Analysis
-
max time kernel
187s -
max time network
187s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
29-11-2022 22:05
Static task
static1
Behavioral task
behavioral1
Sample
c1e539ef1d5ae993fa4c9058f4e2e6caf14e61226b349b191cdfa37e65b710a5.exe
Resource
win7-20221111-en
General
-
Target
c1e539ef1d5ae993fa4c9058f4e2e6caf14e61226b349b191cdfa37e65b710a5.exe
-
Size
1.1MB
-
MD5
87f31938ba32ffe17ff1bbe96e076421
-
SHA1
97487d29f1cf63559d87d31fc03c20b2b4e4a911
-
SHA256
c1e539ef1d5ae993fa4c9058f4e2e6caf14e61226b349b191cdfa37e65b710a5
-
SHA512
8b23fd6549f998142f7a64e260736ae6293b84451ad73a80da3597ec482feccf27bebe2be32f2c89b711244a9f370d640114cae7d3d2104153205703006fffcf
-
SSDEEP
12288:pJIE4VW2o/LW0NHX68XU9sUX9T8+3M2UBvSwo9nKeK3wzuM/5Tdi77X9Z4YuL4:pSy/S0NPK1CWMTxkKeKAbdEX9Z4YuL4
Malware Config
Extracted
darkcomet
Love
pet105.no-ip.biz:100
DC_MUTEX-TNT8SFG
-
InstallPath
MSDCSC\msdcsc.exe
-
gencode
JJbwi9MArQ9S
-
install
true
-
offline_keylogger
true
-
persistence
true
-
reg_key
MicroUpdate
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
Processes:
vbc.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Users\\Admin\\Documents\\MSDCSC\\msdcsc.exe" vbc.exe -
Executes dropped EXE 2 IoCs
Processes:
vbc.exemsdcsc.exepid process 4632 vbc.exe 3836 msdcsc.exe -
Sets file to hidden 1 TTPs 2 IoCs
Modifies file attributes to stop it showing in Explorer etc.
Processes:
attrib.exeattrib.exepid process 3136 attrib.exe 2668 attrib.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
vbc.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Control Panel\International\Geo\Nation vbc.exe -
Uses the VBS compiler for execution 1 TTPs
-
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
vbc.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Users\\Admin\\Documents\\MSDCSC\\msdcsc.exe" vbc.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
c1e539ef1d5ae993fa4c9058f4e2e6caf14e61226b349b191cdfa37e65b710a5.exedescription pid process target process PID 4320 set thread context of 4632 4320 c1e539ef1d5ae993fa4c9058f4e2e6caf14e61226b349b191cdfa37e65b710a5.exe vbc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of AdjustPrivilegeToken 24 IoCs
Processes:
vbc.exedescription pid process Token: SeIncreaseQuotaPrivilege 4632 vbc.exe Token: SeSecurityPrivilege 4632 vbc.exe Token: SeTakeOwnershipPrivilege 4632 vbc.exe Token: SeLoadDriverPrivilege 4632 vbc.exe Token: SeSystemProfilePrivilege 4632 vbc.exe Token: SeSystemtimePrivilege 4632 vbc.exe Token: SeProfSingleProcessPrivilege 4632 vbc.exe Token: SeIncBasePriorityPrivilege 4632 vbc.exe Token: SeCreatePagefilePrivilege 4632 vbc.exe Token: SeBackupPrivilege 4632 vbc.exe Token: SeRestorePrivilege 4632 vbc.exe Token: SeShutdownPrivilege 4632 vbc.exe Token: SeDebugPrivilege 4632 vbc.exe Token: SeSystemEnvironmentPrivilege 4632 vbc.exe Token: SeChangeNotifyPrivilege 4632 vbc.exe Token: SeRemoteShutdownPrivilege 4632 vbc.exe Token: SeUndockPrivilege 4632 vbc.exe Token: SeManageVolumePrivilege 4632 vbc.exe Token: SeImpersonatePrivilege 4632 vbc.exe Token: SeCreateGlobalPrivilege 4632 vbc.exe Token: 33 4632 vbc.exe Token: 34 4632 vbc.exe Token: 35 4632 vbc.exe Token: 36 4632 vbc.exe -
Suspicious use of WriteProcessMemory 29 IoCs
Processes:
c1e539ef1d5ae993fa4c9058f4e2e6caf14e61226b349b191cdfa37e65b710a5.exevbc.execmd.execmd.exedescription pid process target process PID 4320 wrote to memory of 4632 4320 c1e539ef1d5ae993fa4c9058f4e2e6caf14e61226b349b191cdfa37e65b710a5.exe vbc.exe PID 4320 wrote to memory of 4632 4320 c1e539ef1d5ae993fa4c9058f4e2e6caf14e61226b349b191cdfa37e65b710a5.exe vbc.exe PID 4320 wrote to memory of 4632 4320 c1e539ef1d5ae993fa4c9058f4e2e6caf14e61226b349b191cdfa37e65b710a5.exe vbc.exe PID 4320 wrote to memory of 4632 4320 c1e539ef1d5ae993fa4c9058f4e2e6caf14e61226b349b191cdfa37e65b710a5.exe vbc.exe PID 4320 wrote to memory of 4632 4320 c1e539ef1d5ae993fa4c9058f4e2e6caf14e61226b349b191cdfa37e65b710a5.exe vbc.exe PID 4320 wrote to memory of 4632 4320 c1e539ef1d5ae993fa4c9058f4e2e6caf14e61226b349b191cdfa37e65b710a5.exe vbc.exe PID 4320 wrote to memory of 4632 4320 c1e539ef1d5ae993fa4c9058f4e2e6caf14e61226b349b191cdfa37e65b710a5.exe vbc.exe PID 4320 wrote to memory of 4632 4320 c1e539ef1d5ae993fa4c9058f4e2e6caf14e61226b349b191cdfa37e65b710a5.exe vbc.exe PID 4320 wrote to memory of 4632 4320 c1e539ef1d5ae993fa4c9058f4e2e6caf14e61226b349b191cdfa37e65b710a5.exe vbc.exe PID 4320 wrote to memory of 4632 4320 c1e539ef1d5ae993fa4c9058f4e2e6caf14e61226b349b191cdfa37e65b710a5.exe vbc.exe PID 4320 wrote to memory of 4632 4320 c1e539ef1d5ae993fa4c9058f4e2e6caf14e61226b349b191cdfa37e65b710a5.exe vbc.exe PID 4320 wrote to memory of 4632 4320 c1e539ef1d5ae993fa4c9058f4e2e6caf14e61226b349b191cdfa37e65b710a5.exe vbc.exe PID 4320 wrote to memory of 4632 4320 c1e539ef1d5ae993fa4c9058f4e2e6caf14e61226b349b191cdfa37e65b710a5.exe vbc.exe PID 4320 wrote to memory of 4632 4320 c1e539ef1d5ae993fa4c9058f4e2e6caf14e61226b349b191cdfa37e65b710a5.exe vbc.exe PID 4632 wrote to memory of 1500 4632 vbc.exe cmd.exe PID 4632 wrote to memory of 1500 4632 vbc.exe cmd.exe PID 4632 wrote to memory of 1500 4632 vbc.exe cmd.exe PID 4632 wrote to memory of 1724 4632 vbc.exe cmd.exe PID 4632 wrote to memory of 1724 4632 vbc.exe cmd.exe PID 4632 wrote to memory of 1724 4632 vbc.exe cmd.exe PID 1724 wrote to memory of 2668 1724 cmd.exe attrib.exe PID 1724 wrote to memory of 2668 1724 cmd.exe attrib.exe PID 1724 wrote to memory of 2668 1724 cmd.exe attrib.exe PID 1500 wrote to memory of 3136 1500 cmd.exe attrib.exe PID 1500 wrote to memory of 3136 1500 cmd.exe attrib.exe PID 1500 wrote to memory of 3136 1500 cmd.exe attrib.exe PID 4632 wrote to memory of 3836 4632 vbc.exe msdcsc.exe PID 4632 wrote to memory of 3836 4632 vbc.exe msdcsc.exe PID 4632 wrote to memory of 3836 4632 vbc.exe msdcsc.exe -
Views/modifies file attributes 1 TTPs 2 IoCs
Processes:
attrib.exeattrib.exepid process 3136 attrib.exe 2668 attrib.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\c1e539ef1d5ae993fa4c9058f4e2e6caf14e61226b349b191cdfa37e65b710a5.exe"C:\Users\Admin\AppData\Local\Temp\c1e539ef1d5ae993fa4c9058f4e2e6caf14e61226b349b191cdfa37e65b710a5.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4320 -
C:\Users\Admin\AppData\Local\Temp\plugtemp\vbc.exeC:\Users\Admin\AppData\Local\Temp\\plugtemp\vbc.exe2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Checks computer location settings
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4632 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp\plugtemp\vbc.exe" +s +h3⤵
- Suspicious use of WriteProcessMemory
PID:1500 -
C:\Windows\SysWOW64\attrib.exeattrib "C:\Users\Admin\AppData\Local\Temp\plugtemp\vbc.exe" +s +h4⤵
- Sets file to hidden
- Views/modifies file attributes
PID:3136 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp\plugtemp" +s +h3⤵
- Suspicious use of WriteProcessMemory
PID:1724 -
C:\Windows\SysWOW64\attrib.exeattrib "C:\Users\Admin\AppData\Local\Temp\plugtemp" +s +h4⤵
- Sets file to hidden
- Views/modifies file attributes
PID:2668 -
C:\Users\Admin\Documents\MSDCSC\msdcsc.exe"C:\Users\Admin\Documents\MSDCSC\msdcsc.exe"3⤵
- Executes dropped EXE
PID:3836
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\plugtemp\vbc.exeFilesize
1.1MB
MD5d881de17aa8f2e2c08cbb7b265f928f9
SHA108936aebc87decf0af6e8eada191062b5e65ac2a
SHA256b3a37093609f9a20ad60b85a9fa9de2ba674cba9b5bd687729440c70ba619ca0
SHA5125f23bfb1b8740247b36ed0ab741738c7d4c949736129e767213e321607d1ccd3e3a8428e4ba44bd28a275b5e3f6206285b1a522514b7ef7ea5e698d90a713d34
-
C:\Users\Admin\AppData\Local\Temp\plugtemp\vbc.exeFilesize
1.1MB
MD5d881de17aa8f2e2c08cbb7b265f928f9
SHA108936aebc87decf0af6e8eada191062b5e65ac2a
SHA256b3a37093609f9a20ad60b85a9fa9de2ba674cba9b5bd687729440c70ba619ca0
SHA5125f23bfb1b8740247b36ed0ab741738c7d4c949736129e767213e321607d1ccd3e3a8428e4ba44bd28a275b5e3f6206285b1a522514b7ef7ea5e698d90a713d34
-
C:\Users\Admin\Documents\MSDCSC\msdcsc.exeFilesize
1.1MB
MD5d881de17aa8f2e2c08cbb7b265f928f9
SHA108936aebc87decf0af6e8eada191062b5e65ac2a
SHA256b3a37093609f9a20ad60b85a9fa9de2ba674cba9b5bd687729440c70ba619ca0
SHA5125f23bfb1b8740247b36ed0ab741738c7d4c949736129e767213e321607d1ccd3e3a8428e4ba44bd28a275b5e3f6206285b1a522514b7ef7ea5e698d90a713d34
-
C:\Users\Admin\Documents\MSDCSC\msdcsc.exeFilesize
1.1MB
MD5d881de17aa8f2e2c08cbb7b265f928f9
SHA108936aebc87decf0af6e8eada191062b5e65ac2a
SHA256b3a37093609f9a20ad60b85a9fa9de2ba674cba9b5bd687729440c70ba619ca0
SHA5125f23bfb1b8740247b36ed0ab741738c7d4c949736129e767213e321607d1ccd3e3a8428e4ba44bd28a275b5e3f6206285b1a522514b7ef7ea5e698d90a713d34
-
memory/1500-143-0x0000000000000000-mapping.dmp
-
memory/1724-144-0x0000000000000000-mapping.dmp
-
memory/2668-145-0x0000000000000000-mapping.dmp
-
memory/3136-146-0x0000000000000000-mapping.dmp
-
memory/3836-147-0x0000000000000000-mapping.dmp
-
memory/4320-133-0x0000000075440000-0x00000000759F1000-memory.dmpFilesize
5.7MB
-
memory/4320-132-0x0000000075440000-0x00000000759F1000-memory.dmpFilesize
5.7MB
-
memory/4632-138-0x0000000000400000-0x00000000004BA000-memory.dmpFilesize
744KB
-
memory/4632-142-0x0000000000400000-0x00000000004BA000-memory.dmpFilesize
744KB
-
memory/4632-141-0x0000000000400000-0x00000000004BA000-memory.dmpFilesize
744KB
-
memory/4632-139-0x0000000000400000-0x00000000004BA000-memory.dmpFilesize
744KB
-
memory/4632-135-0x0000000000400000-0x00000000004BA000-memory.dmpFilesize
744KB
-
memory/4632-134-0x0000000000000000-mapping.dmp
-
memory/4632-150-0x0000000000400000-0x00000000004BA000-memory.dmpFilesize
744KB