Analysis
-
max time kernel
40s -
max time network
47s -
platform
windows7_x64 -
resource
win7-20220901-en -
resource tags
arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system -
submitted
29-11-2022 22:05
Static task
static1
Behavioral task
behavioral1
Sample
dafd90ea443252b18583fd96f2da4c277e258ff5afa495b512c14070f0fe0f67.exe
Resource
win7-20220901-en
General
-
Target
dafd90ea443252b18583fd96f2da4c277e258ff5afa495b512c14070f0fe0f67.exe
-
Size
963KB
-
MD5
a10d8267ed0b2eeb663c3caef247ba3c
-
SHA1
a9931587dab4f70a091bc7c0e59097bfc10229fd
-
SHA256
dafd90ea443252b18583fd96f2da4c277e258ff5afa495b512c14070f0fe0f67
-
SHA512
89d2f1a1a5aa26b9bb3b03558c39d22d955c7a845b7ffa750f4635b586c46a6c4c5d4676afb2f4f6ecd0005da9ccc2fbf5d74096f0f2821fb21864b833beece9
-
SSDEEP
12288:EJIN4VW2o/LW0NHX68XU9sUX9T8+3M2UBvSwo9nKeK3wz:ESV/S0NPK1CWMTxkKeKA
Malware Config
Extracted
darkcomet
Love
pet105.no-ip.biz:100
DC_MUTEX-TNT8SFG
-
InstallPath
MSDCSC\msdcsc.exe
-
gencode
JJbwi9MArQ9S
-
install
true
-
offline_keylogger
true
-
persistence
true
-
reg_key
MicroUpdate
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
Processes:
svchost.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Users\\Admin\\Documents\\MSDCSC\\msdcsc.exe" svchost.exe -
Executes dropped EXE 2 IoCs
Processes:
svchost.exemsdcsc.exepid process 276 svchost.exe 1200 msdcsc.exe -
Sets file to hidden 1 TTPs 2 IoCs
Modifies file attributes to stop it showing in Explorer etc.
Processes:
attrib.exeattrib.exepid process 1196 attrib.exe 556 attrib.exe -
Loads dropped DLL 2 IoCs
Processes:
dafd90ea443252b18583fd96f2da4c277e258ff5afa495b512c14070f0fe0f67.exesvchost.exepid process 992 dafd90ea443252b18583fd96f2da4c277e258ff5afa495b512c14070f0fe0f67.exe 276 svchost.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
dafd90ea443252b18583fd96f2da4c277e258ff5afa495b512c14070f0fe0f67.exesvchost.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\WinUpdate = "C:\\Users\\Admin\\AppData\\Roaming\\WinUpdate.exe" dafd90ea443252b18583fd96f2da4c277e258ff5afa495b512c14070f0fe0f67.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Users\\Admin\\Documents\\MSDCSC\\msdcsc.exe" svchost.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
dafd90ea443252b18583fd96f2da4c277e258ff5afa495b512c14070f0fe0f67.exedescription pid process target process PID 992 set thread context of 276 992 dafd90ea443252b18583fd96f2da4c277e258ff5afa495b512c14070f0fe0f67.exe svchost.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of AdjustPrivilegeToken 23 IoCs
Processes:
svchost.exedescription pid process Token: SeIncreaseQuotaPrivilege 276 svchost.exe Token: SeSecurityPrivilege 276 svchost.exe Token: SeTakeOwnershipPrivilege 276 svchost.exe Token: SeLoadDriverPrivilege 276 svchost.exe Token: SeSystemProfilePrivilege 276 svchost.exe Token: SeSystemtimePrivilege 276 svchost.exe Token: SeProfSingleProcessPrivilege 276 svchost.exe Token: SeIncBasePriorityPrivilege 276 svchost.exe Token: SeCreatePagefilePrivilege 276 svchost.exe Token: SeBackupPrivilege 276 svchost.exe Token: SeRestorePrivilege 276 svchost.exe Token: SeShutdownPrivilege 276 svchost.exe Token: SeDebugPrivilege 276 svchost.exe Token: SeSystemEnvironmentPrivilege 276 svchost.exe Token: SeChangeNotifyPrivilege 276 svchost.exe Token: SeRemoteShutdownPrivilege 276 svchost.exe Token: SeUndockPrivilege 276 svchost.exe Token: SeManageVolumePrivilege 276 svchost.exe Token: SeImpersonatePrivilege 276 svchost.exe Token: SeCreateGlobalPrivilege 276 svchost.exe Token: 33 276 svchost.exe Token: 34 276 svchost.exe Token: 35 276 svchost.exe -
Suspicious use of WriteProcessMemory 33 IoCs
Processes:
dafd90ea443252b18583fd96f2da4c277e258ff5afa495b512c14070f0fe0f67.exesvchost.execmd.execmd.exedescription pid process target process PID 992 wrote to memory of 276 992 dafd90ea443252b18583fd96f2da4c277e258ff5afa495b512c14070f0fe0f67.exe svchost.exe PID 992 wrote to memory of 276 992 dafd90ea443252b18583fd96f2da4c277e258ff5afa495b512c14070f0fe0f67.exe svchost.exe PID 992 wrote to memory of 276 992 dafd90ea443252b18583fd96f2da4c277e258ff5afa495b512c14070f0fe0f67.exe svchost.exe PID 992 wrote to memory of 276 992 dafd90ea443252b18583fd96f2da4c277e258ff5afa495b512c14070f0fe0f67.exe svchost.exe PID 992 wrote to memory of 276 992 dafd90ea443252b18583fd96f2da4c277e258ff5afa495b512c14070f0fe0f67.exe svchost.exe PID 992 wrote to memory of 276 992 dafd90ea443252b18583fd96f2da4c277e258ff5afa495b512c14070f0fe0f67.exe svchost.exe PID 992 wrote to memory of 276 992 dafd90ea443252b18583fd96f2da4c277e258ff5afa495b512c14070f0fe0f67.exe svchost.exe PID 992 wrote to memory of 276 992 dafd90ea443252b18583fd96f2da4c277e258ff5afa495b512c14070f0fe0f67.exe svchost.exe PID 992 wrote to memory of 276 992 dafd90ea443252b18583fd96f2da4c277e258ff5afa495b512c14070f0fe0f67.exe svchost.exe PID 992 wrote to memory of 276 992 dafd90ea443252b18583fd96f2da4c277e258ff5afa495b512c14070f0fe0f67.exe svchost.exe PID 992 wrote to memory of 276 992 dafd90ea443252b18583fd96f2da4c277e258ff5afa495b512c14070f0fe0f67.exe svchost.exe PID 992 wrote to memory of 276 992 dafd90ea443252b18583fd96f2da4c277e258ff5afa495b512c14070f0fe0f67.exe svchost.exe PID 992 wrote to memory of 276 992 dafd90ea443252b18583fd96f2da4c277e258ff5afa495b512c14070f0fe0f67.exe svchost.exe PID 276 wrote to memory of 1444 276 svchost.exe cmd.exe PID 276 wrote to memory of 1444 276 svchost.exe cmd.exe PID 276 wrote to memory of 1444 276 svchost.exe cmd.exe PID 276 wrote to memory of 1444 276 svchost.exe cmd.exe PID 276 wrote to memory of 1052 276 svchost.exe cmd.exe PID 276 wrote to memory of 1052 276 svchost.exe cmd.exe PID 276 wrote to memory of 1052 276 svchost.exe cmd.exe PID 276 wrote to memory of 1052 276 svchost.exe cmd.exe PID 1052 wrote to memory of 556 1052 cmd.exe attrib.exe PID 1052 wrote to memory of 556 1052 cmd.exe attrib.exe PID 1052 wrote to memory of 556 1052 cmd.exe attrib.exe PID 1052 wrote to memory of 556 1052 cmd.exe attrib.exe PID 1444 wrote to memory of 1196 1444 cmd.exe attrib.exe PID 1444 wrote to memory of 1196 1444 cmd.exe attrib.exe PID 1444 wrote to memory of 1196 1444 cmd.exe attrib.exe PID 1444 wrote to memory of 1196 1444 cmd.exe attrib.exe PID 276 wrote to memory of 1200 276 svchost.exe msdcsc.exe PID 276 wrote to memory of 1200 276 svchost.exe msdcsc.exe PID 276 wrote to memory of 1200 276 svchost.exe msdcsc.exe PID 276 wrote to memory of 1200 276 svchost.exe msdcsc.exe -
Views/modifies file attributes 1 TTPs 2 IoCs
Processes:
attrib.exeattrib.exepid process 1196 attrib.exe 556 attrib.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\dafd90ea443252b18583fd96f2da4c277e258ff5afa495b512c14070f0fe0f67.exe"C:\Users\Admin\AppData\Local\Temp\dafd90ea443252b18583fd96f2da4c277e258ff5afa495b512c14070f0fe0f67.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:992 -
C:\Users\Admin\AppData\Local\Temp\plugtemp\svchost.exeC:\Users\Admin\AppData\Local\Temp\\plugtemp\svchost.exe2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:276 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp\plugtemp\svchost.exe" +s +h3⤵
- Suspicious use of WriteProcessMemory
PID:1444 -
C:\Windows\SysWOW64\attrib.exeattrib "C:\Users\Admin\AppData\Local\Temp\plugtemp\svchost.exe" +s +h4⤵
- Sets file to hidden
- Views/modifies file attributes
PID:1196 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp\plugtemp" +s +h3⤵
- Suspicious use of WriteProcessMemory
PID:1052 -
C:\Windows\SysWOW64\attrib.exeattrib "C:\Users\Admin\AppData\Local\Temp\plugtemp" +s +h4⤵
- Sets file to hidden
- Views/modifies file attributes
PID:556 -
C:\Users\Admin\Documents\MSDCSC\msdcsc.exe"C:\Users\Admin\Documents\MSDCSC\msdcsc.exe"3⤵
- Executes dropped EXE
PID:1200
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\plugtemp\svchost.exeFilesize
1.1MB
MD534aa912defa18c2c129f1e09d75c1d7e
SHA19c3046324657505a30ecd9b1fdb46c05bde7d470
SHA2566df94b7fa33f1b87142adc39b3db0613fc520d9e7a5fd6a5301dd7f51f8d0386
SHA512d1ea9368f5d7166180612fd763c87afb647d088498887961f5e7fb0a10f4a808bd5928e8a3666d70ff794093c51ecca8816f75dd47652fd4eb23dce7f9aa1f98
-
C:\Users\Admin\AppData\Local\Temp\plugtemp\svchost.exeFilesize
1.1MB
MD534aa912defa18c2c129f1e09d75c1d7e
SHA19c3046324657505a30ecd9b1fdb46c05bde7d470
SHA2566df94b7fa33f1b87142adc39b3db0613fc520d9e7a5fd6a5301dd7f51f8d0386
SHA512d1ea9368f5d7166180612fd763c87afb647d088498887961f5e7fb0a10f4a808bd5928e8a3666d70ff794093c51ecca8816f75dd47652fd4eb23dce7f9aa1f98
-
C:\Users\Admin\Documents\MSDCSC\msdcsc.exeFilesize
1.1MB
MD534aa912defa18c2c129f1e09d75c1d7e
SHA19c3046324657505a30ecd9b1fdb46c05bde7d470
SHA2566df94b7fa33f1b87142adc39b3db0613fc520d9e7a5fd6a5301dd7f51f8d0386
SHA512d1ea9368f5d7166180612fd763c87afb647d088498887961f5e7fb0a10f4a808bd5928e8a3666d70ff794093c51ecca8816f75dd47652fd4eb23dce7f9aa1f98
-
C:\Users\Admin\Documents\MSDCSC\msdcsc.exeFilesize
1.1MB
MD534aa912defa18c2c129f1e09d75c1d7e
SHA19c3046324657505a30ecd9b1fdb46c05bde7d470
SHA2566df94b7fa33f1b87142adc39b3db0613fc520d9e7a5fd6a5301dd7f51f8d0386
SHA512d1ea9368f5d7166180612fd763c87afb647d088498887961f5e7fb0a10f4a808bd5928e8a3666d70ff794093c51ecca8816f75dd47652fd4eb23dce7f9aa1f98
-
\Users\Admin\AppData\Local\Temp\plugtemp\svchost.exeFilesize
1.1MB
MD534aa912defa18c2c129f1e09d75c1d7e
SHA19c3046324657505a30ecd9b1fdb46c05bde7d470
SHA2566df94b7fa33f1b87142adc39b3db0613fc520d9e7a5fd6a5301dd7f51f8d0386
SHA512d1ea9368f5d7166180612fd763c87afb647d088498887961f5e7fb0a10f4a808bd5928e8a3666d70ff794093c51ecca8816f75dd47652fd4eb23dce7f9aa1f98
-
\Users\Admin\Documents\MSDCSC\msdcsc.exeFilesize
1.1MB
MD534aa912defa18c2c129f1e09d75c1d7e
SHA19c3046324657505a30ecd9b1fdb46c05bde7d470
SHA2566df94b7fa33f1b87142adc39b3db0613fc520d9e7a5fd6a5301dd7f51f8d0386
SHA512d1ea9368f5d7166180612fd763c87afb647d088498887961f5e7fb0a10f4a808bd5928e8a3666d70ff794093c51ecca8816f75dd47652fd4eb23dce7f9aa1f98
-
memory/276-64-0x0000000000400000-0x00000000004BA000-memory.dmpFilesize
744KB
-
memory/276-78-0x0000000000400000-0x00000000004BA000-memory.dmpFilesize
744KB
-
memory/276-67-0x0000000000400000-0x00000000004BA000-memory.dmpFilesize
744KB
-
memory/276-66-0x0000000000400000-0x00000000004BA000-memory.dmpFilesize
744KB
-
memory/276-69-0x0000000000400000-0x00000000004BA000-memory.dmpFilesize
744KB
-
memory/276-71-0x0000000000400000-0x00000000004BA000-memory.dmpFilesize
744KB
-
memory/276-72-0x000000000048F888-mapping.dmp
-
memory/276-62-0x0000000000400000-0x00000000004BA000-memory.dmpFilesize
744KB
-
memory/276-74-0x0000000000400000-0x00000000004BA000-memory.dmpFilesize
744KB
-
memory/276-76-0x0000000000400000-0x00000000004BA000-memory.dmpFilesize
744KB
-
memory/276-60-0x0000000000400000-0x00000000004BA000-memory.dmpFilesize
744KB
-
memory/276-87-0x0000000000400000-0x00000000004BA000-memory.dmpFilesize
744KB
-
memory/276-57-0x0000000000400000-0x00000000004BA000-memory.dmpFilesize
744KB
-
memory/276-58-0x0000000000400000-0x00000000004BA000-memory.dmpFilesize
744KB
-
memory/556-81-0x0000000000000000-mapping.dmp
-
memory/992-55-0x0000000074AA0000-0x000000007504B000-memory.dmpFilesize
5.7MB
-
memory/992-54-0x0000000076561000-0x0000000076563000-memory.dmpFilesize
8KB
-
memory/992-88-0x0000000074AA0000-0x000000007504B000-memory.dmpFilesize
5.7MB
-
memory/1052-80-0x0000000000000000-mapping.dmp
-
memory/1196-82-0x0000000000000000-mapping.dmp
-
memory/1200-84-0x0000000000000000-mapping.dmp
-
memory/1444-79-0x0000000000000000-mapping.dmp