Analysis
-
max time kernel
156s -
max time network
50s -
platform
windows7_x64 -
resource
win7-20220901-en -
resource tags
arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system -
submitted
29-11-2022 14:12
Behavioral task
behavioral1
Sample
7fb37de5b0d3a10bd5f0c4667421419d5948c422f89116a474250ecadec9ebcb.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
7fb37de5b0d3a10bd5f0c4667421419d5948c422f89116a474250ecadec9ebcb.exe
Resource
win10v2004-20220901-en
General
-
Target
7fb37de5b0d3a10bd5f0c4667421419d5948c422f89116a474250ecadec9ebcb.exe
-
Size
663KB
-
MD5
742b9cfbf6a1a647fff63a68db09ae9a
-
SHA1
401898c521fa87c5390fe84a420ad051b5f00e2e
-
SHA256
7fb37de5b0d3a10bd5f0c4667421419d5948c422f89116a474250ecadec9ebcb
-
SHA512
b20264cab69a080fbee3e117b7978c8e398b3ac898ab8a578dcfbda896148b334cdaa4244ee34064e3a38727556b04a17fa285c50fe344d6fe88ca92681d7e21
-
SSDEEP
12288:S9HFJ9rJxRX1uVVjoaWSoynxdO1FVBaOiRZTERfIhNkNCCLo9Ek5C/hu:+Z1xuVVjfFoynPaVBUR8f+kN10EBE
Malware Config
Extracted
darkcomet
Guest16
darkcometrshack.zapto.org:1604
DC_MUTEX-WY98CUV
-
InstallPath
MSDCSC\msdcsc.exe
-
gencode
DSuCzdL0CcY0
-
install
true
-
offline_keylogger
true
-
persistence
true
-
reg_key
MicroUpdate
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
Processes:
7fb37de5b0d3a10bd5f0c4667421419d5948c422f89116a474250ecadec9ebcb.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Users\\Admin\\Documents\\MSDCSC\\msdcsc.exe" 7fb37de5b0d3a10bd5f0c4667421419d5948c422f89116a474250ecadec9ebcb.exe -
Executes dropped EXE 1 IoCs
Processes:
msdcsc.exepid process 676 msdcsc.exe -
Deletes itself 1 IoCs
Processes:
notepad.exepid process 1992 notepad.exe -
Loads dropped DLL 2 IoCs
Processes:
7fb37de5b0d3a10bd5f0c4667421419d5948c422f89116a474250ecadec9ebcb.exepid process 2016 7fb37de5b0d3a10bd5f0c4667421419d5948c422f89116a474250ecadec9ebcb.exe 2016 7fb37de5b0d3a10bd5f0c4667421419d5948c422f89116a474250ecadec9ebcb.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
7fb37de5b0d3a10bd5f0c4667421419d5948c422f89116a474250ecadec9ebcb.exemsdcsc.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Users\\Admin\\Documents\\MSDCSC\\msdcsc.exe" 7fb37de5b0d3a10bd5f0c4667421419d5948c422f89116a474250ecadec9ebcb.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Users\\Admin\\Documents\\MSDCSC\\msdcsc.exe" msdcsc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of AdjustPrivilegeToken 46 IoCs
Processes:
7fb37de5b0d3a10bd5f0c4667421419d5948c422f89116a474250ecadec9ebcb.exemsdcsc.exedescription pid process Token: SeIncreaseQuotaPrivilege 2016 7fb37de5b0d3a10bd5f0c4667421419d5948c422f89116a474250ecadec9ebcb.exe Token: SeSecurityPrivilege 2016 7fb37de5b0d3a10bd5f0c4667421419d5948c422f89116a474250ecadec9ebcb.exe Token: SeTakeOwnershipPrivilege 2016 7fb37de5b0d3a10bd5f0c4667421419d5948c422f89116a474250ecadec9ebcb.exe Token: SeLoadDriverPrivilege 2016 7fb37de5b0d3a10bd5f0c4667421419d5948c422f89116a474250ecadec9ebcb.exe Token: SeSystemProfilePrivilege 2016 7fb37de5b0d3a10bd5f0c4667421419d5948c422f89116a474250ecadec9ebcb.exe Token: SeSystemtimePrivilege 2016 7fb37de5b0d3a10bd5f0c4667421419d5948c422f89116a474250ecadec9ebcb.exe Token: SeProfSingleProcessPrivilege 2016 7fb37de5b0d3a10bd5f0c4667421419d5948c422f89116a474250ecadec9ebcb.exe Token: SeIncBasePriorityPrivilege 2016 7fb37de5b0d3a10bd5f0c4667421419d5948c422f89116a474250ecadec9ebcb.exe Token: SeCreatePagefilePrivilege 2016 7fb37de5b0d3a10bd5f0c4667421419d5948c422f89116a474250ecadec9ebcb.exe Token: SeBackupPrivilege 2016 7fb37de5b0d3a10bd5f0c4667421419d5948c422f89116a474250ecadec9ebcb.exe Token: SeRestorePrivilege 2016 7fb37de5b0d3a10bd5f0c4667421419d5948c422f89116a474250ecadec9ebcb.exe Token: SeShutdownPrivilege 2016 7fb37de5b0d3a10bd5f0c4667421419d5948c422f89116a474250ecadec9ebcb.exe Token: SeDebugPrivilege 2016 7fb37de5b0d3a10bd5f0c4667421419d5948c422f89116a474250ecadec9ebcb.exe Token: SeSystemEnvironmentPrivilege 2016 7fb37de5b0d3a10bd5f0c4667421419d5948c422f89116a474250ecadec9ebcb.exe Token: SeChangeNotifyPrivilege 2016 7fb37de5b0d3a10bd5f0c4667421419d5948c422f89116a474250ecadec9ebcb.exe Token: SeRemoteShutdownPrivilege 2016 7fb37de5b0d3a10bd5f0c4667421419d5948c422f89116a474250ecadec9ebcb.exe Token: SeUndockPrivilege 2016 7fb37de5b0d3a10bd5f0c4667421419d5948c422f89116a474250ecadec9ebcb.exe Token: SeManageVolumePrivilege 2016 7fb37de5b0d3a10bd5f0c4667421419d5948c422f89116a474250ecadec9ebcb.exe Token: SeImpersonatePrivilege 2016 7fb37de5b0d3a10bd5f0c4667421419d5948c422f89116a474250ecadec9ebcb.exe Token: SeCreateGlobalPrivilege 2016 7fb37de5b0d3a10bd5f0c4667421419d5948c422f89116a474250ecadec9ebcb.exe Token: 33 2016 7fb37de5b0d3a10bd5f0c4667421419d5948c422f89116a474250ecadec9ebcb.exe Token: 34 2016 7fb37de5b0d3a10bd5f0c4667421419d5948c422f89116a474250ecadec9ebcb.exe Token: 35 2016 7fb37de5b0d3a10bd5f0c4667421419d5948c422f89116a474250ecadec9ebcb.exe Token: SeIncreaseQuotaPrivilege 676 msdcsc.exe Token: SeSecurityPrivilege 676 msdcsc.exe Token: SeTakeOwnershipPrivilege 676 msdcsc.exe Token: SeLoadDriverPrivilege 676 msdcsc.exe Token: SeSystemProfilePrivilege 676 msdcsc.exe Token: SeSystemtimePrivilege 676 msdcsc.exe Token: SeProfSingleProcessPrivilege 676 msdcsc.exe Token: SeIncBasePriorityPrivilege 676 msdcsc.exe Token: SeCreatePagefilePrivilege 676 msdcsc.exe Token: SeBackupPrivilege 676 msdcsc.exe Token: SeRestorePrivilege 676 msdcsc.exe Token: SeShutdownPrivilege 676 msdcsc.exe Token: SeDebugPrivilege 676 msdcsc.exe Token: SeSystemEnvironmentPrivilege 676 msdcsc.exe Token: SeChangeNotifyPrivilege 676 msdcsc.exe Token: SeRemoteShutdownPrivilege 676 msdcsc.exe Token: SeUndockPrivilege 676 msdcsc.exe Token: SeManageVolumePrivilege 676 msdcsc.exe Token: SeImpersonatePrivilege 676 msdcsc.exe Token: SeCreateGlobalPrivilege 676 msdcsc.exe Token: 33 676 msdcsc.exe Token: 34 676 msdcsc.exe Token: 35 676 msdcsc.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
msdcsc.exepid process 676 msdcsc.exe -
Suspicious use of WriteProcessMemory 45 IoCs
Processes:
7fb37de5b0d3a10bd5f0c4667421419d5948c422f89116a474250ecadec9ebcb.exemsdcsc.exedescription pid process target process PID 2016 wrote to memory of 1992 2016 7fb37de5b0d3a10bd5f0c4667421419d5948c422f89116a474250ecadec9ebcb.exe notepad.exe PID 2016 wrote to memory of 1992 2016 7fb37de5b0d3a10bd5f0c4667421419d5948c422f89116a474250ecadec9ebcb.exe notepad.exe PID 2016 wrote to memory of 1992 2016 7fb37de5b0d3a10bd5f0c4667421419d5948c422f89116a474250ecadec9ebcb.exe notepad.exe PID 2016 wrote to memory of 1992 2016 7fb37de5b0d3a10bd5f0c4667421419d5948c422f89116a474250ecadec9ebcb.exe notepad.exe PID 2016 wrote to memory of 1992 2016 7fb37de5b0d3a10bd5f0c4667421419d5948c422f89116a474250ecadec9ebcb.exe notepad.exe PID 2016 wrote to memory of 1992 2016 7fb37de5b0d3a10bd5f0c4667421419d5948c422f89116a474250ecadec9ebcb.exe notepad.exe PID 2016 wrote to memory of 1992 2016 7fb37de5b0d3a10bd5f0c4667421419d5948c422f89116a474250ecadec9ebcb.exe notepad.exe PID 2016 wrote to memory of 1992 2016 7fb37de5b0d3a10bd5f0c4667421419d5948c422f89116a474250ecadec9ebcb.exe notepad.exe PID 2016 wrote to memory of 1992 2016 7fb37de5b0d3a10bd5f0c4667421419d5948c422f89116a474250ecadec9ebcb.exe notepad.exe PID 2016 wrote to memory of 1992 2016 7fb37de5b0d3a10bd5f0c4667421419d5948c422f89116a474250ecadec9ebcb.exe notepad.exe PID 2016 wrote to memory of 1992 2016 7fb37de5b0d3a10bd5f0c4667421419d5948c422f89116a474250ecadec9ebcb.exe notepad.exe PID 2016 wrote to memory of 1992 2016 7fb37de5b0d3a10bd5f0c4667421419d5948c422f89116a474250ecadec9ebcb.exe notepad.exe PID 2016 wrote to memory of 1992 2016 7fb37de5b0d3a10bd5f0c4667421419d5948c422f89116a474250ecadec9ebcb.exe notepad.exe PID 2016 wrote to memory of 1992 2016 7fb37de5b0d3a10bd5f0c4667421419d5948c422f89116a474250ecadec9ebcb.exe notepad.exe PID 2016 wrote to memory of 1992 2016 7fb37de5b0d3a10bd5f0c4667421419d5948c422f89116a474250ecadec9ebcb.exe notepad.exe PID 2016 wrote to memory of 1992 2016 7fb37de5b0d3a10bd5f0c4667421419d5948c422f89116a474250ecadec9ebcb.exe notepad.exe PID 2016 wrote to memory of 1992 2016 7fb37de5b0d3a10bd5f0c4667421419d5948c422f89116a474250ecadec9ebcb.exe notepad.exe PID 2016 wrote to memory of 1992 2016 7fb37de5b0d3a10bd5f0c4667421419d5948c422f89116a474250ecadec9ebcb.exe notepad.exe PID 2016 wrote to memory of 676 2016 7fb37de5b0d3a10bd5f0c4667421419d5948c422f89116a474250ecadec9ebcb.exe msdcsc.exe PID 2016 wrote to memory of 676 2016 7fb37de5b0d3a10bd5f0c4667421419d5948c422f89116a474250ecadec9ebcb.exe msdcsc.exe PID 2016 wrote to memory of 676 2016 7fb37de5b0d3a10bd5f0c4667421419d5948c422f89116a474250ecadec9ebcb.exe msdcsc.exe PID 2016 wrote to memory of 676 2016 7fb37de5b0d3a10bd5f0c4667421419d5948c422f89116a474250ecadec9ebcb.exe msdcsc.exe PID 676 wrote to memory of 568 676 msdcsc.exe notepad.exe PID 676 wrote to memory of 568 676 msdcsc.exe notepad.exe PID 676 wrote to memory of 568 676 msdcsc.exe notepad.exe PID 676 wrote to memory of 568 676 msdcsc.exe notepad.exe PID 676 wrote to memory of 568 676 msdcsc.exe notepad.exe PID 676 wrote to memory of 568 676 msdcsc.exe notepad.exe PID 676 wrote to memory of 568 676 msdcsc.exe notepad.exe PID 676 wrote to memory of 568 676 msdcsc.exe notepad.exe PID 676 wrote to memory of 568 676 msdcsc.exe notepad.exe PID 676 wrote to memory of 568 676 msdcsc.exe notepad.exe PID 676 wrote to memory of 568 676 msdcsc.exe notepad.exe PID 676 wrote to memory of 568 676 msdcsc.exe notepad.exe PID 676 wrote to memory of 568 676 msdcsc.exe notepad.exe PID 676 wrote to memory of 568 676 msdcsc.exe notepad.exe PID 676 wrote to memory of 568 676 msdcsc.exe notepad.exe PID 676 wrote to memory of 568 676 msdcsc.exe notepad.exe PID 676 wrote to memory of 568 676 msdcsc.exe notepad.exe PID 676 wrote to memory of 568 676 msdcsc.exe notepad.exe PID 676 wrote to memory of 568 676 msdcsc.exe notepad.exe PID 676 wrote to memory of 568 676 msdcsc.exe notepad.exe PID 676 wrote to memory of 568 676 msdcsc.exe notepad.exe PID 676 wrote to memory of 568 676 msdcsc.exe notepad.exe PID 676 wrote to memory of 568 676 msdcsc.exe notepad.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\7fb37de5b0d3a10bd5f0c4667421419d5948c422f89116a474250ecadec9ebcb.exe"C:\Users\Admin\AppData\Local\Temp\7fb37de5b0d3a10bd5f0c4667421419d5948c422f89116a474250ecadec9ebcb.exe"1⤵
- Modifies WinLogon for persistence
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\notepad.exenotepad2⤵
- Deletes itself
-
C:\Users\Admin\Documents\MSDCSC\msdcsc.exe"C:\Users\Admin\Documents\MSDCSC\msdcsc.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\notepad.exenotepad3⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\Documents\MSDCSC\msdcsc.exeFilesize
663KB
MD5742b9cfbf6a1a647fff63a68db09ae9a
SHA1401898c521fa87c5390fe84a420ad051b5f00e2e
SHA2567fb37de5b0d3a10bd5f0c4667421419d5948c422f89116a474250ecadec9ebcb
SHA512b20264cab69a080fbee3e117b7978c8e398b3ac898ab8a578dcfbda896148b334cdaa4244ee34064e3a38727556b04a17fa285c50fe344d6fe88ca92681d7e21
-
C:\Users\Admin\Documents\MSDCSC\msdcsc.exeFilesize
663KB
MD5742b9cfbf6a1a647fff63a68db09ae9a
SHA1401898c521fa87c5390fe84a420ad051b5f00e2e
SHA2567fb37de5b0d3a10bd5f0c4667421419d5948c422f89116a474250ecadec9ebcb
SHA512b20264cab69a080fbee3e117b7978c8e398b3ac898ab8a578dcfbda896148b334cdaa4244ee34064e3a38727556b04a17fa285c50fe344d6fe88ca92681d7e21
-
\Users\Admin\Documents\MSDCSC\msdcsc.exeFilesize
663KB
MD5742b9cfbf6a1a647fff63a68db09ae9a
SHA1401898c521fa87c5390fe84a420ad051b5f00e2e
SHA2567fb37de5b0d3a10bd5f0c4667421419d5948c422f89116a474250ecadec9ebcb
SHA512b20264cab69a080fbee3e117b7978c8e398b3ac898ab8a578dcfbda896148b334cdaa4244ee34064e3a38727556b04a17fa285c50fe344d6fe88ca92681d7e21
-
\Users\Admin\Documents\MSDCSC\msdcsc.exeFilesize
663KB
MD5742b9cfbf6a1a647fff63a68db09ae9a
SHA1401898c521fa87c5390fe84a420ad051b5f00e2e
SHA2567fb37de5b0d3a10bd5f0c4667421419d5948c422f89116a474250ecadec9ebcb
SHA512b20264cab69a080fbee3e117b7978c8e398b3ac898ab8a578dcfbda896148b334cdaa4244ee34064e3a38727556b04a17fa285c50fe344d6fe88ca92681d7e21
-
memory/568-63-0x0000000000000000-mapping.dmp
-
memory/676-59-0x0000000000000000-mapping.dmp
-
memory/1992-55-0x0000000000000000-mapping.dmp
-
memory/2016-54-0x00000000766D1000-0x00000000766D3000-memory.dmpFilesize
8KB