Analysis
-
max time kernel
150s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
26-11-2022 13:42
Static task
static1
Behavioral task
behavioral1
Sample
7487b0bf31ecec6248a41d78cd00d1f4e4b5f6e778b363f0d798fe2e654f1f93.exe
Resource
win7-20221111-en
General
-
Target
7487b0bf31ecec6248a41d78cd00d1f4e4b5f6e778b363f0d798fe2e654f1f93.exe
-
Size
328KB
-
MD5
5a6770a663b5125240a78424db7a74f2
-
SHA1
b3f3615b2e3c7b04fa904ce893644b9de65f9395
-
SHA256
7487b0bf31ecec6248a41d78cd00d1f4e4b5f6e778b363f0d798fe2e654f1f93
-
SHA512
58bfc1a02760d14ac63e4a9c8a06430a1a2adca1608fba10d8be59e34db03e51cf8ebbb6b7e016fd932506af7246da501b5ea0a1f6ab4e6aa78b32ad106aa5ad
-
SSDEEP
6144:umYnW1JAtWAwM0bWQLM0D0B+Gs4Jc+UO5EBGprbDGwBuUPN:KW1JuWm0bRw+NTO5JRPGwBrV
Malware Config
Extracted
darkcomet
BackUp
185.17.1.54:9002
WindowsBackUpMgr
-
gencode
VzVqX1p6FUzg
-
install
false
-
offline_keylogger
true
-
password
redblood1
-
persistence
false
Signatures
-
Executes dropped EXE 3 IoCs
Processes:
winlogon.exewinlogon.execsrss.exepid process 4964 winlogon.exe 1224 winlogon.exe 4912 csrss.exe -
Processes:
resource yara_rule behavioral2/memory/1224-140-0x0000000000400000-0x00000000004B7000-memory.dmp upx behavioral2/memory/1224-141-0x0000000000400000-0x00000000004B7000-memory.dmp upx behavioral2/memory/1224-142-0x0000000000400000-0x00000000004B7000-memory.dmp upx behavioral2/memory/1224-148-0x0000000000400000-0x00000000004B7000-memory.dmp upx behavioral2/memory/1224-150-0x0000000000400000-0x00000000004B7000-memory.dmp upx behavioral2/memory/1224-151-0x0000000000400000-0x00000000004B7000-memory.dmp upx behavioral2/memory/1224-152-0x0000000000400000-0x00000000004B7000-memory.dmp upx behavioral2/memory/1224-157-0x0000000000400000-0x00000000004B7000-memory.dmp upx -
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
7487b0bf31ecec6248a41d78cd00d1f4e4b5f6e778b363f0d798fe2e654f1f93.exewinlogon.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation 7487b0bf31ecec6248a41d78cd00d1f4e4b5f6e778b363f0d798fe2e654f1f93.exe Key value queried \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation winlogon.exe -
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
winlogon.execsrss.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Winlogon = "C:\\Users\\Admin\\AppData\\Roaming\\sgbcsvbadfvbdfvasdf\\Tsdfadsvsfsdfs\\winlogon.exe" winlogon.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Winlogon = "C:\\Users\\Admin\\AppData\\Roaming\\sgbcsvbadfvbdfvasdf\\Tsdfadsvsfsdfs\\winlogon.exe" winlogon.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Winlogon = "C:\\Users\\Admin\\AppData\\Roaming\\sgbcsvbadfvbdfvasdf\\Tsdfadsvsfsdfs\\winlogon.exe" csrss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Winlogon = "C:\\Users\\Admin\\AppData\\Roaming\\sgbcsvbadfvbdfvasdf\\Tsdfadsvsfsdfs\\winlogon.exe" csrss.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
winlogon.exedescription pid process target process PID 4964 set thread context of 1224 4964 winlogon.exe winlogon.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Modifies registry class 1 IoCs
Processes:
winlogon.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ winlogon.exe -
NTFS ADS 4 IoCs
Processes:
7487b0bf31ecec6248a41d78cd00d1f4e4b5f6e778b363f0d798fe2e654f1f93.execmd.exewinlogon.execmd.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\sgbcsvbadfvbdfvasdf\Tsdfadsvsfsdfs\winlogon.exe\:ZONE.identifier:$DATA 7487b0bf31ecec6248a41d78cd00d1f4e4b5f6e778b363f0d798fe2e654f1f93.exe File opened for modification C:\Users\Admin\AppData\Roaming\sgbcsvbadfvbdfvasdf\Tsdfadsvsfsdfs\winlogon.exe:ZONE.identifier cmd.exe File created C:\Users\Admin\AppData\Roaming\sgbcsvbadfvbdfvasdf\Tsdfadsvsfsdfs\csrss.exe\:ZONE.identifier:$DATA winlogon.exe File created C:\Users\Admin\AppData\Local\Temp\7487b0bf31ecec6248a41d78cd00d1f4e4b5f6e778b363f0d798fe2e654f1f93.exe:ZONE.identifier cmd.exe -
Suspicious behavior: EnumeratesProcesses 63 IoCs
Processes:
csrss.exepid process 4912 csrss.exe 4912 csrss.exe 4912 csrss.exe 4912 csrss.exe 4912 csrss.exe 4912 csrss.exe 4912 csrss.exe 4912 csrss.exe 4912 csrss.exe 4912 csrss.exe 4912 csrss.exe 4912 csrss.exe 4912 csrss.exe 4912 csrss.exe 4912 csrss.exe 4912 csrss.exe 4912 csrss.exe 4912 csrss.exe 4912 csrss.exe 4912 csrss.exe 4912 csrss.exe 4912 csrss.exe 4912 csrss.exe 4912 csrss.exe 4912 csrss.exe 4912 csrss.exe 4912 csrss.exe 4912 csrss.exe 4912 csrss.exe 4912 csrss.exe 4912 csrss.exe 4912 csrss.exe 4912 csrss.exe 4912 csrss.exe 4912 csrss.exe 4912 csrss.exe 4912 csrss.exe 4912 csrss.exe 4912 csrss.exe 4912 csrss.exe 4912 csrss.exe 4912 csrss.exe 4912 csrss.exe 4912 csrss.exe 4912 csrss.exe 4912 csrss.exe 4912 csrss.exe 4912 csrss.exe 4912 csrss.exe 4912 csrss.exe 4912 csrss.exe 4912 csrss.exe 4912 csrss.exe 4912 csrss.exe 4912 csrss.exe 4912 csrss.exe 4912 csrss.exe 4912 csrss.exe 4912 csrss.exe 4912 csrss.exe 4912 csrss.exe 4912 csrss.exe 4912 csrss.exe -
Suspicious use of AdjustPrivilegeToken 25 IoCs
Processes:
winlogon.execsrss.exedescription pid process Token: SeIncreaseQuotaPrivilege 1224 winlogon.exe Token: SeSecurityPrivilege 1224 winlogon.exe Token: SeTakeOwnershipPrivilege 1224 winlogon.exe Token: SeLoadDriverPrivilege 1224 winlogon.exe Token: SeSystemProfilePrivilege 1224 winlogon.exe Token: SeSystemtimePrivilege 1224 winlogon.exe Token: SeProfSingleProcessPrivilege 1224 winlogon.exe Token: SeIncBasePriorityPrivilege 1224 winlogon.exe Token: SeCreatePagefilePrivilege 1224 winlogon.exe Token: SeBackupPrivilege 1224 winlogon.exe Token: SeRestorePrivilege 1224 winlogon.exe Token: SeShutdownPrivilege 1224 winlogon.exe Token: SeDebugPrivilege 1224 winlogon.exe Token: SeSystemEnvironmentPrivilege 1224 winlogon.exe Token: SeChangeNotifyPrivilege 1224 winlogon.exe Token: SeRemoteShutdownPrivilege 1224 winlogon.exe Token: SeUndockPrivilege 1224 winlogon.exe Token: SeManageVolumePrivilege 1224 winlogon.exe Token: SeImpersonatePrivilege 1224 winlogon.exe Token: SeCreateGlobalPrivilege 1224 winlogon.exe Token: 33 1224 winlogon.exe Token: 34 1224 winlogon.exe Token: 35 1224 winlogon.exe Token: 36 1224 winlogon.exe Token: SeDebugPrivilege 4912 csrss.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
winlogon.exepid process 1224 winlogon.exe -
Suspicious use of WriteProcessMemory 16 IoCs
Processes:
7487b0bf31ecec6248a41d78cd00d1f4e4b5f6e778b363f0d798fe2e654f1f93.exewinlogon.exedescription pid process target process PID 2264 wrote to memory of 4480 2264 7487b0bf31ecec6248a41d78cd00d1f4e4b5f6e778b363f0d798fe2e654f1f93.exe cmd.exe PID 2264 wrote to memory of 4480 2264 7487b0bf31ecec6248a41d78cd00d1f4e4b5f6e778b363f0d798fe2e654f1f93.exe cmd.exe PID 2264 wrote to memory of 4964 2264 7487b0bf31ecec6248a41d78cd00d1f4e4b5f6e778b363f0d798fe2e654f1f93.exe winlogon.exe PID 2264 wrote to memory of 4964 2264 7487b0bf31ecec6248a41d78cd00d1f4e4b5f6e778b363f0d798fe2e654f1f93.exe winlogon.exe PID 4964 wrote to memory of 3268 4964 winlogon.exe cmd.exe PID 4964 wrote to memory of 3268 4964 winlogon.exe cmd.exe PID 4964 wrote to memory of 1224 4964 winlogon.exe winlogon.exe PID 4964 wrote to memory of 1224 4964 winlogon.exe winlogon.exe PID 4964 wrote to memory of 1224 4964 winlogon.exe winlogon.exe PID 4964 wrote to memory of 1224 4964 winlogon.exe winlogon.exe PID 4964 wrote to memory of 1224 4964 winlogon.exe winlogon.exe PID 4964 wrote to memory of 1224 4964 winlogon.exe winlogon.exe PID 4964 wrote to memory of 1224 4964 winlogon.exe winlogon.exe PID 4964 wrote to memory of 1224 4964 winlogon.exe winlogon.exe PID 4964 wrote to memory of 4912 4964 winlogon.exe csrss.exe PID 4964 wrote to memory of 4912 4964 winlogon.exe csrss.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\7487b0bf31ecec6248a41d78cd00d1f4e4b5f6e778b363f0d798fe2e654f1f93.exe"C:\Users\Admin\AppData\Local\Temp\7487b0bf31ecec6248a41d78cd00d1f4e4b5f6e778b363f0d798fe2e654f1f93.exe"1⤵
- Checks computer location settings
- NTFS ADS
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c echo [zoneTransfer]ZoneID = 2 > "C:\Users\Admin\AppData\Local\Temp\7487b0bf31ecec6248a41d78cd00d1f4e4b5f6e778b363f0d798fe2e654f1f93.exe":ZONE.identifier & exit2⤵
- NTFS ADS
-
C:\Users\Admin\AppData\Roaming\sgbcsvbadfvbdfvasdf\Tsdfadsvsfsdfs\winlogon.exe"C:\Users\Admin\AppData\Roaming\sgbcsvbadfvbdfvasdf\Tsdfadsvsfsdfs\winlogon.exe"2⤵
- Executes dropped EXE
- Checks computer location settings
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Modifies registry class
- NTFS ADS
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c echo [zoneTransfer]ZoneID = 2 > "C:\Users\Admin\AppData\Roaming\sgbcsvbadfvbdfvasdf\Tsdfadsvsfsdfs\winlogon.exe":ZONE.identifier & exit3⤵
- NTFS ADS
-
C:\Users\Admin\AppData\Roaming\winlogon.exe"C:\Users\Admin\AppData\Roaming\winlogon.exe"3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Roaming\sgbcsvbadfvbdfvasdf\Tsdfadsvsfsdfs\csrss.exe"C:\Users\Admin\AppData\Roaming\sgbcsvbadfvbdfvasdf\Tsdfadsvsfsdfs\csrss.exe" -reg C:\Users\Admin\AppData\Roaming\sgbcsvbadfvbdfvasdf\Tsdfadsvsfsdfs\winlogon.exe -proc 1224 C:\Users\Admin\AppData\Roaming\sgbcsvbadfvbdfvasdf\Tsdfadsvsfsdfs\winlogon.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\7487b0bf31ecec6248a41d78cd00d1f4e4b5f6e778b363f0d798fe2e654f1f93.exeFilesize
328KB
MD55a6770a663b5125240a78424db7a74f2
SHA1b3f3615b2e3c7b04fa904ce893644b9de65f9395
SHA2567487b0bf31ecec6248a41d78cd00d1f4e4b5f6e778b363f0d798fe2e654f1f93
SHA51258bfc1a02760d14ac63e4a9c8a06430a1a2adca1608fba10d8be59e34db03e51cf8ebbb6b7e016fd932506af7246da501b5ea0a1f6ab4e6aa78b32ad106aa5ad
-
C:\Users\Admin\AppData\Roaming\sgbcsvbadfvbdfvasdf\Tsdfadsvsfsdfs\csrss.exeFilesize
328KB
MD55a6770a663b5125240a78424db7a74f2
SHA1b3f3615b2e3c7b04fa904ce893644b9de65f9395
SHA2567487b0bf31ecec6248a41d78cd00d1f4e4b5f6e778b363f0d798fe2e654f1f93
SHA51258bfc1a02760d14ac63e4a9c8a06430a1a2adca1608fba10d8be59e34db03e51cf8ebbb6b7e016fd932506af7246da501b5ea0a1f6ab4e6aa78b32ad106aa5ad
-
C:\Users\Admin\AppData\Roaming\sgbcsvbadfvbdfvasdf\Tsdfadsvsfsdfs\csrss.exeFilesize
328KB
MD55a6770a663b5125240a78424db7a74f2
SHA1b3f3615b2e3c7b04fa904ce893644b9de65f9395
SHA2567487b0bf31ecec6248a41d78cd00d1f4e4b5f6e778b363f0d798fe2e654f1f93
SHA51258bfc1a02760d14ac63e4a9c8a06430a1a2adca1608fba10d8be59e34db03e51cf8ebbb6b7e016fd932506af7246da501b5ea0a1f6ab4e6aa78b32ad106aa5ad
-
C:\Users\Admin\AppData\Roaming\sgbcsvbadfvbdfvasdf\Tsdfadsvsfsdfs\winlogon.exeFilesize
328KB
MD55a6770a663b5125240a78424db7a74f2
SHA1b3f3615b2e3c7b04fa904ce893644b9de65f9395
SHA2567487b0bf31ecec6248a41d78cd00d1f4e4b5f6e778b363f0d798fe2e654f1f93
SHA51258bfc1a02760d14ac63e4a9c8a06430a1a2adca1608fba10d8be59e34db03e51cf8ebbb6b7e016fd932506af7246da501b5ea0a1f6ab4e6aa78b32ad106aa5ad
-
C:\Users\Admin\AppData\Roaming\sgbcsvbadfvbdfvasdf\Tsdfadsvsfsdfs\winlogon.exeFilesize
328KB
MD55a6770a663b5125240a78424db7a74f2
SHA1b3f3615b2e3c7b04fa904ce893644b9de65f9395
SHA2567487b0bf31ecec6248a41d78cd00d1f4e4b5f6e778b363f0d798fe2e654f1f93
SHA51258bfc1a02760d14ac63e4a9c8a06430a1a2adca1608fba10d8be59e34db03e51cf8ebbb6b7e016fd932506af7246da501b5ea0a1f6ab4e6aa78b32ad106aa5ad
-
C:\Users\Admin\AppData\Roaming\sgbcsvbadfvbdfvasdf\Tsdfadsvsfsdfs\winlogon.exeFilesize
328KB
MD55a6770a663b5125240a78424db7a74f2
SHA1b3f3615b2e3c7b04fa904ce893644b9de65f9395
SHA2567487b0bf31ecec6248a41d78cd00d1f4e4b5f6e778b363f0d798fe2e654f1f93
SHA51258bfc1a02760d14ac63e4a9c8a06430a1a2adca1608fba10d8be59e34db03e51cf8ebbb6b7e016fd932506af7246da501b5ea0a1f6ab4e6aa78b32ad106aa5ad
-
C:\Users\Admin\AppData\Roaming\winlogon.exeFilesize
1.1MB
MD5d881de17aa8f2e2c08cbb7b265f928f9
SHA108936aebc87decf0af6e8eada191062b5e65ac2a
SHA256b3a37093609f9a20ad60b85a9fa9de2ba674cba9b5bd687729440c70ba619ca0
SHA5125f23bfb1b8740247b36ed0ab741738c7d4c949736129e767213e321607d1ccd3e3a8428e4ba44bd28a275b5e3f6206285b1a522514b7ef7ea5e698d90a713d34
-
C:\Users\Admin\AppData\Roaming\winlogon.exeFilesize
1.1MB
MD5d881de17aa8f2e2c08cbb7b265f928f9
SHA108936aebc87decf0af6e8eada191062b5e65ac2a
SHA256b3a37093609f9a20ad60b85a9fa9de2ba674cba9b5bd687729440c70ba619ca0
SHA5125f23bfb1b8740247b36ed0ab741738c7d4c949736129e767213e321607d1ccd3e3a8428e4ba44bd28a275b5e3f6206285b1a522514b7ef7ea5e698d90a713d34
-
memory/1224-152-0x0000000000400000-0x00000000004B7000-memory.dmpFilesize
732KB
-
memory/1224-151-0x0000000000400000-0x00000000004B7000-memory.dmpFilesize
732KB
-
memory/1224-142-0x0000000000400000-0x00000000004B7000-memory.dmpFilesize
732KB
-
memory/1224-140-0x0000000000400000-0x00000000004B7000-memory.dmpFilesize
732KB
-
memory/1224-157-0x0000000000400000-0x00000000004B7000-memory.dmpFilesize
732KB
-
memory/1224-144-0x00000000004B5670-mapping.dmp
-
memory/1224-141-0x0000000000400000-0x00000000004B7000-memory.dmpFilesize
732KB
-
memory/1224-148-0x0000000000400000-0x00000000004B7000-memory.dmpFilesize
732KB
-
memory/1224-150-0x0000000000400000-0x00000000004B7000-memory.dmpFilesize
732KB
-
memory/2264-132-0x00007FFEE7540000-0x00007FFEE7F76000-memory.dmpFilesize
10.2MB
-
memory/3268-139-0x0000000000000000-mapping.dmp
-
memory/4480-133-0x0000000000000000-mapping.dmp
-
memory/4912-153-0x0000000000000000-mapping.dmp
-
memory/4912-156-0x00007FFEE7540000-0x00007FFEE7F76000-memory.dmpFilesize
10.2MB
-
memory/4964-138-0x00007FFEE7540000-0x00007FFEE7F76000-memory.dmpFilesize
10.2MB
-
memory/4964-135-0x0000000000000000-mapping.dmp