Analysis
-
max time kernel
152s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
30-11-2022 22:07
Static task
static1
Behavioral task
behavioral1
Sample
045595a4493dc26842880460683d89cf44b87c4bcaa1d77ad671784aec5bd97f.exe
Resource
win7-20220812-en
General
-
Target
045595a4493dc26842880460683d89cf44b87c4bcaa1d77ad671784aec5bd97f.exe
-
Size
632KB
-
MD5
745ec1ff9dbb12e8a8f64e7d0404e329
-
SHA1
9b0c22b8cef19baf9217efdae81998c848165bd4
-
SHA256
045595a4493dc26842880460683d89cf44b87c4bcaa1d77ad671784aec5bd97f
-
SHA512
927f624f4088cdc0d26978a38fc70934bd7e00b22239d4677f98540a12ac34d3d827cdddcd05e77221788ed0050d0dd0ecbe3508497c5af35f56ed14f73125f0
-
SSDEEP
12288:4Shz5IBcIcxbzPSQoj8sAxu3ArRnyO6vj+4SwD4:Fz5i4x2j8hxLr09jru
Malware Config
Extracted
darkcomet
settings5
soxprox1979.zapto.org:1604
DCMIN_MUTEX-79J7P3V
-
gencode
855v2ncQdoa5
-
install
false
-
offline_keylogger
true
-
persistence
false
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
1204dcttsvc.exepid process 4648 1204dcttsvc.exe -
Processes:
resource yara_rule behavioral2/memory/4648-135-0x0000000000400000-0x00000000004B7000-memory.dmp upx behavioral2/memory/4648-138-0x0000000000400000-0x00000000004B7000-memory.dmp upx behavioral2/memory/4648-139-0x0000000000400000-0x00000000004B7000-memory.dmp upx behavioral2/memory/4648-141-0x0000000000400000-0x00000000004B7000-memory.dmp upx behavioral2/memory/4648-142-0x0000000000400000-0x00000000004B7000-memory.dmp upx behavioral2/memory/4648-143-0x0000000000400000-0x00000000004B7000-memory.dmp upx behavioral2/memory/4648-144-0x0000000000400000-0x00000000004B7000-memory.dmp upx -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
045595a4493dc26842880460683d89cf44b87c4bcaa1d77ad671784aec5bd97f.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\FacbookUpdate = "C:\\Users\\Admin\\AppData\\Roaming\\FacbookUpdate.exe" 045595a4493dc26842880460683d89cf44b87c4bcaa1d77ad671784aec5bd97f.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
045595a4493dc26842880460683d89cf44b87c4bcaa1d77ad671784aec5bd97f.exedescription pid process target process PID 4772 set thread context of 4648 4772 045595a4493dc26842880460683d89cf44b87c4bcaa1d77ad671784aec5bd97f.exe 1204dcttsvc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
045595a4493dc26842880460683d89cf44b87c4bcaa1d77ad671784aec5bd97f.exepid process 4772 045595a4493dc26842880460683d89cf44b87c4bcaa1d77ad671784aec5bd97f.exe -
Suspicious use of AdjustPrivilegeToken 25 IoCs
Processes:
045595a4493dc26842880460683d89cf44b87c4bcaa1d77ad671784aec5bd97f.exe1204dcttsvc.exedescription pid process Token: SeDebugPrivilege 4772 045595a4493dc26842880460683d89cf44b87c4bcaa1d77ad671784aec5bd97f.exe Token: SeIncreaseQuotaPrivilege 4648 1204dcttsvc.exe Token: SeSecurityPrivilege 4648 1204dcttsvc.exe Token: SeTakeOwnershipPrivilege 4648 1204dcttsvc.exe Token: SeLoadDriverPrivilege 4648 1204dcttsvc.exe Token: SeSystemProfilePrivilege 4648 1204dcttsvc.exe Token: SeSystemtimePrivilege 4648 1204dcttsvc.exe Token: SeProfSingleProcessPrivilege 4648 1204dcttsvc.exe Token: SeIncBasePriorityPrivilege 4648 1204dcttsvc.exe Token: SeCreatePagefilePrivilege 4648 1204dcttsvc.exe Token: SeBackupPrivilege 4648 1204dcttsvc.exe Token: SeRestorePrivilege 4648 1204dcttsvc.exe Token: SeShutdownPrivilege 4648 1204dcttsvc.exe Token: SeDebugPrivilege 4648 1204dcttsvc.exe Token: SeSystemEnvironmentPrivilege 4648 1204dcttsvc.exe Token: SeChangeNotifyPrivilege 4648 1204dcttsvc.exe Token: SeRemoteShutdownPrivilege 4648 1204dcttsvc.exe Token: SeUndockPrivilege 4648 1204dcttsvc.exe Token: SeManageVolumePrivilege 4648 1204dcttsvc.exe Token: SeImpersonatePrivilege 4648 1204dcttsvc.exe Token: SeCreateGlobalPrivilege 4648 1204dcttsvc.exe Token: 33 4648 1204dcttsvc.exe Token: 34 4648 1204dcttsvc.exe Token: 35 4648 1204dcttsvc.exe Token: 36 4648 1204dcttsvc.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
1204dcttsvc.exepid process 4648 1204dcttsvc.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
045595a4493dc26842880460683d89cf44b87c4bcaa1d77ad671784aec5bd97f.exedescription pid process target process PID 4772 wrote to memory of 4648 4772 045595a4493dc26842880460683d89cf44b87c4bcaa1d77ad671784aec5bd97f.exe 1204dcttsvc.exe PID 4772 wrote to memory of 4648 4772 045595a4493dc26842880460683d89cf44b87c4bcaa1d77ad671784aec5bd97f.exe 1204dcttsvc.exe PID 4772 wrote to memory of 4648 4772 045595a4493dc26842880460683d89cf44b87c4bcaa1d77ad671784aec5bd97f.exe 1204dcttsvc.exe PID 4772 wrote to memory of 4648 4772 045595a4493dc26842880460683d89cf44b87c4bcaa1d77ad671784aec5bd97f.exe 1204dcttsvc.exe PID 4772 wrote to memory of 4648 4772 045595a4493dc26842880460683d89cf44b87c4bcaa1d77ad671784aec5bd97f.exe 1204dcttsvc.exe PID 4772 wrote to memory of 4648 4772 045595a4493dc26842880460683d89cf44b87c4bcaa1d77ad671784aec5bd97f.exe 1204dcttsvc.exe PID 4772 wrote to memory of 4648 4772 045595a4493dc26842880460683d89cf44b87c4bcaa1d77ad671784aec5bd97f.exe 1204dcttsvc.exe PID 4772 wrote to memory of 4648 4772 045595a4493dc26842880460683d89cf44b87c4bcaa1d77ad671784aec5bd97f.exe 1204dcttsvc.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\045595a4493dc26842880460683d89cf44b87c4bcaa1d77ad671784aec5bd97f.exe"C:\Users\Admin\AppData\Local\Temp\045595a4493dc26842880460683d89cf44b87c4bcaa1d77ad671784aec5bd97f.exe"1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\AppLaunch\1204dcttsvc.exeC:\Users\Admin\AppData\Local\Temp\\AppLaunch\1204dcttsvc.exe2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\AppLaunch\1204dcttsvc.exeFilesize
1.1MB
MD5d881de17aa8f2e2c08cbb7b265f928f9
SHA108936aebc87decf0af6e8eada191062b5e65ac2a
SHA256b3a37093609f9a20ad60b85a9fa9de2ba674cba9b5bd687729440c70ba619ca0
SHA5125f23bfb1b8740247b36ed0ab741738c7d4c949736129e767213e321607d1ccd3e3a8428e4ba44bd28a275b5e3f6206285b1a522514b7ef7ea5e698d90a713d34
-
C:\Users\Admin\AppData\Local\Temp\AppLaunch\1204dcttsvc.exeFilesize
1.1MB
MD5d881de17aa8f2e2c08cbb7b265f928f9
SHA108936aebc87decf0af6e8eada191062b5e65ac2a
SHA256b3a37093609f9a20ad60b85a9fa9de2ba674cba9b5bd687729440c70ba619ca0
SHA5125f23bfb1b8740247b36ed0ab741738c7d4c949736129e767213e321607d1ccd3e3a8428e4ba44bd28a275b5e3f6206285b1a522514b7ef7ea5e698d90a713d34
-
memory/4648-134-0x0000000000000000-mapping.dmp
-
memory/4648-135-0x0000000000400000-0x00000000004B7000-memory.dmpFilesize
732KB
-
memory/4648-138-0x0000000000400000-0x00000000004B7000-memory.dmpFilesize
732KB
-
memory/4648-139-0x0000000000400000-0x00000000004B7000-memory.dmpFilesize
732KB
-
memory/4648-141-0x0000000000400000-0x00000000004B7000-memory.dmpFilesize
732KB
-
memory/4648-142-0x0000000000400000-0x00000000004B7000-memory.dmpFilesize
732KB
-
memory/4648-143-0x0000000000400000-0x00000000004B7000-memory.dmpFilesize
732KB
-
memory/4648-144-0x0000000000400000-0x00000000004B7000-memory.dmpFilesize
732KB
-
memory/4772-132-0x0000000074EC0000-0x0000000075471000-memory.dmpFilesize
5.7MB
-
memory/4772-133-0x0000000074EC0000-0x0000000075471000-memory.dmpFilesize
5.7MB