Analysis
-
max time kernel
42s -
max time network
48s -
platform
windows7_x64 -
resource
win7-20220901-en -
resource tags
arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system -
submitted
29-11-2022 11:39
Static task
static1
Behavioral task
behavioral1
Sample
c2eec1701284699343ae2acb7a659b19f9275ab1742d7f5da526a5ef37f15c2e.exe
Resource
win7-20220901-en
General
-
Target
c2eec1701284699343ae2acb7a659b19f9275ab1742d7f5da526a5ef37f15c2e.exe
-
Size
1.7MB
-
MD5
49d1338dd124baf0102b62040d11fbad
-
SHA1
e06d262b039ddbc61e89787b28224aa2bf64770b
-
SHA256
c2eec1701284699343ae2acb7a659b19f9275ab1742d7f5da526a5ef37f15c2e
-
SHA512
4bd2740e630f013d53c63f13eb34083d4892c73aa78e72d36bd0273ba8134a6eebc8b9949aaa03685f199177053254b4271a2a0be662db1b5dd43259b5e19440
-
SSDEEP
24576:Ooad3G11e7FXE61jqAdc9DH/73df8XoxZlYscJsLn1D4L4oSnJRB:OoaRlXE6GtU4hYse+n1kcr
Malware Config
Extracted
darkcomet
Main
leinuo2rat.no-ip.biz:1604
DC_MUTEX-ZPESHXD
-
InstallPath
MSDCSC\msdcsc.exe
-
gencode
KlPD5oRnmTw4
-
install
true
-
offline_keylogger
true
-
persistence
false
-
reg_key
Updata
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
Processes:
vbc.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\MSDCSC\\msdcsc.exe" vbc.exe -
Executes dropped EXE 1 IoCs
Processes:
msdcsc.exepid process 1324 msdcsc.exe -
Sets file to hidden 1 TTPs 2 IoCs
Modifies file attributes to stop it showing in Explorer etc.
Processes:
attrib.exeattrib.exepid process 872 attrib.exe 1344 attrib.exe -
Loads dropped DLL 1 IoCs
Processes:
vbc.exepid process 268 vbc.exe -
Uses the VBS compiler for execution 1 TTPs
-
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
c2eec1701284699343ae2acb7a659b19f9275ab1742d7f5da526a5ef37f15c2e.exevbc.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindosU = "C:\\Users\\Admin\\AppData\\Local\\Temp\\WindosU.exe" c2eec1701284699343ae2acb7a659b19f9275ab1742d7f5da526a5ef37f15c2e.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\Updata = "C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\MSDCSC\\msdcsc.exe" vbc.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
c2eec1701284699343ae2acb7a659b19f9275ab1742d7f5da526a5ef37f15c2e.exedescription pid process target process PID 1752 set thread context of 268 1752 c2eec1701284699343ae2acb7a659b19f9275ab1742d7f5da526a5ef37f15c2e.exe vbc.exe -
Drops file in Windows directory 2 IoCs
Processes:
attrib.exeattrib.exedescription ioc process File opened for modification C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe attrib.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v2.0.50727 attrib.exe -
Suspicious use of AdjustPrivilegeToken 23 IoCs
Processes:
vbc.exedescription pid process Token: SeIncreaseQuotaPrivilege 268 vbc.exe Token: SeSecurityPrivilege 268 vbc.exe Token: SeTakeOwnershipPrivilege 268 vbc.exe Token: SeLoadDriverPrivilege 268 vbc.exe Token: SeSystemProfilePrivilege 268 vbc.exe Token: SeSystemtimePrivilege 268 vbc.exe Token: SeProfSingleProcessPrivilege 268 vbc.exe Token: SeIncBasePriorityPrivilege 268 vbc.exe Token: SeCreatePagefilePrivilege 268 vbc.exe Token: SeBackupPrivilege 268 vbc.exe Token: SeRestorePrivilege 268 vbc.exe Token: SeShutdownPrivilege 268 vbc.exe Token: SeDebugPrivilege 268 vbc.exe Token: SeSystemEnvironmentPrivilege 268 vbc.exe Token: SeChangeNotifyPrivilege 268 vbc.exe Token: SeRemoteShutdownPrivilege 268 vbc.exe Token: SeUndockPrivilege 268 vbc.exe Token: SeManageVolumePrivilege 268 vbc.exe Token: SeImpersonatePrivilege 268 vbc.exe Token: SeCreateGlobalPrivilege 268 vbc.exe Token: 33 268 vbc.exe Token: 34 268 vbc.exe Token: 35 268 vbc.exe -
Suspicious use of WriteProcessMemory 33 IoCs
Processes:
c2eec1701284699343ae2acb7a659b19f9275ab1742d7f5da526a5ef37f15c2e.exevbc.execmd.execmd.exedescription pid process target process PID 1752 wrote to memory of 268 1752 c2eec1701284699343ae2acb7a659b19f9275ab1742d7f5da526a5ef37f15c2e.exe vbc.exe PID 1752 wrote to memory of 268 1752 c2eec1701284699343ae2acb7a659b19f9275ab1742d7f5da526a5ef37f15c2e.exe vbc.exe PID 1752 wrote to memory of 268 1752 c2eec1701284699343ae2acb7a659b19f9275ab1742d7f5da526a5ef37f15c2e.exe vbc.exe PID 1752 wrote to memory of 268 1752 c2eec1701284699343ae2acb7a659b19f9275ab1742d7f5da526a5ef37f15c2e.exe vbc.exe PID 1752 wrote to memory of 268 1752 c2eec1701284699343ae2acb7a659b19f9275ab1742d7f5da526a5ef37f15c2e.exe vbc.exe PID 1752 wrote to memory of 268 1752 c2eec1701284699343ae2acb7a659b19f9275ab1742d7f5da526a5ef37f15c2e.exe vbc.exe PID 1752 wrote to memory of 268 1752 c2eec1701284699343ae2acb7a659b19f9275ab1742d7f5da526a5ef37f15c2e.exe vbc.exe PID 1752 wrote to memory of 268 1752 c2eec1701284699343ae2acb7a659b19f9275ab1742d7f5da526a5ef37f15c2e.exe vbc.exe PID 1752 wrote to memory of 268 1752 c2eec1701284699343ae2acb7a659b19f9275ab1742d7f5da526a5ef37f15c2e.exe vbc.exe PID 1752 wrote to memory of 268 1752 c2eec1701284699343ae2acb7a659b19f9275ab1742d7f5da526a5ef37f15c2e.exe vbc.exe PID 1752 wrote to memory of 268 1752 c2eec1701284699343ae2acb7a659b19f9275ab1742d7f5da526a5ef37f15c2e.exe vbc.exe PID 1752 wrote to memory of 268 1752 c2eec1701284699343ae2acb7a659b19f9275ab1742d7f5da526a5ef37f15c2e.exe vbc.exe PID 1752 wrote to memory of 268 1752 c2eec1701284699343ae2acb7a659b19f9275ab1742d7f5da526a5ef37f15c2e.exe vbc.exe PID 268 wrote to memory of 1816 268 vbc.exe cmd.exe PID 268 wrote to memory of 1816 268 vbc.exe cmd.exe PID 268 wrote to memory of 1816 268 vbc.exe cmd.exe PID 268 wrote to memory of 1816 268 vbc.exe cmd.exe PID 268 wrote to memory of 856 268 vbc.exe cmd.exe PID 268 wrote to memory of 856 268 vbc.exe cmd.exe PID 268 wrote to memory of 856 268 vbc.exe cmd.exe PID 268 wrote to memory of 856 268 vbc.exe cmd.exe PID 268 wrote to memory of 1324 268 vbc.exe msdcsc.exe PID 268 wrote to memory of 1324 268 vbc.exe msdcsc.exe PID 268 wrote to memory of 1324 268 vbc.exe msdcsc.exe PID 268 wrote to memory of 1324 268 vbc.exe msdcsc.exe PID 856 wrote to memory of 1344 856 cmd.exe attrib.exe PID 856 wrote to memory of 1344 856 cmd.exe attrib.exe PID 856 wrote to memory of 1344 856 cmd.exe attrib.exe PID 856 wrote to memory of 1344 856 cmd.exe attrib.exe PID 1816 wrote to memory of 872 1816 cmd.exe attrib.exe PID 1816 wrote to memory of 872 1816 cmd.exe attrib.exe PID 1816 wrote to memory of 872 1816 cmd.exe attrib.exe PID 1816 wrote to memory of 872 1816 cmd.exe attrib.exe -
Views/modifies file attributes 1 TTPs 2 IoCs
Processes:
attrib.exeattrib.exepid process 872 attrib.exe 1344 attrib.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\c2eec1701284699343ae2acb7a659b19f9275ab1742d7f5da526a5ef37f15c2e.exe"C:\Users\Admin\AppData\Local\Temp\c2eec1701284699343ae2acb7a659b19f9275ab1742d7f5da526a5ef37f15c2e.exe"1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeC:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe2⤵
- Modifies WinLogon for persistence
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" +s +h3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" +s +h4⤵
- Sets file to hidden
- Drops file in Windows directory
- Views/modifies file attributes
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\Microsoft.NET\Framework\v2.0.50727" +s +h3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\Microsoft.NET\Framework\v2.0.50727" +s +h4⤵
- Sets file to hidden
- Drops file in Windows directory
- Views/modifies file attributes
-
C:\ProgramData\Microsoft\Windows\Start Menu\MSDCSC\msdcsc.exe"C:\ProgramData\Microsoft\Windows\Start Menu\MSDCSC\msdcsc.exe"3⤵
- Executes dropped EXE
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ProgramData\Microsoft\Windows\Start Menu\MSDCSC\msdcsc.exeFilesize
1.1MB
MD534aa912defa18c2c129f1e09d75c1d7e
SHA19c3046324657505a30ecd9b1fdb46c05bde7d470
SHA2566df94b7fa33f1b87142adc39b3db0613fc520d9e7a5fd6a5301dd7f51f8d0386
SHA512d1ea9368f5d7166180612fd763c87afb647d088498887961f5e7fb0a10f4a808bd5928e8a3666d70ff794093c51ecca8816f75dd47652fd4eb23dce7f9aa1f98
-
C:\ProgramData\Microsoft\Windows\Start Menu\MSDCSC\msdcsc.exeFilesize
1.1MB
MD534aa912defa18c2c129f1e09d75c1d7e
SHA19c3046324657505a30ecd9b1fdb46c05bde7d470
SHA2566df94b7fa33f1b87142adc39b3db0613fc520d9e7a5fd6a5301dd7f51f8d0386
SHA512d1ea9368f5d7166180612fd763c87afb647d088498887961f5e7fb0a10f4a808bd5928e8a3666d70ff794093c51ecca8816f75dd47652fd4eb23dce7f9aa1f98
-
\ProgramData\Microsoft\Windows\Start Menu\MSDCSC\msdcsc.exeFilesize
1.1MB
MD534aa912defa18c2c129f1e09d75c1d7e
SHA19c3046324657505a30ecd9b1fdb46c05bde7d470
SHA2566df94b7fa33f1b87142adc39b3db0613fc520d9e7a5fd6a5301dd7f51f8d0386
SHA512d1ea9368f5d7166180612fd763c87afb647d088498887961f5e7fb0a10f4a808bd5928e8a3666d70ff794093c51ecca8816f75dd47652fd4eb23dce7f9aa1f98
-
memory/268-63-0x0000000000400000-0x00000000004B5000-memory.dmpFilesize
724KB
-
memory/268-75-0x0000000000400000-0x00000000004B5000-memory.dmpFilesize
724KB
-
memory/268-61-0x0000000000400000-0x00000000004B5000-memory.dmpFilesize
724KB
-
memory/268-82-0x0000000000400000-0x00000000004B5000-memory.dmpFilesize
724KB
-
memory/268-65-0x0000000000400000-0x00000000004B5000-memory.dmpFilesize
724KB
-
memory/268-66-0x0000000000400000-0x00000000004B5000-memory.dmpFilesize
724KB
-
memory/268-68-0x0000000000400000-0x00000000004B5000-memory.dmpFilesize
724KB
-
memory/268-70-0x0000000000400000-0x00000000004B5000-memory.dmpFilesize
724KB
-
memory/268-71-0x0000000000490888-mapping.dmp
-
memory/268-72-0x0000000000400000-0x00000000004B5000-memory.dmpFilesize
724KB
-
memory/268-74-0x0000000000400000-0x00000000004B5000-memory.dmpFilesize
724KB
-
memory/268-59-0x0000000000400000-0x00000000004B5000-memory.dmpFilesize
724KB
-
memory/268-56-0x0000000000400000-0x00000000004B5000-memory.dmpFilesize
724KB
-
memory/268-57-0x0000000000400000-0x00000000004B5000-memory.dmpFilesize
724KB
-
memory/856-77-0x0000000000000000-mapping.dmp
-
memory/872-83-0x0000000000000000-mapping.dmp
-
memory/1324-79-0x0000000000000000-mapping.dmp
-
memory/1344-81-0x0000000000000000-mapping.dmp
-
memory/1752-54-0x0000000075111000-0x0000000075113000-memory.dmpFilesize
8KB
-
memory/1752-55-0x0000000074170000-0x000000007471B000-memory.dmpFilesize
5.7MB
-
memory/1752-85-0x0000000074170000-0x000000007471B000-memory.dmpFilesize
5.7MB
-
memory/1816-76-0x0000000000000000-mapping.dmp