Analysis
-
max time kernel
151s -
max time network
47s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
26-11-2022 12:40
Static task
static1
Behavioral task
behavioral1
Sample
72b401594c6d7674f905f8fcc187e2c8525f6b2c1c9682fafd5e1191d6a617cd.exe
Resource
win7-20220812-en
General
-
Target
72b401594c6d7674f905f8fcc187e2c8525f6b2c1c9682fafd5e1191d6a617cd.exe
-
Size
383KB
-
MD5
4ae30f28f1acb06cc303afb107fb5242
-
SHA1
017ed0e76ed7daee651f88c81df2f43c986a773c
-
SHA256
72b401594c6d7674f905f8fcc187e2c8525f6b2c1c9682fafd5e1191d6a617cd
-
SHA512
015292b13b5712357e9b7f33cb9097884b15578598c066a1fc5a272b8cddcfffe42bc6a9fa499ffae43ce245967ce005234ead3b50cf304f84f3666f06de8f16
-
SSDEEP
6144:/YpRNQuZi9+neeKGn4SBIz0Bpv/8Ykw+aS053PuLupGT1CXINTB8LgAFAl7B9w:wp/1Fxn+G8S+aL3GapyfB2GR
Malware Config
Extracted
darkcomet
HF
xavian.no-ip.org:1604
DC_MUTEX-KT2FTNQ
-
InstallPath
MSDCSC\msdcsc.exe
-
gencode
VKesLADk0mNy
-
install
true
-
offline_keylogger
true
-
persistence
true
-
reg_key
MicroUpdate
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
Processes:
72b401594c6d7674f905f8fcc187e2c8525f6b2c1c9682fafd5e1191d6a617cd.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Users\\Admin\\Documents\\MSDCSC\\msdcsc.exe" 72b401594c6d7674f905f8fcc187e2c8525f6b2c1c9682fafd5e1191d6a617cd.exe -
Executes dropped EXE 1 IoCs
Processes:
msdcsc.exepid process 1088 msdcsc.exe -
Sets file to hidden 1 TTPs 2 IoCs
Modifies file attributes to stop it showing in Explorer etc.
Processes:
attrib.exeattrib.exepid process 1116 attrib.exe 840 attrib.exe -
Loads dropped DLL 2 IoCs
Processes:
72b401594c6d7674f905f8fcc187e2c8525f6b2c1c9682fafd5e1191d6a617cd.exepid process 1584 72b401594c6d7674f905f8fcc187e2c8525f6b2c1c9682fafd5e1191d6a617cd.exe 1584 72b401594c6d7674f905f8fcc187e2c8525f6b2c1c9682fafd5e1191d6a617cd.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
72b401594c6d7674f905f8fcc187e2c8525f6b2c1c9682fafd5e1191d6a617cd.exemsdcsc.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Users\\Admin\\Documents\\MSDCSC\\msdcsc.exe" 72b401594c6d7674f905f8fcc187e2c8525f6b2c1c9682fafd5e1191d6a617cd.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Users\\Admin\\Documents\\MSDCSC\\msdcsc.exe" msdcsc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of AdjustPrivilegeToken 46 IoCs
Processes:
72b401594c6d7674f905f8fcc187e2c8525f6b2c1c9682fafd5e1191d6a617cd.exemsdcsc.exedescription pid process Token: SeIncreaseQuotaPrivilege 1584 72b401594c6d7674f905f8fcc187e2c8525f6b2c1c9682fafd5e1191d6a617cd.exe Token: SeSecurityPrivilege 1584 72b401594c6d7674f905f8fcc187e2c8525f6b2c1c9682fafd5e1191d6a617cd.exe Token: SeTakeOwnershipPrivilege 1584 72b401594c6d7674f905f8fcc187e2c8525f6b2c1c9682fafd5e1191d6a617cd.exe Token: SeLoadDriverPrivilege 1584 72b401594c6d7674f905f8fcc187e2c8525f6b2c1c9682fafd5e1191d6a617cd.exe Token: SeSystemProfilePrivilege 1584 72b401594c6d7674f905f8fcc187e2c8525f6b2c1c9682fafd5e1191d6a617cd.exe Token: SeSystemtimePrivilege 1584 72b401594c6d7674f905f8fcc187e2c8525f6b2c1c9682fafd5e1191d6a617cd.exe Token: SeProfSingleProcessPrivilege 1584 72b401594c6d7674f905f8fcc187e2c8525f6b2c1c9682fafd5e1191d6a617cd.exe Token: SeIncBasePriorityPrivilege 1584 72b401594c6d7674f905f8fcc187e2c8525f6b2c1c9682fafd5e1191d6a617cd.exe Token: SeCreatePagefilePrivilege 1584 72b401594c6d7674f905f8fcc187e2c8525f6b2c1c9682fafd5e1191d6a617cd.exe Token: SeBackupPrivilege 1584 72b401594c6d7674f905f8fcc187e2c8525f6b2c1c9682fafd5e1191d6a617cd.exe Token: SeRestorePrivilege 1584 72b401594c6d7674f905f8fcc187e2c8525f6b2c1c9682fafd5e1191d6a617cd.exe Token: SeShutdownPrivilege 1584 72b401594c6d7674f905f8fcc187e2c8525f6b2c1c9682fafd5e1191d6a617cd.exe Token: SeDebugPrivilege 1584 72b401594c6d7674f905f8fcc187e2c8525f6b2c1c9682fafd5e1191d6a617cd.exe Token: SeSystemEnvironmentPrivilege 1584 72b401594c6d7674f905f8fcc187e2c8525f6b2c1c9682fafd5e1191d6a617cd.exe Token: SeChangeNotifyPrivilege 1584 72b401594c6d7674f905f8fcc187e2c8525f6b2c1c9682fafd5e1191d6a617cd.exe Token: SeRemoteShutdownPrivilege 1584 72b401594c6d7674f905f8fcc187e2c8525f6b2c1c9682fafd5e1191d6a617cd.exe Token: SeUndockPrivilege 1584 72b401594c6d7674f905f8fcc187e2c8525f6b2c1c9682fafd5e1191d6a617cd.exe Token: SeManageVolumePrivilege 1584 72b401594c6d7674f905f8fcc187e2c8525f6b2c1c9682fafd5e1191d6a617cd.exe Token: SeImpersonatePrivilege 1584 72b401594c6d7674f905f8fcc187e2c8525f6b2c1c9682fafd5e1191d6a617cd.exe Token: SeCreateGlobalPrivilege 1584 72b401594c6d7674f905f8fcc187e2c8525f6b2c1c9682fafd5e1191d6a617cd.exe Token: 33 1584 72b401594c6d7674f905f8fcc187e2c8525f6b2c1c9682fafd5e1191d6a617cd.exe Token: 34 1584 72b401594c6d7674f905f8fcc187e2c8525f6b2c1c9682fafd5e1191d6a617cd.exe Token: 35 1584 72b401594c6d7674f905f8fcc187e2c8525f6b2c1c9682fafd5e1191d6a617cd.exe Token: SeIncreaseQuotaPrivilege 1088 msdcsc.exe Token: SeSecurityPrivilege 1088 msdcsc.exe Token: SeTakeOwnershipPrivilege 1088 msdcsc.exe Token: SeLoadDriverPrivilege 1088 msdcsc.exe Token: SeSystemProfilePrivilege 1088 msdcsc.exe Token: SeSystemtimePrivilege 1088 msdcsc.exe Token: SeProfSingleProcessPrivilege 1088 msdcsc.exe Token: SeIncBasePriorityPrivilege 1088 msdcsc.exe Token: SeCreatePagefilePrivilege 1088 msdcsc.exe Token: SeBackupPrivilege 1088 msdcsc.exe Token: SeRestorePrivilege 1088 msdcsc.exe Token: SeShutdownPrivilege 1088 msdcsc.exe Token: SeDebugPrivilege 1088 msdcsc.exe Token: SeSystemEnvironmentPrivilege 1088 msdcsc.exe Token: SeChangeNotifyPrivilege 1088 msdcsc.exe Token: SeRemoteShutdownPrivilege 1088 msdcsc.exe Token: SeUndockPrivilege 1088 msdcsc.exe Token: SeManageVolumePrivilege 1088 msdcsc.exe Token: SeImpersonatePrivilege 1088 msdcsc.exe Token: SeCreateGlobalPrivilege 1088 msdcsc.exe Token: 33 1088 msdcsc.exe Token: 34 1088 msdcsc.exe Token: 35 1088 msdcsc.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
msdcsc.exepid process 1088 msdcsc.exe -
Suspicious use of WriteProcessMemory 20 IoCs
Processes:
72b401594c6d7674f905f8fcc187e2c8525f6b2c1c9682fafd5e1191d6a617cd.execmd.execmd.exedescription pid process target process PID 1584 wrote to memory of 1748 1584 72b401594c6d7674f905f8fcc187e2c8525f6b2c1c9682fafd5e1191d6a617cd.exe cmd.exe PID 1584 wrote to memory of 1748 1584 72b401594c6d7674f905f8fcc187e2c8525f6b2c1c9682fafd5e1191d6a617cd.exe cmd.exe PID 1584 wrote to memory of 1748 1584 72b401594c6d7674f905f8fcc187e2c8525f6b2c1c9682fafd5e1191d6a617cd.exe cmd.exe PID 1584 wrote to memory of 1748 1584 72b401594c6d7674f905f8fcc187e2c8525f6b2c1c9682fafd5e1191d6a617cd.exe cmd.exe PID 1584 wrote to memory of 1612 1584 72b401594c6d7674f905f8fcc187e2c8525f6b2c1c9682fafd5e1191d6a617cd.exe cmd.exe PID 1584 wrote to memory of 1612 1584 72b401594c6d7674f905f8fcc187e2c8525f6b2c1c9682fafd5e1191d6a617cd.exe cmd.exe PID 1584 wrote to memory of 1612 1584 72b401594c6d7674f905f8fcc187e2c8525f6b2c1c9682fafd5e1191d6a617cd.exe cmd.exe PID 1584 wrote to memory of 1612 1584 72b401594c6d7674f905f8fcc187e2c8525f6b2c1c9682fafd5e1191d6a617cd.exe cmd.exe PID 1612 wrote to memory of 840 1612 cmd.exe attrib.exe PID 1612 wrote to memory of 840 1612 cmd.exe attrib.exe PID 1612 wrote to memory of 840 1612 cmd.exe attrib.exe PID 1612 wrote to memory of 840 1612 cmd.exe attrib.exe PID 1748 wrote to memory of 1116 1748 cmd.exe attrib.exe PID 1748 wrote to memory of 1116 1748 cmd.exe attrib.exe PID 1748 wrote to memory of 1116 1748 cmd.exe attrib.exe PID 1748 wrote to memory of 1116 1748 cmd.exe attrib.exe PID 1584 wrote to memory of 1088 1584 72b401594c6d7674f905f8fcc187e2c8525f6b2c1c9682fafd5e1191d6a617cd.exe msdcsc.exe PID 1584 wrote to memory of 1088 1584 72b401594c6d7674f905f8fcc187e2c8525f6b2c1c9682fafd5e1191d6a617cd.exe msdcsc.exe PID 1584 wrote to memory of 1088 1584 72b401594c6d7674f905f8fcc187e2c8525f6b2c1c9682fafd5e1191d6a617cd.exe msdcsc.exe PID 1584 wrote to memory of 1088 1584 72b401594c6d7674f905f8fcc187e2c8525f6b2c1c9682fafd5e1191d6a617cd.exe msdcsc.exe -
Views/modifies file attributes 1 TTPs 2 IoCs
Processes:
attrib.exeattrib.exepid process 840 attrib.exe 1116 attrib.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\72b401594c6d7674f905f8fcc187e2c8525f6b2c1c9682fafd5e1191d6a617cd.exe"C:\Users\Admin\AppData\Local\Temp\72b401594c6d7674f905f8fcc187e2c8525f6b2c1c9682fafd5e1191d6a617cd.exe"1⤵
- Modifies WinLogon for persistence
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp\72b401594c6d7674f905f8fcc187e2c8525f6b2c1c9682fafd5e1191d6a617cd.exe" +s +h2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Users\Admin\AppData\Local\Temp\72b401594c6d7674f905f8fcc187e2c8525f6b2c1c9682fafd5e1191d6a617cd.exe" +s +h3⤵
- Sets file to hidden
- Views/modifies file attributes
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp" +s +h2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Users\Admin\AppData\Local\Temp" +s +h3⤵
- Sets file to hidden
- Views/modifies file attributes
-
C:\Users\Admin\Documents\MSDCSC\msdcsc.exe"C:\Users\Admin\Documents\MSDCSC\msdcsc.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\Documents\MSDCSC\msdcsc.exeFilesize
383KB
MD54ae30f28f1acb06cc303afb107fb5242
SHA1017ed0e76ed7daee651f88c81df2f43c986a773c
SHA25672b401594c6d7674f905f8fcc187e2c8525f6b2c1c9682fafd5e1191d6a617cd
SHA512015292b13b5712357e9b7f33cb9097884b15578598c066a1fc5a272b8cddcfffe42bc6a9fa499ffae43ce245967ce005234ead3b50cf304f84f3666f06de8f16
-
C:\Users\Admin\Documents\MSDCSC\msdcsc.exeFilesize
383KB
MD54ae30f28f1acb06cc303afb107fb5242
SHA1017ed0e76ed7daee651f88c81df2f43c986a773c
SHA25672b401594c6d7674f905f8fcc187e2c8525f6b2c1c9682fafd5e1191d6a617cd
SHA512015292b13b5712357e9b7f33cb9097884b15578598c066a1fc5a272b8cddcfffe42bc6a9fa499ffae43ce245967ce005234ead3b50cf304f84f3666f06de8f16
-
\Users\Admin\Documents\MSDCSC\msdcsc.exeFilesize
383KB
MD54ae30f28f1acb06cc303afb107fb5242
SHA1017ed0e76ed7daee651f88c81df2f43c986a773c
SHA25672b401594c6d7674f905f8fcc187e2c8525f6b2c1c9682fafd5e1191d6a617cd
SHA512015292b13b5712357e9b7f33cb9097884b15578598c066a1fc5a272b8cddcfffe42bc6a9fa499ffae43ce245967ce005234ead3b50cf304f84f3666f06de8f16
-
\Users\Admin\Documents\MSDCSC\msdcsc.exeFilesize
383KB
MD54ae30f28f1acb06cc303afb107fb5242
SHA1017ed0e76ed7daee651f88c81df2f43c986a773c
SHA25672b401594c6d7674f905f8fcc187e2c8525f6b2c1c9682fafd5e1191d6a617cd
SHA512015292b13b5712357e9b7f33cb9097884b15578598c066a1fc5a272b8cddcfffe42bc6a9fa499ffae43ce245967ce005234ead3b50cf304f84f3666f06de8f16
-
memory/840-58-0x0000000000000000-mapping.dmp
-
memory/1088-62-0x0000000000000000-mapping.dmp
-
memory/1088-67-0x0000000000400000-0x00000000004FF000-memory.dmpFilesize
1020KB
-
memory/1088-69-0x0000000000400000-0x00000000004FF000-memory.dmpFilesize
1020KB
-
memory/1116-59-0x0000000000000000-mapping.dmp
-
memory/1584-54-0x0000000074BB1000-0x0000000074BB3000-memory.dmpFilesize
8KB
-
memory/1584-55-0x0000000000400000-0x00000000004FF000-memory.dmpFilesize
1020KB
-
memory/1584-66-0x0000000003280000-0x000000000337F000-memory.dmpFilesize
1020KB
-
memory/1584-68-0x0000000000400000-0x00000000004FF000-memory.dmpFilesize
1020KB
-
memory/1612-57-0x0000000000000000-mapping.dmp
-
memory/1748-56-0x0000000000000000-mapping.dmp