Analysis
-
max time kernel
42s -
max time network
45s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
28-11-2022 18:54
Static task
static1
Behavioral task
behavioral1
Sample
0797ecf215ad293bb9cec8cc8d7c48721866a224585490bf3993910366b134b7.exe
Resource
win7-20220812-en
General
-
Target
0797ecf215ad293bb9cec8cc8d7c48721866a224585490bf3993910366b134b7.exe
-
Size
736KB
-
MD5
aa790ff4f430ab3af619c31d4d0d9c92
-
SHA1
8fe417542db5fe0671fb164bbdc9973e6c48f73a
-
SHA256
0797ecf215ad293bb9cec8cc8d7c48721866a224585490bf3993910366b134b7
-
SHA512
abfa2156fbeba332ca669cc54c7c75f58fcdc57546ef6f4244217ab2471b106a32d35c9348ca3a22294c2fbcb0ea1f3416b32617aa84bd29372fbf0a0f6e0031
-
SSDEEP
12288:a5gTvBHv8dtRtpkxG/2VDFQa5xfUGXp/s0RpirOIAp555:aQBHv8dtR/kCcQcxfUG5U2pirB
Malware Config
Extracted
darkcomet
v1
easytoremember.no-ip.biz:9003
DC_MUTEX-RHEVRRJ
-
InstallPath
GoogleUpdate\updater.exe
-
gencode
3bnD3E1CbrMc
-
install
true
-
offline_keylogger
true
-
persistence
true
-
reg_key
googleupdate
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
Processes:
vbc.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Users\\Admin\\AppData\\Local\\Temp\\GoogleUpdate\\updater.exe" vbc.exe -
Executes dropped EXE 1 IoCs
Processes:
updater.exepid process 1868 updater.exe -
Sets file to hidden 1 TTPs 1 IoCs
Modifies file attributes to stop it showing in Explorer etc.
-
Loads dropped DLL 1 IoCs
Processes:
vbc.exepid process 1520 vbc.exe -
Uses the VBS compiler for execution 1 TTPs
-
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
0797ecf215ad293bb9cec8cc8d7c48721866a224585490bf3993910366b134b7.exevbc.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\CSGO Hack = "C:\\Users\\Admin\\AppData\\Local\\Temp\\0797ecf215ad293bb9cec8cc8d7c48721866a224585490bf3993910366b134b7.exe" 0797ecf215ad293bb9cec8cc8d7c48721866a224585490bf3993910366b134b7.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\googleupdate = "C:\\Users\\Admin\\AppData\\Local\\Temp\\GoogleUpdate\\updater.exe" vbc.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
0797ecf215ad293bb9cec8cc8d7c48721866a224585490bf3993910366b134b7.exedescription pid process target process PID 1956 set thread context of 1520 1956 0797ecf215ad293bb9cec8cc8d7c48721866a224585490bf3993910366b134b7.exe vbc.exe -
Drops file in Windows directory 1 IoCs
Processes:
attrib.exedescription ioc process File opened for modification C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe attrib.exe -
Suspicious use of AdjustPrivilegeToken 23 IoCs
Processes:
vbc.exedescription pid process Token: SeIncreaseQuotaPrivilege 1520 vbc.exe Token: SeSecurityPrivilege 1520 vbc.exe Token: SeTakeOwnershipPrivilege 1520 vbc.exe Token: SeLoadDriverPrivilege 1520 vbc.exe Token: SeSystemProfilePrivilege 1520 vbc.exe Token: SeSystemtimePrivilege 1520 vbc.exe Token: SeProfSingleProcessPrivilege 1520 vbc.exe Token: SeIncBasePriorityPrivilege 1520 vbc.exe Token: SeCreatePagefilePrivilege 1520 vbc.exe Token: SeBackupPrivilege 1520 vbc.exe Token: SeRestorePrivilege 1520 vbc.exe Token: SeShutdownPrivilege 1520 vbc.exe Token: SeDebugPrivilege 1520 vbc.exe Token: SeSystemEnvironmentPrivilege 1520 vbc.exe Token: SeChangeNotifyPrivilege 1520 vbc.exe Token: SeRemoteShutdownPrivilege 1520 vbc.exe Token: SeUndockPrivilege 1520 vbc.exe Token: SeManageVolumePrivilege 1520 vbc.exe Token: SeImpersonatePrivilege 1520 vbc.exe Token: SeCreateGlobalPrivilege 1520 vbc.exe Token: 33 1520 vbc.exe Token: 34 1520 vbc.exe Token: 35 1520 vbc.exe -
Suspicious use of WriteProcessMemory 30 IoCs
Processes:
0797ecf215ad293bb9cec8cc8d7c48721866a224585490bf3993910366b134b7.exevbc.execmd.exedescription pid process target process PID 1956 wrote to memory of 1520 1956 0797ecf215ad293bb9cec8cc8d7c48721866a224585490bf3993910366b134b7.exe vbc.exe PID 1956 wrote to memory of 1520 1956 0797ecf215ad293bb9cec8cc8d7c48721866a224585490bf3993910366b134b7.exe vbc.exe PID 1956 wrote to memory of 1520 1956 0797ecf215ad293bb9cec8cc8d7c48721866a224585490bf3993910366b134b7.exe vbc.exe PID 1956 wrote to memory of 1520 1956 0797ecf215ad293bb9cec8cc8d7c48721866a224585490bf3993910366b134b7.exe vbc.exe PID 1956 wrote to memory of 1520 1956 0797ecf215ad293bb9cec8cc8d7c48721866a224585490bf3993910366b134b7.exe vbc.exe PID 1956 wrote to memory of 1520 1956 0797ecf215ad293bb9cec8cc8d7c48721866a224585490bf3993910366b134b7.exe vbc.exe PID 1956 wrote to memory of 1520 1956 0797ecf215ad293bb9cec8cc8d7c48721866a224585490bf3993910366b134b7.exe vbc.exe PID 1956 wrote to memory of 1520 1956 0797ecf215ad293bb9cec8cc8d7c48721866a224585490bf3993910366b134b7.exe vbc.exe PID 1956 wrote to memory of 1520 1956 0797ecf215ad293bb9cec8cc8d7c48721866a224585490bf3993910366b134b7.exe vbc.exe PID 1956 wrote to memory of 1520 1956 0797ecf215ad293bb9cec8cc8d7c48721866a224585490bf3993910366b134b7.exe vbc.exe PID 1956 wrote to memory of 1520 1956 0797ecf215ad293bb9cec8cc8d7c48721866a224585490bf3993910366b134b7.exe vbc.exe PID 1956 wrote to memory of 1520 1956 0797ecf215ad293bb9cec8cc8d7c48721866a224585490bf3993910366b134b7.exe vbc.exe PID 1956 wrote to memory of 1520 1956 0797ecf215ad293bb9cec8cc8d7c48721866a224585490bf3993910366b134b7.exe vbc.exe PID 1956 wrote to memory of 1520 1956 0797ecf215ad293bb9cec8cc8d7c48721866a224585490bf3993910366b134b7.exe vbc.exe PID 1956 wrote to memory of 1520 1956 0797ecf215ad293bb9cec8cc8d7c48721866a224585490bf3993910366b134b7.exe vbc.exe PID 1520 wrote to memory of 816 1520 vbc.exe cmd.exe PID 1520 wrote to memory of 816 1520 vbc.exe cmd.exe PID 1520 wrote to memory of 816 1520 vbc.exe cmd.exe PID 1520 wrote to memory of 816 1520 vbc.exe cmd.exe PID 816 wrote to memory of 2024 816 cmd.exe attrib.exe PID 816 wrote to memory of 2024 816 cmd.exe attrib.exe PID 816 wrote to memory of 2024 816 cmd.exe attrib.exe PID 816 wrote to memory of 2024 816 cmd.exe attrib.exe PID 1520 wrote to memory of 1868 1520 vbc.exe updater.exe PID 1520 wrote to memory of 1868 1520 vbc.exe updater.exe PID 1520 wrote to memory of 1868 1520 vbc.exe updater.exe PID 1520 wrote to memory of 1868 1520 vbc.exe updater.exe PID 1520 wrote to memory of 1868 1520 vbc.exe updater.exe PID 1520 wrote to memory of 1868 1520 vbc.exe updater.exe PID 1520 wrote to memory of 1868 1520 vbc.exe updater.exe -
Views/modifies file attributes 1 TTPs 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\0797ecf215ad293bb9cec8cc8d7c48721866a224585490bf3993910366b134b7.exe"C:\Users\Admin\AppData\Local\Temp\0797ecf215ad293bb9cec8cc8d7c48721866a224585490bf3993910366b134b7.exe"1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeC:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe2⤵
- Modifies WinLogon for persistence
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" +s +h3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" +s +h4⤵
- Sets file to hidden
- Drops file in Windows directory
- Views/modifies file attributes
-
C:\Users\Admin\AppData\Local\Temp\GoogleUpdate\updater.exe"C:\Users\Admin\AppData\Local\Temp\GoogleUpdate\updater.exe"3⤵
- Executes dropped EXE
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\GoogleUpdate\updater.exeFilesize
1.1MB
MD534aa912defa18c2c129f1e09d75c1d7e
SHA19c3046324657505a30ecd9b1fdb46c05bde7d470
SHA2566df94b7fa33f1b87142adc39b3db0613fc520d9e7a5fd6a5301dd7f51f8d0386
SHA512d1ea9368f5d7166180612fd763c87afb647d088498887961f5e7fb0a10f4a808bd5928e8a3666d70ff794093c51ecca8816f75dd47652fd4eb23dce7f9aa1f98
-
C:\Users\Admin\AppData\Local\Temp\GoogleUpdate\updater.exeFilesize
1.1MB
MD534aa912defa18c2c129f1e09d75c1d7e
SHA19c3046324657505a30ecd9b1fdb46c05bde7d470
SHA2566df94b7fa33f1b87142adc39b3db0613fc520d9e7a5fd6a5301dd7f51f8d0386
SHA512d1ea9368f5d7166180612fd763c87afb647d088498887961f5e7fb0a10f4a808bd5928e8a3666d70ff794093c51ecca8816f75dd47652fd4eb23dce7f9aa1f98
-
\Users\Admin\AppData\Local\Temp\GoogleUpdate\updater.exeFilesize
1.1MB
MD534aa912defa18c2c129f1e09d75c1d7e
SHA19c3046324657505a30ecd9b1fdb46c05bde7d470
SHA2566df94b7fa33f1b87142adc39b3db0613fc520d9e7a5fd6a5301dd7f51f8d0386
SHA512d1ea9368f5d7166180612fd763c87afb647d088498887961f5e7fb0a10f4a808bd5928e8a3666d70ff794093c51ecca8816f75dd47652fd4eb23dce7f9aa1f98
-
memory/816-63-0x0000000000000000-mapping.dmp
-
memory/1520-61-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/1520-58-0x000000000048F888-mapping.dmp
-
memory/1520-59-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/1520-57-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/1520-69-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/1868-66-0x0000000000000000-mapping.dmp
-
memory/1956-54-0x0000000075141000-0x0000000075143000-memory.dmpFilesize
8KB
-
memory/1956-62-0x00000000742C0000-0x000000007486B000-memory.dmpFilesize
5.7MB
-
memory/1956-56-0x00000000742C0000-0x000000007486B000-memory.dmpFilesize
5.7MB
-
memory/1956-55-0x00000000742C0000-0x000000007486B000-memory.dmpFilesize
5.7MB
-
memory/2024-64-0x0000000000000000-mapping.dmp