Analysis
-
max time kernel
169s -
max time network
171s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
28-11-2022 05:56
Static task
static1
Behavioral task
behavioral1
Sample
92ca5e43bb22376cd1995ba5664a92690ee01b44930809619422fffe2f200e7c.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
92ca5e43bb22376cd1995ba5664a92690ee01b44930809619422fffe2f200e7c.exe
Resource
win10v2004-20220812-en
General
-
Target
92ca5e43bb22376cd1995ba5664a92690ee01b44930809619422fffe2f200e7c.exe
-
Size
1009KB
-
MD5
e0fecd1853ec03f20e8d2cc28b7012da
-
SHA1
93a0a322615876ed4c625e0410ca1fdc08e8ad8b
-
SHA256
92ca5e43bb22376cd1995ba5664a92690ee01b44930809619422fffe2f200e7c
-
SHA512
efc56b9c045eef8df9072c99d28b7797b17e64fc337152ca7816975f608717f9b0df0c652e138f5fc071b7838e91f4460eed0ea99c668881b37e3863657191e9
-
SSDEEP
24576:w3/+i1/ShId2i5JZYb/v5goqv2rL7fimsAONU:wXO8g
Malware Config
Extracted
darkcomet
RSACCS
trojanhasswag.chickenkiller.com:1337
DCMIN_MUTEX-SHQRVP8
-
InstallPath
DCSCMIN\IMDCSC.exe
-
gencode
PwMPh90f59Ky
-
install
true
-
offline_keylogger
true
-
persistence
false
-
reg_key
DarkComet RAT
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
Processes:
92ca5e43bb22376cd1995ba5664a92690ee01b44930809619422fffe2f200e7c.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Users\\Admin\\Documents\\DCSCMIN\\IMDCSC.exe" 92ca5e43bb22376cd1995ba5664a92690ee01b44930809619422fffe2f200e7c.exe -
Executes dropped EXE 2 IoCs
Processes:
IMDCSC.exeIMDCSC.exepid process 1400 IMDCSC.exe 4704 IMDCSC.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
92ca5e43bb22376cd1995ba5664a92690ee01b44930809619422fffe2f200e7c.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation 92ca5e43bb22376cd1995ba5664a92690ee01b44930809619422fffe2f200e7c.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
92ca5e43bb22376cd1995ba5664a92690ee01b44930809619422fffe2f200e7c.exe92ca5e43bb22376cd1995ba5664a92690ee01b44930809619422fffe2f200e7c.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\DarkComet RAT = "C:\\Users\\Admin\\Documents\\DCSCMIN\\IMDCSC.exe" 92ca5e43bb22376cd1995ba5664a92690ee01b44930809619422fffe2f200e7c.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\startup = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\u00ad\\Start Menu\\Programs\\Startup\\startup.exe" 92ca5e43bb22376cd1995ba5664a92690ee01b44930809619422fffe2f200e7c.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
92ca5e43bb22376cd1995ba5664a92690ee01b44930809619422fffe2f200e7c.exeIMDCSC.exedescription pid process target process PID 1408 set thread context of 1144 1408 92ca5e43bb22376cd1995ba5664a92690ee01b44930809619422fffe2f200e7c.exe 92ca5e43bb22376cd1995ba5664a92690ee01b44930809619422fffe2f200e7c.exe PID 1400 set thread context of 4704 1400 IMDCSC.exe IMDCSC.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of AdjustPrivilegeToken 50 IoCs
Processes:
92ca5e43bb22376cd1995ba5664a92690ee01b44930809619422fffe2f200e7c.exe92ca5e43bb22376cd1995ba5664a92690ee01b44930809619422fffe2f200e7c.exeIMDCSC.exeIMDCSC.exedescription pid process Token: SeDebugPrivilege 1408 92ca5e43bb22376cd1995ba5664a92690ee01b44930809619422fffe2f200e7c.exe Token: SeIncreaseQuotaPrivilege 1144 92ca5e43bb22376cd1995ba5664a92690ee01b44930809619422fffe2f200e7c.exe Token: SeSecurityPrivilege 1144 92ca5e43bb22376cd1995ba5664a92690ee01b44930809619422fffe2f200e7c.exe Token: SeTakeOwnershipPrivilege 1144 92ca5e43bb22376cd1995ba5664a92690ee01b44930809619422fffe2f200e7c.exe Token: SeLoadDriverPrivilege 1144 92ca5e43bb22376cd1995ba5664a92690ee01b44930809619422fffe2f200e7c.exe Token: SeSystemProfilePrivilege 1144 92ca5e43bb22376cd1995ba5664a92690ee01b44930809619422fffe2f200e7c.exe Token: SeSystemtimePrivilege 1144 92ca5e43bb22376cd1995ba5664a92690ee01b44930809619422fffe2f200e7c.exe Token: SeProfSingleProcessPrivilege 1144 92ca5e43bb22376cd1995ba5664a92690ee01b44930809619422fffe2f200e7c.exe Token: SeIncBasePriorityPrivilege 1144 92ca5e43bb22376cd1995ba5664a92690ee01b44930809619422fffe2f200e7c.exe Token: SeCreatePagefilePrivilege 1144 92ca5e43bb22376cd1995ba5664a92690ee01b44930809619422fffe2f200e7c.exe Token: SeBackupPrivilege 1144 92ca5e43bb22376cd1995ba5664a92690ee01b44930809619422fffe2f200e7c.exe Token: SeRestorePrivilege 1144 92ca5e43bb22376cd1995ba5664a92690ee01b44930809619422fffe2f200e7c.exe Token: SeShutdownPrivilege 1144 92ca5e43bb22376cd1995ba5664a92690ee01b44930809619422fffe2f200e7c.exe Token: SeDebugPrivilege 1144 92ca5e43bb22376cd1995ba5664a92690ee01b44930809619422fffe2f200e7c.exe Token: SeSystemEnvironmentPrivilege 1144 92ca5e43bb22376cd1995ba5664a92690ee01b44930809619422fffe2f200e7c.exe Token: SeChangeNotifyPrivilege 1144 92ca5e43bb22376cd1995ba5664a92690ee01b44930809619422fffe2f200e7c.exe Token: SeRemoteShutdownPrivilege 1144 92ca5e43bb22376cd1995ba5664a92690ee01b44930809619422fffe2f200e7c.exe Token: SeUndockPrivilege 1144 92ca5e43bb22376cd1995ba5664a92690ee01b44930809619422fffe2f200e7c.exe Token: SeManageVolumePrivilege 1144 92ca5e43bb22376cd1995ba5664a92690ee01b44930809619422fffe2f200e7c.exe Token: SeImpersonatePrivilege 1144 92ca5e43bb22376cd1995ba5664a92690ee01b44930809619422fffe2f200e7c.exe Token: SeCreateGlobalPrivilege 1144 92ca5e43bb22376cd1995ba5664a92690ee01b44930809619422fffe2f200e7c.exe Token: 33 1144 92ca5e43bb22376cd1995ba5664a92690ee01b44930809619422fffe2f200e7c.exe Token: 34 1144 92ca5e43bb22376cd1995ba5664a92690ee01b44930809619422fffe2f200e7c.exe Token: 35 1144 92ca5e43bb22376cd1995ba5664a92690ee01b44930809619422fffe2f200e7c.exe Token: 36 1144 92ca5e43bb22376cd1995ba5664a92690ee01b44930809619422fffe2f200e7c.exe Token: SeDebugPrivilege 1400 IMDCSC.exe Token: SeIncreaseQuotaPrivilege 4704 IMDCSC.exe Token: SeSecurityPrivilege 4704 IMDCSC.exe Token: SeTakeOwnershipPrivilege 4704 IMDCSC.exe Token: SeLoadDriverPrivilege 4704 IMDCSC.exe Token: SeSystemProfilePrivilege 4704 IMDCSC.exe Token: SeSystemtimePrivilege 4704 IMDCSC.exe Token: SeProfSingleProcessPrivilege 4704 IMDCSC.exe Token: SeIncBasePriorityPrivilege 4704 IMDCSC.exe Token: SeCreatePagefilePrivilege 4704 IMDCSC.exe Token: SeBackupPrivilege 4704 IMDCSC.exe Token: SeRestorePrivilege 4704 IMDCSC.exe Token: SeShutdownPrivilege 4704 IMDCSC.exe Token: SeDebugPrivilege 4704 IMDCSC.exe Token: SeSystemEnvironmentPrivilege 4704 IMDCSC.exe Token: SeChangeNotifyPrivilege 4704 IMDCSC.exe Token: SeRemoteShutdownPrivilege 4704 IMDCSC.exe Token: SeUndockPrivilege 4704 IMDCSC.exe Token: SeManageVolumePrivilege 4704 IMDCSC.exe Token: SeImpersonatePrivilege 4704 IMDCSC.exe Token: SeCreateGlobalPrivilege 4704 IMDCSC.exe Token: 33 4704 IMDCSC.exe Token: 34 4704 IMDCSC.exe Token: 35 4704 IMDCSC.exe Token: 36 4704 IMDCSC.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
IMDCSC.exepid process 4704 IMDCSC.exe -
Suspicious use of WriteProcessMemory 31 IoCs
Processes:
92ca5e43bb22376cd1995ba5664a92690ee01b44930809619422fffe2f200e7c.exe92ca5e43bb22376cd1995ba5664a92690ee01b44930809619422fffe2f200e7c.exeIMDCSC.exedescription pid process target process PID 1408 wrote to memory of 1144 1408 92ca5e43bb22376cd1995ba5664a92690ee01b44930809619422fffe2f200e7c.exe 92ca5e43bb22376cd1995ba5664a92690ee01b44930809619422fffe2f200e7c.exe PID 1408 wrote to memory of 1144 1408 92ca5e43bb22376cd1995ba5664a92690ee01b44930809619422fffe2f200e7c.exe 92ca5e43bb22376cd1995ba5664a92690ee01b44930809619422fffe2f200e7c.exe PID 1408 wrote to memory of 1144 1408 92ca5e43bb22376cd1995ba5664a92690ee01b44930809619422fffe2f200e7c.exe 92ca5e43bb22376cd1995ba5664a92690ee01b44930809619422fffe2f200e7c.exe PID 1408 wrote to memory of 1144 1408 92ca5e43bb22376cd1995ba5664a92690ee01b44930809619422fffe2f200e7c.exe 92ca5e43bb22376cd1995ba5664a92690ee01b44930809619422fffe2f200e7c.exe PID 1408 wrote to memory of 1144 1408 92ca5e43bb22376cd1995ba5664a92690ee01b44930809619422fffe2f200e7c.exe 92ca5e43bb22376cd1995ba5664a92690ee01b44930809619422fffe2f200e7c.exe PID 1408 wrote to memory of 1144 1408 92ca5e43bb22376cd1995ba5664a92690ee01b44930809619422fffe2f200e7c.exe 92ca5e43bb22376cd1995ba5664a92690ee01b44930809619422fffe2f200e7c.exe PID 1408 wrote to memory of 1144 1408 92ca5e43bb22376cd1995ba5664a92690ee01b44930809619422fffe2f200e7c.exe 92ca5e43bb22376cd1995ba5664a92690ee01b44930809619422fffe2f200e7c.exe PID 1408 wrote to memory of 1144 1408 92ca5e43bb22376cd1995ba5664a92690ee01b44930809619422fffe2f200e7c.exe 92ca5e43bb22376cd1995ba5664a92690ee01b44930809619422fffe2f200e7c.exe PID 1408 wrote to memory of 1144 1408 92ca5e43bb22376cd1995ba5664a92690ee01b44930809619422fffe2f200e7c.exe 92ca5e43bb22376cd1995ba5664a92690ee01b44930809619422fffe2f200e7c.exe PID 1408 wrote to memory of 1144 1408 92ca5e43bb22376cd1995ba5664a92690ee01b44930809619422fffe2f200e7c.exe 92ca5e43bb22376cd1995ba5664a92690ee01b44930809619422fffe2f200e7c.exe PID 1408 wrote to memory of 1144 1408 92ca5e43bb22376cd1995ba5664a92690ee01b44930809619422fffe2f200e7c.exe 92ca5e43bb22376cd1995ba5664a92690ee01b44930809619422fffe2f200e7c.exe PID 1408 wrote to memory of 1144 1408 92ca5e43bb22376cd1995ba5664a92690ee01b44930809619422fffe2f200e7c.exe 92ca5e43bb22376cd1995ba5664a92690ee01b44930809619422fffe2f200e7c.exe PID 1408 wrote to memory of 1144 1408 92ca5e43bb22376cd1995ba5664a92690ee01b44930809619422fffe2f200e7c.exe 92ca5e43bb22376cd1995ba5664a92690ee01b44930809619422fffe2f200e7c.exe PID 1408 wrote to memory of 1144 1408 92ca5e43bb22376cd1995ba5664a92690ee01b44930809619422fffe2f200e7c.exe 92ca5e43bb22376cd1995ba5664a92690ee01b44930809619422fffe2f200e7c.exe PID 1144 wrote to memory of 1400 1144 92ca5e43bb22376cd1995ba5664a92690ee01b44930809619422fffe2f200e7c.exe IMDCSC.exe PID 1144 wrote to memory of 1400 1144 92ca5e43bb22376cd1995ba5664a92690ee01b44930809619422fffe2f200e7c.exe IMDCSC.exe PID 1144 wrote to memory of 1400 1144 92ca5e43bb22376cd1995ba5664a92690ee01b44930809619422fffe2f200e7c.exe IMDCSC.exe PID 1400 wrote to memory of 4704 1400 IMDCSC.exe IMDCSC.exe PID 1400 wrote to memory of 4704 1400 IMDCSC.exe IMDCSC.exe PID 1400 wrote to memory of 4704 1400 IMDCSC.exe IMDCSC.exe PID 1400 wrote to memory of 4704 1400 IMDCSC.exe IMDCSC.exe PID 1400 wrote to memory of 4704 1400 IMDCSC.exe IMDCSC.exe PID 1400 wrote to memory of 4704 1400 IMDCSC.exe IMDCSC.exe PID 1400 wrote to memory of 4704 1400 IMDCSC.exe IMDCSC.exe PID 1400 wrote to memory of 4704 1400 IMDCSC.exe IMDCSC.exe PID 1400 wrote to memory of 4704 1400 IMDCSC.exe IMDCSC.exe PID 1400 wrote to memory of 4704 1400 IMDCSC.exe IMDCSC.exe PID 1400 wrote to memory of 4704 1400 IMDCSC.exe IMDCSC.exe PID 1400 wrote to memory of 4704 1400 IMDCSC.exe IMDCSC.exe PID 1400 wrote to memory of 4704 1400 IMDCSC.exe IMDCSC.exe PID 1400 wrote to memory of 4704 1400 IMDCSC.exe IMDCSC.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\92ca5e43bb22376cd1995ba5664a92690ee01b44930809619422fffe2f200e7c.exe"C:\Users\Admin\AppData\Local\Temp\92ca5e43bb22376cd1995ba5664a92690ee01b44930809619422fffe2f200e7c.exe"1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\92ca5e43bb22376cd1995ba5664a92690ee01b44930809619422fffe2f200e7c.exeC:\Users\Admin\AppData\Local\Temp\92ca5e43bb22376cd1995ba5664a92690ee01b44930809619422fffe2f200e7c.exe2⤵
- Modifies WinLogon for persistence
- Checks computer location settings
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\Documents\DCSCMIN\IMDCSC.exe"C:\Users\Admin\Documents\DCSCMIN\IMDCSC.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\Documents\DCSCMIN\IMDCSC.exeC:\Users\Admin\Documents\DCSCMIN\IMDCSC.exe4⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\Documents\DCSCMIN\IMDCSC.exeFilesize
1009KB
MD5e0fecd1853ec03f20e8d2cc28b7012da
SHA193a0a322615876ed4c625e0410ca1fdc08e8ad8b
SHA25692ca5e43bb22376cd1995ba5664a92690ee01b44930809619422fffe2f200e7c
SHA512efc56b9c045eef8df9072c99d28b7797b17e64fc337152ca7816975f608717f9b0df0c652e138f5fc071b7838e91f4460eed0ea99c668881b37e3863657191e9
-
C:\Users\Admin\Documents\DCSCMIN\IMDCSC.exeFilesize
1009KB
MD5e0fecd1853ec03f20e8d2cc28b7012da
SHA193a0a322615876ed4c625e0410ca1fdc08e8ad8b
SHA25692ca5e43bb22376cd1995ba5664a92690ee01b44930809619422fffe2f200e7c
SHA512efc56b9c045eef8df9072c99d28b7797b17e64fc337152ca7816975f608717f9b0df0c652e138f5fc071b7838e91f4460eed0ea99c668881b37e3863657191e9
-
C:\Users\Admin\Documents\DCSCMIN\IMDCSC.exeFilesize
1009KB
MD5e0fecd1853ec03f20e8d2cc28b7012da
SHA193a0a322615876ed4c625e0410ca1fdc08e8ad8b
SHA25692ca5e43bb22376cd1995ba5664a92690ee01b44930809619422fffe2f200e7c
SHA512efc56b9c045eef8df9072c99d28b7797b17e64fc337152ca7816975f608717f9b0df0c652e138f5fc071b7838e91f4460eed0ea99c668881b37e3863657191e9
-
memory/1144-140-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/1144-136-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/1144-135-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/1144-134-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/1144-133-0x0000000000000000-mapping.dmp
-
memory/1400-137-0x0000000000000000-mapping.dmp
-
memory/1400-141-0x00000000749C0000-0x0000000074F71000-memory.dmpFilesize
5.7MB
-
memory/1400-149-0x00000000749C0000-0x0000000074F71000-memory.dmpFilesize
5.7MB
-
memory/1408-132-0x00000000749C0000-0x0000000074F71000-memory.dmpFilesize
5.7MB
-
memory/1408-148-0x00000000749C0000-0x0000000074F71000-memory.dmpFilesize
5.7MB
-
memory/4704-142-0x0000000000000000-mapping.dmp
-
memory/4704-147-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/4704-150-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB