Analysis
-
max time kernel
151s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
27-11-2022 18:33
Static task
static1
Behavioral task
behavioral1
Sample
cdf1fc89d06955c1c4974ed8c229c4eecf8bba4ffdbe99be47cdea71378a16d0.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
cdf1fc89d06955c1c4974ed8c229c4eecf8bba4ffdbe99be47cdea71378a16d0.exe
Resource
win10v2004-20220812-en
General
-
Target
cdf1fc89d06955c1c4974ed8c229c4eecf8bba4ffdbe99be47cdea71378a16d0.exe
-
Size
485KB
-
MD5
a026aec96f86b5aa9a5865d1077dae0e
-
SHA1
cf2e36d388a7f845387a97f3f0c77c77b1c55988
-
SHA256
cdf1fc89d06955c1c4974ed8c229c4eecf8bba4ffdbe99be47cdea71378a16d0
-
SHA512
c77974434c2f065bcfe6e5bf32e097a0c2d35d05cc0f20e75a421ff9c0a76034f4a72a33ed295c147800f6b937c7f9b4b25dd2ef6d28472b234a0a1ba18a06d0
-
SSDEEP
12288:xNMAK4dRRmq28Q3v1GxBMsE6dQs4Hc61JX2Upy+:xNn3c/UMsE/cAmS
Malware Config
Extracted
darkcomet
Bot
takeit23.chickenkiller.com:6993
DC_MUTEX-HEN14M3
-
gencode
9M36A1ngLJGa
-
install
false
-
offline_keylogger
true
-
persistence
false
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
cdf1fc89d06955c1c4974ed8c229c4eecf8bba4ffdbe99be47cdea71378a16d0.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation cdf1fc89d06955c1c4974ed8c229c4eecf8bba4ffdbe99be47cdea71378a16d0.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
reg.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Windows\CurrentVersion\Run reg.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\GoogleUpdate = "C:\\Users\\Admin\\AppData\\Roaming\\WinApp\\GoogleUpdate.exe.lnk" reg.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
cdf1fc89d06955c1c4974ed8c229c4eecf8bba4ffdbe99be47cdea71378a16d0.exedescription pid process target process PID 4676 set thread context of 1720 4676 cdf1fc89d06955c1c4974ed8c229c4eecf8bba4ffdbe99be47cdea71378a16d0.exe cdf1fc89d06955c1c4974ed8c229c4eecf8bba4ffdbe99be47cdea71378a16d0.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
cdf1fc89d06955c1c4974ed8c229c4eecf8bba4ffdbe99be47cdea71378a16d0.exepid process 4676 cdf1fc89d06955c1c4974ed8c229c4eecf8bba4ffdbe99be47cdea71378a16d0.exe 4676 cdf1fc89d06955c1c4974ed8c229c4eecf8bba4ffdbe99be47cdea71378a16d0.exe -
Suspicious use of AdjustPrivilegeToken 25 IoCs
Processes:
cdf1fc89d06955c1c4974ed8c229c4eecf8bba4ffdbe99be47cdea71378a16d0.execdf1fc89d06955c1c4974ed8c229c4eecf8bba4ffdbe99be47cdea71378a16d0.exedescription pid process Token: SeDebugPrivilege 4676 cdf1fc89d06955c1c4974ed8c229c4eecf8bba4ffdbe99be47cdea71378a16d0.exe Token: SeIncreaseQuotaPrivilege 1720 cdf1fc89d06955c1c4974ed8c229c4eecf8bba4ffdbe99be47cdea71378a16d0.exe Token: SeSecurityPrivilege 1720 cdf1fc89d06955c1c4974ed8c229c4eecf8bba4ffdbe99be47cdea71378a16d0.exe Token: SeTakeOwnershipPrivilege 1720 cdf1fc89d06955c1c4974ed8c229c4eecf8bba4ffdbe99be47cdea71378a16d0.exe Token: SeLoadDriverPrivilege 1720 cdf1fc89d06955c1c4974ed8c229c4eecf8bba4ffdbe99be47cdea71378a16d0.exe Token: SeSystemProfilePrivilege 1720 cdf1fc89d06955c1c4974ed8c229c4eecf8bba4ffdbe99be47cdea71378a16d0.exe Token: SeSystemtimePrivilege 1720 cdf1fc89d06955c1c4974ed8c229c4eecf8bba4ffdbe99be47cdea71378a16d0.exe Token: SeProfSingleProcessPrivilege 1720 cdf1fc89d06955c1c4974ed8c229c4eecf8bba4ffdbe99be47cdea71378a16d0.exe Token: SeIncBasePriorityPrivilege 1720 cdf1fc89d06955c1c4974ed8c229c4eecf8bba4ffdbe99be47cdea71378a16d0.exe Token: SeCreatePagefilePrivilege 1720 cdf1fc89d06955c1c4974ed8c229c4eecf8bba4ffdbe99be47cdea71378a16d0.exe Token: SeBackupPrivilege 1720 cdf1fc89d06955c1c4974ed8c229c4eecf8bba4ffdbe99be47cdea71378a16d0.exe Token: SeRestorePrivilege 1720 cdf1fc89d06955c1c4974ed8c229c4eecf8bba4ffdbe99be47cdea71378a16d0.exe Token: SeShutdownPrivilege 1720 cdf1fc89d06955c1c4974ed8c229c4eecf8bba4ffdbe99be47cdea71378a16d0.exe Token: SeDebugPrivilege 1720 cdf1fc89d06955c1c4974ed8c229c4eecf8bba4ffdbe99be47cdea71378a16d0.exe Token: SeSystemEnvironmentPrivilege 1720 cdf1fc89d06955c1c4974ed8c229c4eecf8bba4ffdbe99be47cdea71378a16d0.exe Token: SeChangeNotifyPrivilege 1720 cdf1fc89d06955c1c4974ed8c229c4eecf8bba4ffdbe99be47cdea71378a16d0.exe Token: SeRemoteShutdownPrivilege 1720 cdf1fc89d06955c1c4974ed8c229c4eecf8bba4ffdbe99be47cdea71378a16d0.exe Token: SeUndockPrivilege 1720 cdf1fc89d06955c1c4974ed8c229c4eecf8bba4ffdbe99be47cdea71378a16d0.exe Token: SeManageVolumePrivilege 1720 cdf1fc89d06955c1c4974ed8c229c4eecf8bba4ffdbe99be47cdea71378a16d0.exe Token: SeImpersonatePrivilege 1720 cdf1fc89d06955c1c4974ed8c229c4eecf8bba4ffdbe99be47cdea71378a16d0.exe Token: SeCreateGlobalPrivilege 1720 cdf1fc89d06955c1c4974ed8c229c4eecf8bba4ffdbe99be47cdea71378a16d0.exe Token: 33 1720 cdf1fc89d06955c1c4974ed8c229c4eecf8bba4ffdbe99be47cdea71378a16d0.exe Token: 34 1720 cdf1fc89d06955c1c4974ed8c229c4eecf8bba4ffdbe99be47cdea71378a16d0.exe Token: 35 1720 cdf1fc89d06955c1c4974ed8c229c4eecf8bba4ffdbe99be47cdea71378a16d0.exe Token: 36 1720 cdf1fc89d06955c1c4974ed8c229c4eecf8bba4ffdbe99be47cdea71378a16d0.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
cdf1fc89d06955c1c4974ed8c229c4eecf8bba4ffdbe99be47cdea71378a16d0.exepid process 1720 cdf1fc89d06955c1c4974ed8c229c4eecf8bba4ffdbe99be47cdea71378a16d0.exe -
Suspicious use of WriteProcessMemory 18 IoCs
Processes:
cdf1fc89d06955c1c4974ed8c229c4eecf8bba4ffdbe99be47cdea71378a16d0.execmd.exedescription pid process target process PID 4676 wrote to memory of 4760 4676 cdf1fc89d06955c1c4974ed8c229c4eecf8bba4ffdbe99be47cdea71378a16d0.exe cmd.exe PID 4676 wrote to memory of 4760 4676 cdf1fc89d06955c1c4974ed8c229c4eecf8bba4ffdbe99be47cdea71378a16d0.exe cmd.exe PID 4676 wrote to memory of 4760 4676 cdf1fc89d06955c1c4974ed8c229c4eecf8bba4ffdbe99be47cdea71378a16d0.exe cmd.exe PID 4760 wrote to memory of 4608 4760 cmd.exe reg.exe PID 4760 wrote to memory of 4608 4760 cmd.exe reg.exe PID 4760 wrote to memory of 4608 4760 cmd.exe reg.exe PID 4676 wrote to memory of 1720 4676 cdf1fc89d06955c1c4974ed8c229c4eecf8bba4ffdbe99be47cdea71378a16d0.exe cdf1fc89d06955c1c4974ed8c229c4eecf8bba4ffdbe99be47cdea71378a16d0.exe PID 4676 wrote to memory of 1720 4676 cdf1fc89d06955c1c4974ed8c229c4eecf8bba4ffdbe99be47cdea71378a16d0.exe cdf1fc89d06955c1c4974ed8c229c4eecf8bba4ffdbe99be47cdea71378a16d0.exe PID 4676 wrote to memory of 1720 4676 cdf1fc89d06955c1c4974ed8c229c4eecf8bba4ffdbe99be47cdea71378a16d0.exe cdf1fc89d06955c1c4974ed8c229c4eecf8bba4ffdbe99be47cdea71378a16d0.exe PID 4676 wrote to memory of 1720 4676 cdf1fc89d06955c1c4974ed8c229c4eecf8bba4ffdbe99be47cdea71378a16d0.exe cdf1fc89d06955c1c4974ed8c229c4eecf8bba4ffdbe99be47cdea71378a16d0.exe PID 4676 wrote to memory of 1720 4676 cdf1fc89d06955c1c4974ed8c229c4eecf8bba4ffdbe99be47cdea71378a16d0.exe cdf1fc89d06955c1c4974ed8c229c4eecf8bba4ffdbe99be47cdea71378a16d0.exe PID 4676 wrote to memory of 1720 4676 cdf1fc89d06955c1c4974ed8c229c4eecf8bba4ffdbe99be47cdea71378a16d0.exe cdf1fc89d06955c1c4974ed8c229c4eecf8bba4ffdbe99be47cdea71378a16d0.exe PID 4676 wrote to memory of 1720 4676 cdf1fc89d06955c1c4974ed8c229c4eecf8bba4ffdbe99be47cdea71378a16d0.exe cdf1fc89d06955c1c4974ed8c229c4eecf8bba4ffdbe99be47cdea71378a16d0.exe PID 4676 wrote to memory of 1720 4676 cdf1fc89d06955c1c4974ed8c229c4eecf8bba4ffdbe99be47cdea71378a16d0.exe cdf1fc89d06955c1c4974ed8c229c4eecf8bba4ffdbe99be47cdea71378a16d0.exe PID 4676 wrote to memory of 1720 4676 cdf1fc89d06955c1c4974ed8c229c4eecf8bba4ffdbe99be47cdea71378a16d0.exe cdf1fc89d06955c1c4974ed8c229c4eecf8bba4ffdbe99be47cdea71378a16d0.exe PID 4676 wrote to memory of 1720 4676 cdf1fc89d06955c1c4974ed8c229c4eecf8bba4ffdbe99be47cdea71378a16d0.exe cdf1fc89d06955c1c4974ed8c229c4eecf8bba4ffdbe99be47cdea71378a16d0.exe PID 4676 wrote to memory of 1720 4676 cdf1fc89d06955c1c4974ed8c229c4eecf8bba4ffdbe99be47cdea71378a16d0.exe cdf1fc89d06955c1c4974ed8c229c4eecf8bba4ffdbe99be47cdea71378a16d0.exe PID 4676 wrote to memory of 1720 4676 cdf1fc89d06955c1c4974ed8c229c4eecf8bba4ffdbe99be47cdea71378a16d0.exe cdf1fc89d06955c1c4974ed8c229c4eecf8bba4ffdbe99be47cdea71378a16d0.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\cdf1fc89d06955c1c4974ed8c229c4eecf8bba4ffdbe99be47cdea71378a16d0.exe"C:\Users\Admin\AppData\Local\Temp\cdf1fc89d06955c1c4974ed8c229c4eecf8bba4ffdbe99be47cdea71378a16d0.exe"1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "GoogleUpdate" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\WinApp\GoogleUpdate.exe.lnk"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\reg.exereg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "GoogleUpdate" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\WinApp\GoogleUpdate.exe.lnk"3⤵
- Adds Run key to start application
-
C:\Users\Admin\AppData\Local\Temp\cdf1fc89d06955c1c4974ed8c229c4eecf8bba4ffdbe99be47cdea71378a16d0.exe"C:\Users\Admin\AppData\Local\Temp\cdf1fc89d06955c1c4974ed8c229c4eecf8bba4ffdbe99be47cdea71378a16d0.exe"2⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1720-136-0x0000000000000000-mapping.dmp
-
memory/1720-137-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/1720-138-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/1720-139-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/1720-140-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/1720-141-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/4608-135-0x0000000000000000-mapping.dmp
-
memory/4676-132-0x0000000075310000-0x00000000758C1000-memory.dmpFilesize
5.7MB
-
memory/4676-133-0x0000000075310000-0x00000000758C1000-memory.dmpFilesize
5.7MB
-
memory/4760-134-0x0000000000000000-mapping.dmp