Analysis
-
max time kernel
178s -
max time network
69s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
29-11-2022 14:12
Behavioral task
behavioral1
Sample
cac92ba7a226d877c369403c880f4251391c88409159509e378724b32e57dac5.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
cac92ba7a226d877c369403c880f4251391c88409159509e378724b32e57dac5.exe
Resource
win10v2004-20220901-en
General
-
Target
cac92ba7a226d877c369403c880f4251391c88409159509e378724b32e57dac5.exe
-
Size
756KB
-
MD5
861bd0deacbaa5ba7f5fe80f78d1f5b4
-
SHA1
59792a6b68904c29cf3baad77f033b64dcca3f5c
-
SHA256
cac92ba7a226d877c369403c880f4251391c88409159509e378724b32e57dac5
-
SHA512
d0766f0147e5a2f302cd4adf7be5c34c158b42f78de18ae8731d8274ce9a20cadbd568400953a5382c48780136795bb4f0483612c3ac149fecb9a4b51c09de91
-
SSDEEP
12288:u9HFJ9rJxRX1uVVjoaWSoynxdO1FVBaOiRZTERfIhNkNCCLo9Ek5C/hA:6Z1xuVVjfFoynPaVBUR8f+kN10EBq
Malware Config
Extracted
darkcomet
DrHacker
drhacker.no-ip.info:81
DC_MUTEX-4FCVTUB
-
InstallPath
system.exe
-
gencode
y381anlYCr2s
-
install
true
-
offline_keylogger
true
-
persistence
false
-
reg_key
system
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
Processes:
cac92ba7a226d877c369403c880f4251391c88409159509e378724b32e57dac5.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Users\\Admin\\AppData\\Local\\Temp\\system.exe" cac92ba7a226d877c369403c880f4251391c88409159509e378724b32e57dac5.exe -
Executes dropped EXE 1 IoCs
Processes:
system.exepid process 524 system.exe -
Loads dropped DLL 2 IoCs
Processes:
cac92ba7a226d877c369403c880f4251391c88409159509e378724b32e57dac5.exepid process 1352 cac92ba7a226d877c369403c880f4251391c88409159509e378724b32e57dac5.exe 1352 cac92ba7a226d877c369403c880f4251391c88409159509e378724b32e57dac5.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
cac92ba7a226d877c369403c880f4251391c88409159509e378724b32e57dac5.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run\system = "C:\\Users\\Admin\\AppData\\Local\\Temp\\system.exe" cac92ba7a226d877c369403c880f4251391c88409159509e378724b32e57dac5.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
system.exedescription pid process target process PID 524 set thread context of 1912 524 system.exe iexplore.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
iexplore.exepid process 1912 iexplore.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
cac92ba7a226d877c369403c880f4251391c88409159509e378724b32e57dac5.exesystem.exeiexplore.exedescription pid process Token: SeIncreaseQuotaPrivilege 1352 cac92ba7a226d877c369403c880f4251391c88409159509e378724b32e57dac5.exe Token: SeSecurityPrivilege 1352 cac92ba7a226d877c369403c880f4251391c88409159509e378724b32e57dac5.exe Token: SeTakeOwnershipPrivilege 1352 cac92ba7a226d877c369403c880f4251391c88409159509e378724b32e57dac5.exe Token: SeLoadDriverPrivilege 1352 cac92ba7a226d877c369403c880f4251391c88409159509e378724b32e57dac5.exe Token: SeSystemProfilePrivilege 1352 cac92ba7a226d877c369403c880f4251391c88409159509e378724b32e57dac5.exe Token: SeSystemtimePrivilege 1352 cac92ba7a226d877c369403c880f4251391c88409159509e378724b32e57dac5.exe Token: SeProfSingleProcessPrivilege 1352 cac92ba7a226d877c369403c880f4251391c88409159509e378724b32e57dac5.exe Token: SeIncBasePriorityPrivilege 1352 cac92ba7a226d877c369403c880f4251391c88409159509e378724b32e57dac5.exe Token: SeCreatePagefilePrivilege 1352 cac92ba7a226d877c369403c880f4251391c88409159509e378724b32e57dac5.exe Token: SeBackupPrivilege 1352 cac92ba7a226d877c369403c880f4251391c88409159509e378724b32e57dac5.exe Token: SeRestorePrivilege 1352 cac92ba7a226d877c369403c880f4251391c88409159509e378724b32e57dac5.exe Token: SeShutdownPrivilege 1352 cac92ba7a226d877c369403c880f4251391c88409159509e378724b32e57dac5.exe Token: SeDebugPrivilege 1352 cac92ba7a226d877c369403c880f4251391c88409159509e378724b32e57dac5.exe Token: SeSystemEnvironmentPrivilege 1352 cac92ba7a226d877c369403c880f4251391c88409159509e378724b32e57dac5.exe Token: SeChangeNotifyPrivilege 1352 cac92ba7a226d877c369403c880f4251391c88409159509e378724b32e57dac5.exe Token: SeRemoteShutdownPrivilege 1352 cac92ba7a226d877c369403c880f4251391c88409159509e378724b32e57dac5.exe Token: SeUndockPrivilege 1352 cac92ba7a226d877c369403c880f4251391c88409159509e378724b32e57dac5.exe Token: SeManageVolumePrivilege 1352 cac92ba7a226d877c369403c880f4251391c88409159509e378724b32e57dac5.exe Token: SeImpersonatePrivilege 1352 cac92ba7a226d877c369403c880f4251391c88409159509e378724b32e57dac5.exe Token: SeCreateGlobalPrivilege 1352 cac92ba7a226d877c369403c880f4251391c88409159509e378724b32e57dac5.exe Token: 33 1352 cac92ba7a226d877c369403c880f4251391c88409159509e378724b32e57dac5.exe Token: 34 1352 cac92ba7a226d877c369403c880f4251391c88409159509e378724b32e57dac5.exe Token: 35 1352 cac92ba7a226d877c369403c880f4251391c88409159509e378724b32e57dac5.exe Token: SeIncreaseQuotaPrivilege 524 system.exe Token: SeSecurityPrivilege 524 system.exe Token: SeTakeOwnershipPrivilege 524 system.exe Token: SeLoadDriverPrivilege 524 system.exe Token: SeSystemProfilePrivilege 524 system.exe Token: SeSystemtimePrivilege 524 system.exe Token: SeProfSingleProcessPrivilege 524 system.exe Token: SeIncBasePriorityPrivilege 524 system.exe Token: SeCreatePagefilePrivilege 524 system.exe Token: SeBackupPrivilege 524 system.exe Token: SeRestorePrivilege 524 system.exe Token: SeShutdownPrivilege 524 system.exe Token: SeDebugPrivilege 524 system.exe Token: SeSystemEnvironmentPrivilege 524 system.exe Token: SeChangeNotifyPrivilege 524 system.exe Token: SeRemoteShutdownPrivilege 524 system.exe Token: SeUndockPrivilege 524 system.exe Token: SeManageVolumePrivilege 524 system.exe Token: SeImpersonatePrivilege 524 system.exe Token: SeCreateGlobalPrivilege 524 system.exe Token: 33 524 system.exe Token: 34 524 system.exe Token: 35 524 system.exe Token: SeIncreaseQuotaPrivilege 1912 iexplore.exe Token: SeSecurityPrivilege 1912 iexplore.exe Token: SeTakeOwnershipPrivilege 1912 iexplore.exe Token: SeLoadDriverPrivilege 1912 iexplore.exe Token: SeSystemProfilePrivilege 1912 iexplore.exe Token: SeSystemtimePrivilege 1912 iexplore.exe Token: SeProfSingleProcessPrivilege 1912 iexplore.exe Token: SeIncBasePriorityPrivilege 1912 iexplore.exe Token: SeCreatePagefilePrivilege 1912 iexplore.exe Token: SeBackupPrivilege 1912 iexplore.exe Token: SeRestorePrivilege 1912 iexplore.exe Token: SeShutdownPrivilege 1912 iexplore.exe Token: SeDebugPrivilege 1912 iexplore.exe Token: SeSystemEnvironmentPrivilege 1912 iexplore.exe Token: SeChangeNotifyPrivilege 1912 iexplore.exe Token: SeRemoteShutdownPrivilege 1912 iexplore.exe Token: SeUndockPrivilege 1912 iexplore.exe Token: SeManageVolumePrivilege 1912 iexplore.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
iexplore.exepid process 1912 iexplore.exe -
Suspicious use of WriteProcessMemory 10 IoCs
Processes:
cac92ba7a226d877c369403c880f4251391c88409159509e378724b32e57dac5.exesystem.exedescription pid process target process PID 1352 wrote to memory of 524 1352 cac92ba7a226d877c369403c880f4251391c88409159509e378724b32e57dac5.exe system.exe PID 1352 wrote to memory of 524 1352 cac92ba7a226d877c369403c880f4251391c88409159509e378724b32e57dac5.exe system.exe PID 1352 wrote to memory of 524 1352 cac92ba7a226d877c369403c880f4251391c88409159509e378724b32e57dac5.exe system.exe PID 1352 wrote to memory of 524 1352 cac92ba7a226d877c369403c880f4251391c88409159509e378724b32e57dac5.exe system.exe PID 524 wrote to memory of 1912 524 system.exe iexplore.exe PID 524 wrote to memory of 1912 524 system.exe iexplore.exe PID 524 wrote to memory of 1912 524 system.exe iexplore.exe PID 524 wrote to memory of 1912 524 system.exe iexplore.exe PID 524 wrote to memory of 1912 524 system.exe iexplore.exe PID 524 wrote to memory of 1912 524 system.exe iexplore.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\cac92ba7a226d877c369403c880f4251391c88409159509e378724b32e57dac5.exe"C:\Users\Admin\AppData\Local\Temp\cac92ba7a226d877c369403c880f4251391c88409159509e378724b32e57dac5.exe"1⤵
- Modifies WinLogon for persistence
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\system.exe"C:\Users\Admin\AppData\Local\Temp\system.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\iexplore.exe"C:\Program Files (x86)\Internet Explorer\iexplore.exe"3⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\system.exeFilesize
756KB
MD5861bd0deacbaa5ba7f5fe80f78d1f5b4
SHA159792a6b68904c29cf3baad77f033b64dcca3f5c
SHA256cac92ba7a226d877c369403c880f4251391c88409159509e378724b32e57dac5
SHA512d0766f0147e5a2f302cd4adf7be5c34c158b42f78de18ae8731d8274ce9a20cadbd568400953a5382c48780136795bb4f0483612c3ac149fecb9a4b51c09de91
-
C:\Users\Admin\AppData\Local\Temp\system.exeFilesize
756KB
MD5861bd0deacbaa5ba7f5fe80f78d1f5b4
SHA159792a6b68904c29cf3baad77f033b64dcca3f5c
SHA256cac92ba7a226d877c369403c880f4251391c88409159509e378724b32e57dac5
SHA512d0766f0147e5a2f302cd4adf7be5c34c158b42f78de18ae8731d8274ce9a20cadbd568400953a5382c48780136795bb4f0483612c3ac149fecb9a4b51c09de91
-
\Users\Admin\AppData\Local\Temp\system.exeFilesize
756KB
MD5861bd0deacbaa5ba7f5fe80f78d1f5b4
SHA159792a6b68904c29cf3baad77f033b64dcca3f5c
SHA256cac92ba7a226d877c369403c880f4251391c88409159509e378724b32e57dac5
SHA512d0766f0147e5a2f302cd4adf7be5c34c158b42f78de18ae8731d8274ce9a20cadbd568400953a5382c48780136795bb4f0483612c3ac149fecb9a4b51c09de91
-
\Users\Admin\AppData\Local\Temp\system.exeFilesize
756KB
MD5861bd0deacbaa5ba7f5fe80f78d1f5b4
SHA159792a6b68904c29cf3baad77f033b64dcca3f5c
SHA256cac92ba7a226d877c369403c880f4251391c88409159509e378724b32e57dac5
SHA512d0766f0147e5a2f302cd4adf7be5c34c158b42f78de18ae8731d8274ce9a20cadbd568400953a5382c48780136795bb4f0483612c3ac149fecb9a4b51c09de91
-
memory/524-57-0x0000000000000000-mapping.dmp
-
memory/1352-54-0x0000000075F51000-0x0000000075F53000-memory.dmpFilesize
8KB