Analysis
-
max time kernel
157s -
max time network
162s -
platform
windows10-2004_x64 -
resource
win10v2004-20220901-en -
resource tags
arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system -
submitted
29-11-2022 14:12
Behavioral task
behavioral1
Sample
7fb37de5b0d3a10bd5f0c4667421419d5948c422f89116a474250ecadec9ebcb.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
7fb37de5b0d3a10bd5f0c4667421419d5948c422f89116a474250ecadec9ebcb.exe
Resource
win10v2004-20220901-en
General
-
Target
7fb37de5b0d3a10bd5f0c4667421419d5948c422f89116a474250ecadec9ebcb.exe
-
Size
663KB
-
MD5
742b9cfbf6a1a647fff63a68db09ae9a
-
SHA1
401898c521fa87c5390fe84a420ad051b5f00e2e
-
SHA256
7fb37de5b0d3a10bd5f0c4667421419d5948c422f89116a474250ecadec9ebcb
-
SHA512
b20264cab69a080fbee3e117b7978c8e398b3ac898ab8a578dcfbda896148b334cdaa4244ee34064e3a38727556b04a17fa285c50fe344d6fe88ca92681d7e21
-
SSDEEP
12288:S9HFJ9rJxRX1uVVjoaWSoynxdO1FVBaOiRZTERfIhNkNCCLo9Ek5C/hu:+Z1xuVVjfFoynPaVBUR8f+kN10EBE
Malware Config
Extracted
darkcomet
Guest16
darkcometrshack.zapto.org:1604
DC_MUTEX-WY98CUV
-
InstallPath
MSDCSC\msdcsc.exe
-
gencode
DSuCzdL0CcY0
-
install
true
-
offline_keylogger
true
-
persistence
true
-
reg_key
MicroUpdate
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
Processes:
7fb37de5b0d3a10bd5f0c4667421419d5948c422f89116a474250ecadec9ebcb.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Users\\Admin\\Documents\\MSDCSC\\msdcsc.exe" 7fb37de5b0d3a10bd5f0c4667421419d5948c422f89116a474250ecadec9ebcb.exe -
Executes dropped EXE 1 IoCs
Processes:
msdcsc.exepid process 4556 msdcsc.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
7fb37de5b0d3a10bd5f0c4667421419d5948c422f89116a474250ecadec9ebcb.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation 7fb37de5b0d3a10bd5f0c4667421419d5948c422f89116a474250ecadec9ebcb.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
7fb37de5b0d3a10bd5f0c4667421419d5948c422f89116a474250ecadec9ebcb.exemsdcsc.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Users\\Admin\\Documents\\MSDCSC\\msdcsc.exe" 7fb37de5b0d3a10bd5f0c4667421419d5948c422f89116a474250ecadec9ebcb.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Users\\Admin\\Documents\\MSDCSC\\msdcsc.exe" msdcsc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Modifies registry class 1 IoCs
Processes:
7fb37de5b0d3a10bd5f0c4667421419d5948c422f89116a474250ecadec9ebcb.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ 7fb37de5b0d3a10bd5f0c4667421419d5948c422f89116a474250ecadec9ebcb.exe -
Suspicious use of AdjustPrivilegeToken 48 IoCs
Processes:
7fb37de5b0d3a10bd5f0c4667421419d5948c422f89116a474250ecadec9ebcb.exemsdcsc.exedescription pid process Token: SeIncreaseQuotaPrivilege 5004 7fb37de5b0d3a10bd5f0c4667421419d5948c422f89116a474250ecadec9ebcb.exe Token: SeSecurityPrivilege 5004 7fb37de5b0d3a10bd5f0c4667421419d5948c422f89116a474250ecadec9ebcb.exe Token: SeTakeOwnershipPrivilege 5004 7fb37de5b0d3a10bd5f0c4667421419d5948c422f89116a474250ecadec9ebcb.exe Token: SeLoadDriverPrivilege 5004 7fb37de5b0d3a10bd5f0c4667421419d5948c422f89116a474250ecadec9ebcb.exe Token: SeSystemProfilePrivilege 5004 7fb37de5b0d3a10bd5f0c4667421419d5948c422f89116a474250ecadec9ebcb.exe Token: SeSystemtimePrivilege 5004 7fb37de5b0d3a10bd5f0c4667421419d5948c422f89116a474250ecadec9ebcb.exe Token: SeProfSingleProcessPrivilege 5004 7fb37de5b0d3a10bd5f0c4667421419d5948c422f89116a474250ecadec9ebcb.exe Token: SeIncBasePriorityPrivilege 5004 7fb37de5b0d3a10bd5f0c4667421419d5948c422f89116a474250ecadec9ebcb.exe Token: SeCreatePagefilePrivilege 5004 7fb37de5b0d3a10bd5f0c4667421419d5948c422f89116a474250ecadec9ebcb.exe Token: SeBackupPrivilege 5004 7fb37de5b0d3a10bd5f0c4667421419d5948c422f89116a474250ecadec9ebcb.exe Token: SeRestorePrivilege 5004 7fb37de5b0d3a10bd5f0c4667421419d5948c422f89116a474250ecadec9ebcb.exe Token: SeShutdownPrivilege 5004 7fb37de5b0d3a10bd5f0c4667421419d5948c422f89116a474250ecadec9ebcb.exe Token: SeDebugPrivilege 5004 7fb37de5b0d3a10bd5f0c4667421419d5948c422f89116a474250ecadec9ebcb.exe Token: SeSystemEnvironmentPrivilege 5004 7fb37de5b0d3a10bd5f0c4667421419d5948c422f89116a474250ecadec9ebcb.exe Token: SeChangeNotifyPrivilege 5004 7fb37de5b0d3a10bd5f0c4667421419d5948c422f89116a474250ecadec9ebcb.exe Token: SeRemoteShutdownPrivilege 5004 7fb37de5b0d3a10bd5f0c4667421419d5948c422f89116a474250ecadec9ebcb.exe Token: SeUndockPrivilege 5004 7fb37de5b0d3a10bd5f0c4667421419d5948c422f89116a474250ecadec9ebcb.exe Token: SeManageVolumePrivilege 5004 7fb37de5b0d3a10bd5f0c4667421419d5948c422f89116a474250ecadec9ebcb.exe Token: SeImpersonatePrivilege 5004 7fb37de5b0d3a10bd5f0c4667421419d5948c422f89116a474250ecadec9ebcb.exe Token: SeCreateGlobalPrivilege 5004 7fb37de5b0d3a10bd5f0c4667421419d5948c422f89116a474250ecadec9ebcb.exe Token: 33 5004 7fb37de5b0d3a10bd5f0c4667421419d5948c422f89116a474250ecadec9ebcb.exe Token: 34 5004 7fb37de5b0d3a10bd5f0c4667421419d5948c422f89116a474250ecadec9ebcb.exe Token: 35 5004 7fb37de5b0d3a10bd5f0c4667421419d5948c422f89116a474250ecadec9ebcb.exe Token: 36 5004 7fb37de5b0d3a10bd5f0c4667421419d5948c422f89116a474250ecadec9ebcb.exe Token: SeIncreaseQuotaPrivilege 4556 msdcsc.exe Token: SeSecurityPrivilege 4556 msdcsc.exe Token: SeTakeOwnershipPrivilege 4556 msdcsc.exe Token: SeLoadDriverPrivilege 4556 msdcsc.exe Token: SeSystemProfilePrivilege 4556 msdcsc.exe Token: SeSystemtimePrivilege 4556 msdcsc.exe Token: SeProfSingleProcessPrivilege 4556 msdcsc.exe Token: SeIncBasePriorityPrivilege 4556 msdcsc.exe Token: SeCreatePagefilePrivilege 4556 msdcsc.exe Token: SeBackupPrivilege 4556 msdcsc.exe Token: SeRestorePrivilege 4556 msdcsc.exe Token: SeShutdownPrivilege 4556 msdcsc.exe Token: SeDebugPrivilege 4556 msdcsc.exe Token: SeSystemEnvironmentPrivilege 4556 msdcsc.exe Token: SeChangeNotifyPrivilege 4556 msdcsc.exe Token: SeRemoteShutdownPrivilege 4556 msdcsc.exe Token: SeUndockPrivilege 4556 msdcsc.exe Token: SeManageVolumePrivilege 4556 msdcsc.exe Token: SeImpersonatePrivilege 4556 msdcsc.exe Token: SeCreateGlobalPrivilege 4556 msdcsc.exe Token: 33 4556 msdcsc.exe Token: 34 4556 msdcsc.exe Token: 35 4556 msdcsc.exe Token: 36 4556 msdcsc.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
msdcsc.exepid process 4556 msdcsc.exe -
Suspicious use of WriteProcessMemory 42 IoCs
Processes:
7fb37de5b0d3a10bd5f0c4667421419d5948c422f89116a474250ecadec9ebcb.exemsdcsc.exedescription pid process target process PID 5004 wrote to memory of 640 5004 7fb37de5b0d3a10bd5f0c4667421419d5948c422f89116a474250ecadec9ebcb.exe notepad.exe PID 5004 wrote to memory of 640 5004 7fb37de5b0d3a10bd5f0c4667421419d5948c422f89116a474250ecadec9ebcb.exe notepad.exe PID 5004 wrote to memory of 640 5004 7fb37de5b0d3a10bd5f0c4667421419d5948c422f89116a474250ecadec9ebcb.exe notepad.exe PID 5004 wrote to memory of 640 5004 7fb37de5b0d3a10bd5f0c4667421419d5948c422f89116a474250ecadec9ebcb.exe notepad.exe PID 5004 wrote to memory of 640 5004 7fb37de5b0d3a10bd5f0c4667421419d5948c422f89116a474250ecadec9ebcb.exe notepad.exe PID 5004 wrote to memory of 640 5004 7fb37de5b0d3a10bd5f0c4667421419d5948c422f89116a474250ecadec9ebcb.exe notepad.exe PID 5004 wrote to memory of 640 5004 7fb37de5b0d3a10bd5f0c4667421419d5948c422f89116a474250ecadec9ebcb.exe notepad.exe PID 5004 wrote to memory of 640 5004 7fb37de5b0d3a10bd5f0c4667421419d5948c422f89116a474250ecadec9ebcb.exe notepad.exe PID 5004 wrote to memory of 640 5004 7fb37de5b0d3a10bd5f0c4667421419d5948c422f89116a474250ecadec9ebcb.exe notepad.exe PID 5004 wrote to memory of 640 5004 7fb37de5b0d3a10bd5f0c4667421419d5948c422f89116a474250ecadec9ebcb.exe notepad.exe PID 5004 wrote to memory of 640 5004 7fb37de5b0d3a10bd5f0c4667421419d5948c422f89116a474250ecadec9ebcb.exe notepad.exe PID 5004 wrote to memory of 640 5004 7fb37de5b0d3a10bd5f0c4667421419d5948c422f89116a474250ecadec9ebcb.exe notepad.exe PID 5004 wrote to memory of 640 5004 7fb37de5b0d3a10bd5f0c4667421419d5948c422f89116a474250ecadec9ebcb.exe notepad.exe PID 5004 wrote to memory of 640 5004 7fb37de5b0d3a10bd5f0c4667421419d5948c422f89116a474250ecadec9ebcb.exe notepad.exe PID 5004 wrote to memory of 640 5004 7fb37de5b0d3a10bd5f0c4667421419d5948c422f89116a474250ecadec9ebcb.exe notepad.exe PID 5004 wrote to memory of 640 5004 7fb37de5b0d3a10bd5f0c4667421419d5948c422f89116a474250ecadec9ebcb.exe notepad.exe PID 5004 wrote to memory of 640 5004 7fb37de5b0d3a10bd5f0c4667421419d5948c422f89116a474250ecadec9ebcb.exe notepad.exe PID 5004 wrote to memory of 4556 5004 7fb37de5b0d3a10bd5f0c4667421419d5948c422f89116a474250ecadec9ebcb.exe msdcsc.exe PID 5004 wrote to memory of 4556 5004 7fb37de5b0d3a10bd5f0c4667421419d5948c422f89116a474250ecadec9ebcb.exe msdcsc.exe PID 5004 wrote to memory of 4556 5004 7fb37de5b0d3a10bd5f0c4667421419d5948c422f89116a474250ecadec9ebcb.exe msdcsc.exe PID 4556 wrote to memory of 1448 4556 msdcsc.exe notepad.exe PID 4556 wrote to memory of 1448 4556 msdcsc.exe notepad.exe PID 4556 wrote to memory of 1448 4556 msdcsc.exe notepad.exe PID 4556 wrote to memory of 1448 4556 msdcsc.exe notepad.exe PID 4556 wrote to memory of 1448 4556 msdcsc.exe notepad.exe PID 4556 wrote to memory of 1448 4556 msdcsc.exe notepad.exe PID 4556 wrote to memory of 1448 4556 msdcsc.exe notepad.exe PID 4556 wrote to memory of 1448 4556 msdcsc.exe notepad.exe PID 4556 wrote to memory of 1448 4556 msdcsc.exe notepad.exe PID 4556 wrote to memory of 1448 4556 msdcsc.exe notepad.exe PID 4556 wrote to memory of 1448 4556 msdcsc.exe notepad.exe PID 4556 wrote to memory of 1448 4556 msdcsc.exe notepad.exe PID 4556 wrote to memory of 1448 4556 msdcsc.exe notepad.exe PID 4556 wrote to memory of 1448 4556 msdcsc.exe notepad.exe PID 4556 wrote to memory of 1448 4556 msdcsc.exe notepad.exe PID 4556 wrote to memory of 1448 4556 msdcsc.exe notepad.exe PID 4556 wrote to memory of 1448 4556 msdcsc.exe notepad.exe PID 4556 wrote to memory of 1448 4556 msdcsc.exe notepad.exe PID 4556 wrote to memory of 1448 4556 msdcsc.exe notepad.exe PID 4556 wrote to memory of 1448 4556 msdcsc.exe notepad.exe PID 4556 wrote to memory of 1448 4556 msdcsc.exe notepad.exe PID 4556 wrote to memory of 1448 4556 msdcsc.exe notepad.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\7fb37de5b0d3a10bd5f0c4667421419d5948c422f89116a474250ecadec9ebcb.exe"C:\Users\Admin\AppData\Local\Temp\7fb37de5b0d3a10bd5f0c4667421419d5948c422f89116a474250ecadec9ebcb.exe"1⤵
- Modifies WinLogon for persistence
- Checks computer location settings
- Adds Run key to start application
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\notepad.exenotepad2⤵
-
C:\Users\Admin\Documents\MSDCSC\msdcsc.exe"C:\Users\Admin\Documents\MSDCSC\msdcsc.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\notepad.exenotepad3⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\Documents\MSDCSC\msdcsc.exeFilesize
663KB
MD5742b9cfbf6a1a647fff63a68db09ae9a
SHA1401898c521fa87c5390fe84a420ad051b5f00e2e
SHA2567fb37de5b0d3a10bd5f0c4667421419d5948c422f89116a474250ecadec9ebcb
SHA512b20264cab69a080fbee3e117b7978c8e398b3ac898ab8a578dcfbda896148b334cdaa4244ee34064e3a38727556b04a17fa285c50fe344d6fe88ca92681d7e21
-
C:\Users\Admin\Documents\MSDCSC\msdcsc.exeFilesize
663KB
MD5742b9cfbf6a1a647fff63a68db09ae9a
SHA1401898c521fa87c5390fe84a420ad051b5f00e2e
SHA2567fb37de5b0d3a10bd5f0c4667421419d5948c422f89116a474250ecadec9ebcb
SHA512b20264cab69a080fbee3e117b7978c8e398b3ac898ab8a578dcfbda896148b334cdaa4244ee34064e3a38727556b04a17fa285c50fe344d6fe88ca92681d7e21
-
memory/640-132-0x0000000000000000-mapping.dmp
-
memory/1448-136-0x0000000000000000-mapping.dmp
-
memory/4556-133-0x0000000000000000-mapping.dmp