Analysis
-
max time kernel
151s -
max time network
170s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
01-12-2022 10:03
Behavioral task
behavioral1
Sample
45f86cc0ed0de5f415a780debfbed189cef5baf07276af805e16513a5c4ccbae.exe
Resource
win7-20221111-en
General
-
Target
45f86cc0ed0de5f415a780debfbed189cef5baf07276af805e16513a5c4ccbae.exe
-
Size
660KB
-
MD5
0092838bfe137c5b3cb81384cc752a10
-
SHA1
58135f256464a3b4fc82473244f45da8dadd0048
-
SHA256
45f86cc0ed0de5f415a780debfbed189cef5baf07276af805e16513a5c4ccbae
-
SHA512
452aa9eab9363ce4cc0d763632389496905aa46def3d2338831175d6a90f1466bf96914b759b18892e00933db6b83bcbdae266f515bf6259ce88905784323155
-
SSDEEP
12288:0XhpvNWw276S/DuoeFcfbmiJ99VPhYR5MTSHvLenELrWv1lZw4JuMkMh/fy452UG:inAw2WWeFcfbP9VPSPMTSPL/rWvzq4JW
Malware Config
Extracted
darkcomet
Tim
trollo.zapto.org:1605
DC_MUTEX-4CC7RLB
-
InstallPath
svhost\svhost.exe
-
gencode
iKWKGxcC6jL6
-
install
true
-
offline_keylogger
true
-
persistence
false
-
reg_key
svhost
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
Processes:
45f86cc0ed0de5f415a780debfbed189cef5baf07276af805e16513a5c4ccbae.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Users\\Admin\\AppData\\Local\\Temp\\svhost\\svhost.exe" 45f86cc0ed0de5f415a780debfbed189cef5baf07276af805e16513a5c4ccbae.exe -
Modifies firewall policy service 2 TTPs 3 IoCs
Processes:
svhost.exedescription ioc process Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile svhost.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" svhost.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "0" svhost.exe -
Modifies security service 2 TTPs 1 IoCs
Processes:
svhost.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wscsvc\Start = "4" svhost.exe -
Processes:
svhost.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" svhost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" svhost.exe -
Disables RegEdit via registry modification 1 IoCs
Processes:
svhost.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" svhost.exe -
Executes dropped EXE 1 IoCs
Processes:
svhost.exepid process 4892 svhost.exe -
Sets file to hidden 1 TTPs 2 IoCs
Modifies file attributes to stop it showing in Explorer etc.
Processes:
attrib.exeattrib.exepid process 4956 attrib.exe 4980 attrib.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
45f86cc0ed0de5f415a780debfbed189cef5baf07276af805e16513a5c4ccbae.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation 45f86cc0ed0de5f415a780debfbed189cef5baf07276af805e16513a5c4ccbae.exe -
Processes:
svhost.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" svhost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" svhost.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
45f86cc0ed0de5f415a780debfbed189cef5baf07276af805e16513a5c4ccbae.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\svhost = "C:\\Users\\Admin\\AppData\\Local\\Temp\\svhost\\svhost.exe" 45f86cc0ed0de5f415a780debfbed189cef5baf07276af805e16513a5c4ccbae.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Modifies registry class 1 IoCs
Processes:
45f86cc0ed0de5f415a780debfbed189cef5baf07276af805e16513a5c4ccbae.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ 45f86cc0ed0de5f415a780debfbed189cef5baf07276af805e16513a5c4ccbae.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
svhost.exepid process 4892 svhost.exe -
Suspicious use of AdjustPrivilegeToken 48 IoCs
Processes:
45f86cc0ed0de5f415a780debfbed189cef5baf07276af805e16513a5c4ccbae.exesvhost.exedescription pid process Token: SeIncreaseQuotaPrivilege 4768 45f86cc0ed0de5f415a780debfbed189cef5baf07276af805e16513a5c4ccbae.exe Token: SeSecurityPrivilege 4768 45f86cc0ed0de5f415a780debfbed189cef5baf07276af805e16513a5c4ccbae.exe Token: SeTakeOwnershipPrivilege 4768 45f86cc0ed0de5f415a780debfbed189cef5baf07276af805e16513a5c4ccbae.exe Token: SeLoadDriverPrivilege 4768 45f86cc0ed0de5f415a780debfbed189cef5baf07276af805e16513a5c4ccbae.exe Token: SeSystemProfilePrivilege 4768 45f86cc0ed0de5f415a780debfbed189cef5baf07276af805e16513a5c4ccbae.exe Token: SeSystemtimePrivilege 4768 45f86cc0ed0de5f415a780debfbed189cef5baf07276af805e16513a5c4ccbae.exe Token: SeProfSingleProcessPrivilege 4768 45f86cc0ed0de5f415a780debfbed189cef5baf07276af805e16513a5c4ccbae.exe Token: SeIncBasePriorityPrivilege 4768 45f86cc0ed0de5f415a780debfbed189cef5baf07276af805e16513a5c4ccbae.exe Token: SeCreatePagefilePrivilege 4768 45f86cc0ed0de5f415a780debfbed189cef5baf07276af805e16513a5c4ccbae.exe Token: SeBackupPrivilege 4768 45f86cc0ed0de5f415a780debfbed189cef5baf07276af805e16513a5c4ccbae.exe Token: SeRestorePrivilege 4768 45f86cc0ed0de5f415a780debfbed189cef5baf07276af805e16513a5c4ccbae.exe Token: SeShutdownPrivilege 4768 45f86cc0ed0de5f415a780debfbed189cef5baf07276af805e16513a5c4ccbae.exe Token: SeDebugPrivilege 4768 45f86cc0ed0de5f415a780debfbed189cef5baf07276af805e16513a5c4ccbae.exe Token: SeSystemEnvironmentPrivilege 4768 45f86cc0ed0de5f415a780debfbed189cef5baf07276af805e16513a5c4ccbae.exe Token: SeChangeNotifyPrivilege 4768 45f86cc0ed0de5f415a780debfbed189cef5baf07276af805e16513a5c4ccbae.exe Token: SeRemoteShutdownPrivilege 4768 45f86cc0ed0de5f415a780debfbed189cef5baf07276af805e16513a5c4ccbae.exe Token: SeUndockPrivilege 4768 45f86cc0ed0de5f415a780debfbed189cef5baf07276af805e16513a5c4ccbae.exe Token: SeManageVolumePrivilege 4768 45f86cc0ed0de5f415a780debfbed189cef5baf07276af805e16513a5c4ccbae.exe Token: SeImpersonatePrivilege 4768 45f86cc0ed0de5f415a780debfbed189cef5baf07276af805e16513a5c4ccbae.exe Token: SeCreateGlobalPrivilege 4768 45f86cc0ed0de5f415a780debfbed189cef5baf07276af805e16513a5c4ccbae.exe Token: 33 4768 45f86cc0ed0de5f415a780debfbed189cef5baf07276af805e16513a5c4ccbae.exe Token: 34 4768 45f86cc0ed0de5f415a780debfbed189cef5baf07276af805e16513a5c4ccbae.exe Token: 35 4768 45f86cc0ed0de5f415a780debfbed189cef5baf07276af805e16513a5c4ccbae.exe Token: 36 4768 45f86cc0ed0de5f415a780debfbed189cef5baf07276af805e16513a5c4ccbae.exe Token: SeIncreaseQuotaPrivilege 4892 svhost.exe Token: SeSecurityPrivilege 4892 svhost.exe Token: SeTakeOwnershipPrivilege 4892 svhost.exe Token: SeLoadDriverPrivilege 4892 svhost.exe Token: SeSystemProfilePrivilege 4892 svhost.exe Token: SeSystemtimePrivilege 4892 svhost.exe Token: SeProfSingleProcessPrivilege 4892 svhost.exe Token: SeIncBasePriorityPrivilege 4892 svhost.exe Token: SeCreatePagefilePrivilege 4892 svhost.exe Token: SeBackupPrivilege 4892 svhost.exe Token: SeRestorePrivilege 4892 svhost.exe Token: SeShutdownPrivilege 4892 svhost.exe Token: SeDebugPrivilege 4892 svhost.exe Token: SeSystemEnvironmentPrivilege 4892 svhost.exe Token: SeChangeNotifyPrivilege 4892 svhost.exe Token: SeRemoteShutdownPrivilege 4892 svhost.exe Token: SeUndockPrivilege 4892 svhost.exe Token: SeManageVolumePrivilege 4892 svhost.exe Token: SeImpersonatePrivilege 4892 svhost.exe Token: SeCreateGlobalPrivilege 4892 svhost.exe Token: 33 4892 svhost.exe Token: 34 4892 svhost.exe Token: 35 4892 svhost.exe Token: 36 4892 svhost.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
svhost.exepid process 4892 svhost.exe -
Suspicious use of WriteProcessMemory 37 IoCs
Processes:
45f86cc0ed0de5f415a780debfbed189cef5baf07276af805e16513a5c4ccbae.execmd.execmd.exesvhost.exedescription pid process target process PID 4768 wrote to memory of 2928 4768 45f86cc0ed0de5f415a780debfbed189cef5baf07276af805e16513a5c4ccbae.exe cmd.exe PID 4768 wrote to memory of 2928 4768 45f86cc0ed0de5f415a780debfbed189cef5baf07276af805e16513a5c4ccbae.exe cmd.exe PID 4768 wrote to memory of 2928 4768 45f86cc0ed0de5f415a780debfbed189cef5baf07276af805e16513a5c4ccbae.exe cmd.exe PID 4768 wrote to memory of 4460 4768 45f86cc0ed0de5f415a780debfbed189cef5baf07276af805e16513a5c4ccbae.exe cmd.exe PID 4768 wrote to memory of 4460 4768 45f86cc0ed0de5f415a780debfbed189cef5baf07276af805e16513a5c4ccbae.exe cmd.exe PID 4768 wrote to memory of 4460 4768 45f86cc0ed0de5f415a780debfbed189cef5baf07276af805e16513a5c4ccbae.exe cmd.exe PID 2928 wrote to memory of 4956 2928 cmd.exe attrib.exe PID 2928 wrote to memory of 4956 2928 cmd.exe attrib.exe PID 2928 wrote to memory of 4956 2928 cmd.exe attrib.exe PID 4460 wrote to memory of 4980 4460 cmd.exe attrib.exe PID 4460 wrote to memory of 4980 4460 cmd.exe attrib.exe PID 4460 wrote to memory of 4980 4460 cmd.exe attrib.exe PID 4768 wrote to memory of 4892 4768 45f86cc0ed0de5f415a780debfbed189cef5baf07276af805e16513a5c4ccbae.exe svhost.exe PID 4768 wrote to memory of 4892 4768 45f86cc0ed0de5f415a780debfbed189cef5baf07276af805e16513a5c4ccbae.exe svhost.exe PID 4768 wrote to memory of 4892 4768 45f86cc0ed0de5f415a780debfbed189cef5baf07276af805e16513a5c4ccbae.exe svhost.exe PID 4892 wrote to memory of 3584 4892 svhost.exe notepad.exe PID 4892 wrote to memory of 3584 4892 svhost.exe notepad.exe PID 4892 wrote to memory of 3584 4892 svhost.exe notepad.exe PID 4892 wrote to memory of 3584 4892 svhost.exe notepad.exe PID 4892 wrote to memory of 3584 4892 svhost.exe notepad.exe PID 4892 wrote to memory of 3584 4892 svhost.exe notepad.exe PID 4892 wrote to memory of 3584 4892 svhost.exe notepad.exe PID 4892 wrote to memory of 3584 4892 svhost.exe notepad.exe PID 4892 wrote to memory of 3584 4892 svhost.exe notepad.exe PID 4892 wrote to memory of 3584 4892 svhost.exe notepad.exe PID 4892 wrote to memory of 3584 4892 svhost.exe notepad.exe PID 4892 wrote to memory of 3584 4892 svhost.exe notepad.exe PID 4892 wrote to memory of 3584 4892 svhost.exe notepad.exe PID 4892 wrote to memory of 3584 4892 svhost.exe notepad.exe PID 4892 wrote to memory of 3584 4892 svhost.exe notepad.exe PID 4892 wrote to memory of 3584 4892 svhost.exe notepad.exe PID 4892 wrote to memory of 3584 4892 svhost.exe notepad.exe PID 4892 wrote to memory of 3584 4892 svhost.exe notepad.exe PID 4892 wrote to memory of 3584 4892 svhost.exe notepad.exe PID 4892 wrote to memory of 3584 4892 svhost.exe notepad.exe PID 4892 wrote to memory of 3584 4892 svhost.exe notepad.exe PID 4892 wrote to memory of 3584 4892 svhost.exe notepad.exe -
Views/modifies file attributes 1 TTPs 2 IoCs
Processes:
attrib.exeattrib.exepid process 4956 attrib.exe 4980 attrib.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\45f86cc0ed0de5f415a780debfbed189cef5baf07276af805e16513a5c4ccbae.exe"C:\Users\Admin\AppData\Local\Temp\45f86cc0ed0de5f415a780debfbed189cef5baf07276af805e16513a5c4ccbae.exe"1⤵
- Modifies WinLogon for persistence
- Checks computer location settings
- Adds Run key to start application
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp\45f86cc0ed0de5f415a780debfbed189cef5baf07276af805e16513a5c4ccbae.exe" +s +h2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Users\Admin\AppData\Local\Temp\45f86cc0ed0de5f415a780debfbed189cef5baf07276af805e16513a5c4ccbae.exe" +s +h3⤵
- Sets file to hidden
- Views/modifies file attributes
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp" +s +h2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Users\Admin\AppData\Local\Temp" +s +h3⤵
- Sets file to hidden
- Views/modifies file attributes
-
C:\Users\Admin\AppData\Local\Temp\svhost\svhost.exe"C:\Users\Admin\AppData\Local\Temp\svhost\svhost.exe"2⤵
- Modifies firewall policy service
- Modifies security service
- Windows security bypass
- Disables RegEdit via registry modification
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\notepad.exenotepad3⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\svhost\svhost.exeFilesize
660KB
MD50092838bfe137c5b3cb81384cc752a10
SHA158135f256464a3b4fc82473244f45da8dadd0048
SHA25645f86cc0ed0de5f415a780debfbed189cef5baf07276af805e16513a5c4ccbae
SHA512452aa9eab9363ce4cc0d763632389496905aa46def3d2338831175d6a90f1466bf96914b759b18892e00933db6b83bcbdae266f515bf6259ce88905784323155
-
C:\Users\Admin\AppData\Local\Temp\svhost\svhost.exeFilesize
660KB
MD50092838bfe137c5b3cb81384cc752a10
SHA158135f256464a3b4fc82473244f45da8dadd0048
SHA25645f86cc0ed0de5f415a780debfbed189cef5baf07276af805e16513a5c4ccbae
SHA512452aa9eab9363ce4cc0d763632389496905aa46def3d2338831175d6a90f1466bf96914b759b18892e00933db6b83bcbdae266f515bf6259ce88905784323155
-
memory/2928-132-0x0000000000000000-mapping.dmp
-
memory/3584-139-0x0000000000000000-mapping.dmp
-
memory/4460-133-0x0000000000000000-mapping.dmp
-
memory/4892-136-0x0000000000000000-mapping.dmp
-
memory/4956-134-0x0000000000000000-mapping.dmp
-
memory/4980-135-0x0000000000000000-mapping.dmp