Analysis
-
max time kernel
205s -
max time network
208s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
01-12-2022 06:11
Static task
static1
Behavioral task
behavioral1
Sample
24716fe5a1d2d5f9981444cf994191bf079ce985aff699062f7e7b3dc1644624.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
24716fe5a1d2d5f9981444cf994191bf079ce985aff699062f7e7b3dc1644624.exe
Resource
win10v2004-20220812-en
General
-
Target
24716fe5a1d2d5f9981444cf994191bf079ce985aff699062f7e7b3dc1644624.exe
-
Size
836KB
-
MD5
6f90f939b919550ee51d5c8d628cf6e3
-
SHA1
372d4f0fe47bd63c6df8a9cc785637126935ca87
-
SHA256
24716fe5a1d2d5f9981444cf994191bf079ce985aff699062f7e7b3dc1644624
-
SHA512
346296703898a8673555f4cffad0c2e00cee9495d56442744efee77aec70ed291df98859a08c848ab0f4eafd1fac7e21da31d70a20d80e766486402471ee93da
-
SSDEEP
24576:GcK0FPnmjaDqRTzhuMC1cwzrZttdIE9qOk2VMJGn:V+aDqXud1PZ69OHVR
Malware Config
Extracted
darkcomet
hard
gabrielzinho.no-ip.org:1604
DC_MUTEX-ZVWF6UW
-
InstallPath
MSDCSC\msdcsc.exe
-
gencode
aUYHsEtnsFw3
-
install
true
-
offline_keylogger
true
-
password
87080060abc
-
persistence
true
-
reg_key
MicroUpdate
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
Processes:
24716fe5a1d2d5f9981444cf994191bf079ce985aff699062f7e7b3dc1644624.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe" 24716fe5a1d2d5f9981444cf994191bf079ce985aff699062f7e7b3dc1644624.exe -
Executes dropped EXE 2 IoCs
Processes:
msdcsc.exemsdcsc.exepid process 2368 msdcsc.exe 2364 msdcsc.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
24716fe5a1d2d5f9981444cf994191bf079ce985aff699062f7e7b3dc1644624.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation 24716fe5a1d2d5f9981444cf994191bf079ce985aff699062f7e7b3dc1644624.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
24716fe5a1d2d5f9981444cf994191bf079ce985aff699062f7e7b3dc1644624.exemsdcsc.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Windows\\system32\\MSDCSC\\msdcsc.exe" 24716fe5a1d2d5f9981444cf994191bf079ce985aff699062f7e7b3dc1644624.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Windows\\system32\\MSDCSC\\msdcsc.exe" msdcsc.exe -
Drops file in System32 directory 4 IoCs
Processes:
24716fe5a1d2d5f9981444cf994191bf079ce985aff699062f7e7b3dc1644624.exemsdcsc.exedescription ioc process File opened for modification C:\Windows\SysWOW64\MSDCSC\ 24716fe5a1d2d5f9981444cf994191bf079ce985aff699062f7e7b3dc1644624.exe File opened for modification C:\Windows\SysWOW64\MSDCSC\msdcsc.exe msdcsc.exe File created C:\Windows\SysWOW64\MSDCSC\msdcsc.exe 24716fe5a1d2d5f9981444cf994191bf079ce985aff699062f7e7b3dc1644624.exe File opened for modification C:\Windows\SysWOW64\MSDCSC\msdcsc.exe 24716fe5a1d2d5f9981444cf994191bf079ce985aff699062f7e7b3dc1644624.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
24716fe5a1d2d5f9981444cf994191bf079ce985aff699062f7e7b3dc1644624.exemsdcsc.exedescription pid process target process PID 4800 set thread context of 3640 4800 24716fe5a1d2d5f9981444cf994191bf079ce985aff699062f7e7b3dc1644624.exe 24716fe5a1d2d5f9981444cf994191bf079ce985aff699062f7e7b3dc1644624.exe PID 2368 set thread context of 2364 2368 msdcsc.exe msdcsc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of AdjustPrivilegeToken 48 IoCs
Processes:
24716fe5a1d2d5f9981444cf994191bf079ce985aff699062f7e7b3dc1644624.exemsdcsc.exedescription pid process Token: SeIncreaseQuotaPrivilege 3640 24716fe5a1d2d5f9981444cf994191bf079ce985aff699062f7e7b3dc1644624.exe Token: SeSecurityPrivilege 3640 24716fe5a1d2d5f9981444cf994191bf079ce985aff699062f7e7b3dc1644624.exe Token: SeTakeOwnershipPrivilege 3640 24716fe5a1d2d5f9981444cf994191bf079ce985aff699062f7e7b3dc1644624.exe Token: SeLoadDriverPrivilege 3640 24716fe5a1d2d5f9981444cf994191bf079ce985aff699062f7e7b3dc1644624.exe Token: SeSystemProfilePrivilege 3640 24716fe5a1d2d5f9981444cf994191bf079ce985aff699062f7e7b3dc1644624.exe Token: SeSystemtimePrivilege 3640 24716fe5a1d2d5f9981444cf994191bf079ce985aff699062f7e7b3dc1644624.exe Token: SeProfSingleProcessPrivilege 3640 24716fe5a1d2d5f9981444cf994191bf079ce985aff699062f7e7b3dc1644624.exe Token: SeIncBasePriorityPrivilege 3640 24716fe5a1d2d5f9981444cf994191bf079ce985aff699062f7e7b3dc1644624.exe Token: SeCreatePagefilePrivilege 3640 24716fe5a1d2d5f9981444cf994191bf079ce985aff699062f7e7b3dc1644624.exe Token: SeBackupPrivilege 3640 24716fe5a1d2d5f9981444cf994191bf079ce985aff699062f7e7b3dc1644624.exe Token: SeRestorePrivilege 3640 24716fe5a1d2d5f9981444cf994191bf079ce985aff699062f7e7b3dc1644624.exe Token: SeShutdownPrivilege 3640 24716fe5a1d2d5f9981444cf994191bf079ce985aff699062f7e7b3dc1644624.exe Token: SeDebugPrivilege 3640 24716fe5a1d2d5f9981444cf994191bf079ce985aff699062f7e7b3dc1644624.exe Token: SeSystemEnvironmentPrivilege 3640 24716fe5a1d2d5f9981444cf994191bf079ce985aff699062f7e7b3dc1644624.exe Token: SeChangeNotifyPrivilege 3640 24716fe5a1d2d5f9981444cf994191bf079ce985aff699062f7e7b3dc1644624.exe Token: SeRemoteShutdownPrivilege 3640 24716fe5a1d2d5f9981444cf994191bf079ce985aff699062f7e7b3dc1644624.exe Token: SeUndockPrivilege 3640 24716fe5a1d2d5f9981444cf994191bf079ce985aff699062f7e7b3dc1644624.exe Token: SeManageVolumePrivilege 3640 24716fe5a1d2d5f9981444cf994191bf079ce985aff699062f7e7b3dc1644624.exe Token: SeImpersonatePrivilege 3640 24716fe5a1d2d5f9981444cf994191bf079ce985aff699062f7e7b3dc1644624.exe Token: SeCreateGlobalPrivilege 3640 24716fe5a1d2d5f9981444cf994191bf079ce985aff699062f7e7b3dc1644624.exe Token: 33 3640 24716fe5a1d2d5f9981444cf994191bf079ce985aff699062f7e7b3dc1644624.exe Token: 34 3640 24716fe5a1d2d5f9981444cf994191bf079ce985aff699062f7e7b3dc1644624.exe Token: 35 3640 24716fe5a1d2d5f9981444cf994191bf079ce985aff699062f7e7b3dc1644624.exe Token: 36 3640 24716fe5a1d2d5f9981444cf994191bf079ce985aff699062f7e7b3dc1644624.exe Token: SeIncreaseQuotaPrivilege 2364 msdcsc.exe Token: SeSecurityPrivilege 2364 msdcsc.exe Token: SeTakeOwnershipPrivilege 2364 msdcsc.exe Token: SeLoadDriverPrivilege 2364 msdcsc.exe Token: SeSystemProfilePrivilege 2364 msdcsc.exe Token: SeSystemtimePrivilege 2364 msdcsc.exe Token: SeProfSingleProcessPrivilege 2364 msdcsc.exe Token: SeIncBasePriorityPrivilege 2364 msdcsc.exe Token: SeCreatePagefilePrivilege 2364 msdcsc.exe Token: SeBackupPrivilege 2364 msdcsc.exe Token: SeRestorePrivilege 2364 msdcsc.exe Token: SeShutdownPrivilege 2364 msdcsc.exe Token: SeDebugPrivilege 2364 msdcsc.exe Token: SeSystemEnvironmentPrivilege 2364 msdcsc.exe Token: SeChangeNotifyPrivilege 2364 msdcsc.exe Token: SeRemoteShutdownPrivilege 2364 msdcsc.exe Token: SeUndockPrivilege 2364 msdcsc.exe Token: SeManageVolumePrivilege 2364 msdcsc.exe Token: SeImpersonatePrivilege 2364 msdcsc.exe Token: SeCreateGlobalPrivilege 2364 msdcsc.exe Token: 33 2364 msdcsc.exe Token: 34 2364 msdcsc.exe Token: 35 2364 msdcsc.exe Token: 36 2364 msdcsc.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
Processes:
24716fe5a1d2d5f9981444cf994191bf079ce985aff699062f7e7b3dc1644624.exemsdcsc.exemsdcsc.exepid process 4800 24716fe5a1d2d5f9981444cf994191bf079ce985aff699062f7e7b3dc1644624.exe 2368 msdcsc.exe 2364 msdcsc.exe -
Suspicious use of WriteProcessMemory 53 IoCs
Processes:
24716fe5a1d2d5f9981444cf994191bf079ce985aff699062f7e7b3dc1644624.exe24716fe5a1d2d5f9981444cf994191bf079ce985aff699062f7e7b3dc1644624.exemsdcsc.exemsdcsc.exedescription pid process target process PID 4800 wrote to memory of 3640 4800 24716fe5a1d2d5f9981444cf994191bf079ce985aff699062f7e7b3dc1644624.exe 24716fe5a1d2d5f9981444cf994191bf079ce985aff699062f7e7b3dc1644624.exe PID 4800 wrote to memory of 3640 4800 24716fe5a1d2d5f9981444cf994191bf079ce985aff699062f7e7b3dc1644624.exe 24716fe5a1d2d5f9981444cf994191bf079ce985aff699062f7e7b3dc1644624.exe PID 4800 wrote to memory of 3640 4800 24716fe5a1d2d5f9981444cf994191bf079ce985aff699062f7e7b3dc1644624.exe 24716fe5a1d2d5f9981444cf994191bf079ce985aff699062f7e7b3dc1644624.exe PID 4800 wrote to memory of 3640 4800 24716fe5a1d2d5f9981444cf994191bf079ce985aff699062f7e7b3dc1644624.exe 24716fe5a1d2d5f9981444cf994191bf079ce985aff699062f7e7b3dc1644624.exe PID 4800 wrote to memory of 3640 4800 24716fe5a1d2d5f9981444cf994191bf079ce985aff699062f7e7b3dc1644624.exe 24716fe5a1d2d5f9981444cf994191bf079ce985aff699062f7e7b3dc1644624.exe PID 4800 wrote to memory of 3640 4800 24716fe5a1d2d5f9981444cf994191bf079ce985aff699062f7e7b3dc1644624.exe 24716fe5a1d2d5f9981444cf994191bf079ce985aff699062f7e7b3dc1644624.exe PID 4800 wrote to memory of 3640 4800 24716fe5a1d2d5f9981444cf994191bf079ce985aff699062f7e7b3dc1644624.exe 24716fe5a1d2d5f9981444cf994191bf079ce985aff699062f7e7b3dc1644624.exe PID 4800 wrote to memory of 3640 4800 24716fe5a1d2d5f9981444cf994191bf079ce985aff699062f7e7b3dc1644624.exe 24716fe5a1d2d5f9981444cf994191bf079ce985aff699062f7e7b3dc1644624.exe PID 4800 wrote to memory of 3640 4800 24716fe5a1d2d5f9981444cf994191bf079ce985aff699062f7e7b3dc1644624.exe 24716fe5a1d2d5f9981444cf994191bf079ce985aff699062f7e7b3dc1644624.exe PID 4800 wrote to memory of 3640 4800 24716fe5a1d2d5f9981444cf994191bf079ce985aff699062f7e7b3dc1644624.exe 24716fe5a1d2d5f9981444cf994191bf079ce985aff699062f7e7b3dc1644624.exe PID 4800 wrote to memory of 3640 4800 24716fe5a1d2d5f9981444cf994191bf079ce985aff699062f7e7b3dc1644624.exe 24716fe5a1d2d5f9981444cf994191bf079ce985aff699062f7e7b3dc1644624.exe PID 4800 wrote to memory of 3640 4800 24716fe5a1d2d5f9981444cf994191bf079ce985aff699062f7e7b3dc1644624.exe 24716fe5a1d2d5f9981444cf994191bf079ce985aff699062f7e7b3dc1644624.exe PID 4800 wrote to memory of 3640 4800 24716fe5a1d2d5f9981444cf994191bf079ce985aff699062f7e7b3dc1644624.exe 24716fe5a1d2d5f9981444cf994191bf079ce985aff699062f7e7b3dc1644624.exe PID 4800 wrote to memory of 3640 4800 24716fe5a1d2d5f9981444cf994191bf079ce985aff699062f7e7b3dc1644624.exe 24716fe5a1d2d5f9981444cf994191bf079ce985aff699062f7e7b3dc1644624.exe PID 3640 wrote to memory of 2368 3640 24716fe5a1d2d5f9981444cf994191bf079ce985aff699062f7e7b3dc1644624.exe msdcsc.exe PID 3640 wrote to memory of 2368 3640 24716fe5a1d2d5f9981444cf994191bf079ce985aff699062f7e7b3dc1644624.exe msdcsc.exe PID 3640 wrote to memory of 2368 3640 24716fe5a1d2d5f9981444cf994191bf079ce985aff699062f7e7b3dc1644624.exe msdcsc.exe PID 2368 wrote to memory of 2364 2368 msdcsc.exe msdcsc.exe PID 2368 wrote to memory of 2364 2368 msdcsc.exe msdcsc.exe PID 2368 wrote to memory of 2364 2368 msdcsc.exe msdcsc.exe PID 2368 wrote to memory of 2364 2368 msdcsc.exe msdcsc.exe PID 2368 wrote to memory of 2364 2368 msdcsc.exe msdcsc.exe PID 2368 wrote to memory of 2364 2368 msdcsc.exe msdcsc.exe PID 2368 wrote to memory of 2364 2368 msdcsc.exe msdcsc.exe PID 2368 wrote to memory of 2364 2368 msdcsc.exe msdcsc.exe PID 2368 wrote to memory of 2364 2368 msdcsc.exe msdcsc.exe PID 2368 wrote to memory of 2364 2368 msdcsc.exe msdcsc.exe PID 2368 wrote to memory of 2364 2368 msdcsc.exe msdcsc.exe PID 2368 wrote to memory of 2364 2368 msdcsc.exe msdcsc.exe PID 2368 wrote to memory of 2364 2368 msdcsc.exe msdcsc.exe PID 2368 wrote to memory of 2364 2368 msdcsc.exe msdcsc.exe PID 2364 wrote to memory of 4160 2364 msdcsc.exe notepad.exe PID 2364 wrote to memory of 4160 2364 msdcsc.exe notepad.exe PID 2364 wrote to memory of 4160 2364 msdcsc.exe notepad.exe PID 2364 wrote to memory of 4160 2364 msdcsc.exe notepad.exe PID 2364 wrote to memory of 4160 2364 msdcsc.exe notepad.exe PID 2364 wrote to memory of 4160 2364 msdcsc.exe notepad.exe PID 2364 wrote to memory of 4160 2364 msdcsc.exe notepad.exe PID 2364 wrote to memory of 4160 2364 msdcsc.exe notepad.exe PID 2364 wrote to memory of 4160 2364 msdcsc.exe notepad.exe PID 2364 wrote to memory of 4160 2364 msdcsc.exe notepad.exe PID 2364 wrote to memory of 4160 2364 msdcsc.exe notepad.exe PID 2364 wrote to memory of 4160 2364 msdcsc.exe notepad.exe PID 2364 wrote to memory of 4160 2364 msdcsc.exe notepad.exe PID 2364 wrote to memory of 4160 2364 msdcsc.exe notepad.exe PID 2364 wrote to memory of 4160 2364 msdcsc.exe notepad.exe PID 2364 wrote to memory of 4160 2364 msdcsc.exe notepad.exe PID 2364 wrote to memory of 4160 2364 msdcsc.exe notepad.exe PID 2364 wrote to memory of 4160 2364 msdcsc.exe notepad.exe PID 2364 wrote to memory of 4160 2364 msdcsc.exe notepad.exe PID 2364 wrote to memory of 4160 2364 msdcsc.exe notepad.exe PID 2364 wrote to memory of 4160 2364 msdcsc.exe notepad.exe PID 2364 wrote to memory of 4160 2364 msdcsc.exe notepad.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\24716fe5a1d2d5f9981444cf994191bf079ce985aff699062f7e7b3dc1644624.exe"C:\Users\Admin\AppData\Local\Temp\24716fe5a1d2d5f9981444cf994191bf079ce985aff699062f7e7b3dc1644624.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\24716fe5a1d2d5f9981444cf994191bf079ce985aff699062f7e7b3dc1644624.exe"C:\Users\Admin\AppData\Local\Temp\24716fe5a1d2d5f9981444cf994191bf079ce985aff699062f7e7b3dc1644624.exe"2⤵
- Modifies WinLogon for persistence
- Checks computer location settings
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\MSDCSC\msdcsc.exe"C:\Windows\system32\MSDCSC\msdcsc.exe"3⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\MSDCSC\msdcsc.exe"C:\Windows\SysWOW64\MSDCSC\msdcsc.exe"4⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\notepad.exenotepad5⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-2629973501-4017243118-3254762364-1000\699c4b9cdebca7aaea5193cae8a50098_e32e1c79-b88e-4709-94fb-81034ca3398eFilesize
50B
MD55b63d4dd8c04c88c0e30e494ec6a609a
SHA1884d5a8bdc25fe794dc22ef9518009dcf0069d09
SHA2564d93c22555b3169e5c13716ca59b8b22892c69b3025aea841afe5259698102fd
SHA51215ff8551ac6b9de978050569bcdc26f44dfc06a0eaf445ac70fd45453a21bdafa3e4c8b4857d6a1c3226f4102a639682bdfb71d7b255062fb81a51c9126896cb
-
C:\Windows\SysWOW64\MSDCSC\msdcsc.exeFilesize
836KB
MD56f90f939b919550ee51d5c8d628cf6e3
SHA1372d4f0fe47bd63c6df8a9cc785637126935ca87
SHA25624716fe5a1d2d5f9981444cf994191bf079ce985aff699062f7e7b3dc1644624
SHA512346296703898a8673555f4cffad0c2e00cee9495d56442744efee77aec70ed291df98859a08c848ab0f4eafd1fac7e21da31d70a20d80e766486402471ee93da
-
C:\Windows\SysWOW64\MSDCSC\msdcsc.exeFilesize
836KB
MD56f90f939b919550ee51d5c8d628cf6e3
SHA1372d4f0fe47bd63c6df8a9cc785637126935ca87
SHA25624716fe5a1d2d5f9981444cf994191bf079ce985aff699062f7e7b3dc1644624
SHA512346296703898a8673555f4cffad0c2e00cee9495d56442744efee77aec70ed291df98859a08c848ab0f4eafd1fac7e21da31d70a20d80e766486402471ee93da
-
C:\Windows\SysWOW64\MSDCSC\msdcsc.exeFilesize
836KB
MD56f90f939b919550ee51d5c8d628cf6e3
SHA1372d4f0fe47bd63c6df8a9cc785637126935ca87
SHA25624716fe5a1d2d5f9981444cf994191bf079ce985aff699062f7e7b3dc1644624
SHA512346296703898a8673555f4cffad0c2e00cee9495d56442744efee77aec70ed291df98859a08c848ab0f4eafd1fac7e21da31d70a20d80e766486402471ee93da
-
memory/2364-145-0x0000000000000000-mapping.dmp
-
memory/2364-150-0x0000000000400000-0x00000000004CA000-memory.dmpFilesize
808KB
-
memory/2368-139-0x0000000000000000-mapping.dmp
-
memory/3640-138-0x0000000000400000-0x00000000004CA000-memory.dmpFilesize
808KB
-
memory/3640-137-0x0000000000400000-0x00000000004CA000-memory.dmpFilesize
808KB
-
memory/3640-135-0x0000000000400000-0x00000000004CA000-memory.dmpFilesize
808KB
-
memory/3640-134-0x0000000000000000-mapping.dmp
-
memory/3640-136-0x0000000000400000-0x00000000004CA000-memory.dmpFilesize
808KB
-
memory/3640-151-0x0000000000400000-0x00000000004CA000-memory.dmpFilesize
808KB
-
memory/4160-152-0x0000000000000000-mapping.dmp