c14.exe Token: SeCreatePagefilePrivilege 2808 626dab42d424d40c23ae40bed02f3d826e404e964cca3877979a18b13a852c14.exe Token: SeBackupPrivilege 2808 626dab42d424d40c23ae40bed02f3d826e404e964cca3877979a18b13a852c14.exe Token: SeRestorePrivilege 2808 626dab42d424d40c23ae40bed02f3d826e404e964cca3877979a18b13a852c14.exe Token: SeShutdownPrivilege 2808 626dab42d424d40c23ae40bed02f3d826e404e964cca3877979a18b13a852c14.exe Token: SeDebugPrivilege 2808 626dab42d424d40c23ae40bed02f3d826e404e964cca3877979a18b13a852c14.exe Token: SeSystemEnvironmentPrivilege 2808 626dab42d424d40c23ae40bed02f3d826e404e964cca3877979a18b13a852c14.exe Token: SeChangeNotifyPrivilege 2808 626dab42d424d40c23ae40bed02f3d826e404e964cca3877979a18b13a852c14.exe Token: SeRemoteShutdownPrivilege 2808 626dab42d424d40c23ae40bed02f3d826e404e964cca3877979a18b13a852c14.exe Token: SeUndockPrivilege 2808 626dab42d424d40c23ae40bed02f3d826e404e964cca3877979a18b13a852c14.exe Token: SeManageVolumePrivilege 2808 626dab42d424d40c23ae40bed02f3d826e404e964cca3877979a18b13a852c14.exe Token: SeImpersonatePrivilege 2808 626dab42d424d40c23ae40bed02f3d826e404e964cca3877979a18b13a852c14.exe Token: SeCreateGlobalPrivilege 2808 626dab42d424d40c23ae40bed02f3d826e404e964cca3877979a18b13a852c14.exe Token: 33 2808 626dab42d424d40c23ae40bed02f3d826e404e964cca3877979a18b13a852c14.exe Token: 34 2808 626dab42d424d40c23ae40bed02f3d826e404e964cca3877979a18b13a852c14.exe Token: 35 2808 626dab42d424d40c23ae40bed02f3d826e404e964cca3877979a18b13a852c14.exe Token: 36 2808 626dab42d424d40c23ae40bed02f3d826e404e964cca3877979a18b13a852c14.exe Token: SeIncreaseQuotaPrivilege 1876 msdcsc.exe Token: SeSecurityPrivilege 1876 msdcsc.exe Token: SeTakeOwnershipPrivilege 1876 msdcsc.exe Token: SeLoadDriverPrivilege 1876 msdcsc.exe Token: SeSystemProfilePrivilege 1876 msdcsc.exe Token: SeSystemtimePrivilege 1876 msdcsc.exe Token: SeProfSingleProcessPrivilege 1876 msdcsc.exe Token: SeIncBasePriorityPrivilege 1876 msdcsc.exe Token: SeCreatePagefilePrivilege 1876 msdcsc.exe Token: SeBackupPrivilege 1876 msdcsc.exe Token: SeRestorePrivilege 1876 msdcsc.exe Token: SeShutdownPrivilege 1876 msdcsc.exe Token: SeDebugPrivilege 1876 msdcsc.exe Token: SeSystemEnvironmentPrivilege 1876 msdcsc.exe Token: SeChangeNotifyPrivilege 1876 msdcsc.exe Token: SeRemoteShutdownPrivilege 1876 msdcsc.exe Token: SeUndockPrivilege 1876 msdcsc.exe Token: SeManageVolumePrivilege 1876 msdcsc.exe Token: SeImpersonatePrivilege 1876 msdcsc.exe Token: SeCreateGlobalPrivilege 1876 msdcsc.exe Token: 33 1876 msdcsc.exe Token: 34 1876 msdcsc.exe Token: 35 1876 msdcsc.exe Token: 36 1876 msdcsc.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
msdcsc.exepid process 1876 msdcsc.exe -
Suspicious use of WriteProcessMemory 37 IoCs
Processes:
626dab42d424d40c23ae40bed02f3d826e404e964cca3877979a18b13a852c14.execmd.execmd.exemsdcsc.exedescription pid process target process PID 2808 wrote to memory of 1456 2808 626dab42d424d40c23ae40bed02f3d826e404e964cca3877979a18b13a852c14.exe cmd.exe PID 2808 wrote to memory of 1456 2808 626dab42d424d40c23ae40bed02f3d826e404e964cca3877979a18b13a852c14.exe cmd.exe PID 2808 wrote to memory of 1456 2808 626dab42d424d40c23ae40bed02f3d826e404e964cca3877979a18b13a852c14.exe cmd.exe PID 2808 wrote to memory of 5008 2808 626dab42d424d40c23ae40bed02f3d826e404e964cca3877979a18b13a852c14.exe cmd.exe PID 2808 wrote to memory of 5008 2808 626dab42d424d40c23ae40bed02f3d826e404e964cca3877979a18b13a852c14.exe cmd.exe PID 2808 wrote to memory of 5008 2808 626dab42d424d40c23ae40bed02f3d826e404e964cca3877979a18b13a852c14.exe cmd.exe PID 1456 wrote to memory of 2384 1456 cmd.exe attrib.exe PID 1456 wrote to memory of 2384 1456 cmd.exe attrib.exe PID 1456 wrote to memory of 2384 1456 cmd.exe attrib.exe PID 5008 wrote to memory of 3996 5008 cmd.exe attrib.exe PID 5008 wrote to memory of 3996 5008 cmd.exe attrib.exe PID 5008 wrote to memory of 3996 5008 cmd.exe attrib.exe PID 2808 wrote to memory of 1876 2808 626dab42d424d40c23ae40bed02f3d826e404e964cca3877979a18b13a852c14.exe msdcsc.exe PID 2808 wrote to memory of 1876 2808 626dab42d424d40c23ae40bed02f3d826e404e964cca3877979a18b13a852c14.exe msdcsc.exe PID 2808 wrote to memory of 1876 2808 626dab42d424d40c23ae40bed02f3d826e404e964cca3877979a18b13a852c14.exe msdcsc.exe PID 1876 wrote to memory of 3408 1876 msdcsc.exe notepad.exe PID 1876 wrote to memory of 3408 1876 msdcsc.exe notepad.exe PID 1876 wrote to memory of 3408 1876 msdcsc.exe notepad.exe PID 1876 wrote to memory of 3408 1876 msdcsc.exe notepad.exe PID 1876 wrote to memory of 3408 1876 msdcsc.exe notepad.exe PID 1876 wrote to memory of 3408 1876 msdcsc.exe notepad.exe PID 1876 wrote to memory of 3408 1876 msdcsc.exe notepad.exe PID 1876 wrote to memory of 3408 1876 msdcsc.exe notepad.exe PID 1876 wrote to memory of 3408 1876 msdcsc.exe notepad.exe PID 1876 wrote to memory of 3408 1876 msdcsc.exe notepad.exe PID 1876 wrote to memory of 3408 1876 msdcsc.exe notepad.exe PID 1876 wrote to memory of 3408 1876 msdcsc.exe notepad.exe PID 1876 wrote to memory of 3408 1876 msdcsc.exe notepad.exe PID 1876 wrote to memory of 3408 1876 msdcsc.exe notepad.exe PID 1876 wrote to memory of 3408 1876 msdcsc.exe notepad.exe PID 1876 wrote to memory of 3408 1876 msdcsc.exe notepad.exe PID 1876 wrote to memory of 3408 1876 msdcsc.exe notepad.exe PID 1876 wrote to memory of 3408 1876 msdcsc.exe notepad.exe PID 1876 wrote to memory of 3408 1876 msdcsc.exe notepad.exe PID 1876 wrote to memory of 3408 1876 msdcsc.exe notepad.exe PID 1876 wrote to memory of 3408 1876 msdcsc.exe notepad.exe PID 1876 wrote to memory of 3408 1876 msdcsc.exe notepad.exe -
Views/modifies file attributes 1 TTPs 2 IoCs
Processes:
attrib.exeattrib.exepid process 2384 attrib.exe 3996 attrib.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\626dab42d424d40c23ae40bed02f3d826e404e964cca3877979a18b13a852c14.exe"C:\Users\Admin\AppData\Local\Temp\626dab42d424d40c23ae40bed02f3d826e404e964cca3877979a18b13a852c14.exe"1⤵
- Modifies WinLogon for persistence
- Checks computer location settings
- Adds Run key to start application
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp\626dab42d424d40c23ae40bed02f3d826e404e964cca3877979a18b13a852c14.exe" +s +h2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Users\Admin\AppData\Local\Temp\626dab42d424d40c23ae40bed02f3d826e404e964cca3877979a18b13a852c14.exe" +s +h3⤵
- Sets file to hidden
- Views/modifies file attributes
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp" +s +h2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Users\Admin\AppData\Local\Temp" +s +h3⤵
- Sets file to hidden
- Views/modifies file attributes
-
C:\Users\Admin\AppData\Local\Temp\MSDCSC\msdcsc.exe"C:\Users\Admin\AppData\Local\Temp\MSDCSC\msdcsc.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\notepad.exenotepad3⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\MSDCSC\msdcsc.exeFilesize
658KB
MD577877cbf3a974a22942251639c9b4f44
SHA18592457a1ed0d904845d9c4bc3434b30bcd626ff
SHA256626dab42d424d40c23ae40bed02f3d826e404e964cca3877979a18b13a852c14
SHA5126a8a1ec91f2482b7ea0211d41cf611b6ebe983c21211b875783362bcb02b03f3a1b4def2b41b6d0073cb65ec3a186585d2004795abc486a518db1c6769da7739
-
C:\Users\Admin\AppData\Local\Temp\MSDCSC\msdcsc.exeFilesize
658KB
MD577877cbf3a974a22942251639c9b4f44
SHA18592457a1ed0d904845d9c4bc3434b30bcd626ff
SHA256626dab42d424d40c23ae40bed02f3d826e404e964cca3877979a18b13a852c14
SHA5126a8a1ec91f2482b7ea0211d41cf611b6ebe983c21211b875783362bcb02b03f3a1b4def2b41b6d0073cb65ec3a186585d2004795abc486a518db1c6769da7739
-
memory/1456-132-0x0000000000000000-mapping.dmp
-
memory/1876-136-0x0000000000000000-mapping.dmp
-
memory/2384-134-0x0000000000000000-mapping.dmp
-
memory/3408-139-0x0000000000000000-mapping.dmp
-
memory/3996-135-0x0000000000000000-mapping.dmp
-
memory/5008-133-0x0000000000000000-mapping.dmp