Analysis
-
max time kernel
155s -
max time network
31s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
02-12-2022 21:52
Static task
static1
Behavioral task
behavioral1
Sample
c9d9ff232e23f1e7231a091c86955c070caf3002553713a9c3ff41d4eba37f07.exe
Resource
win7-20221111-en
General
-
Target
c9d9ff232e23f1e7231a091c86955c070caf3002553713a9c3ff41d4eba37f07.exe
-
Size
596KB
-
MD5
82b6847860a2fb6ae84badda650bec3c
-
SHA1
fee9fcad16bef3b27a37696aa9d52bf5add80a6d
-
SHA256
c9d9ff232e23f1e7231a091c86955c070caf3002553713a9c3ff41d4eba37f07
-
SHA512
2d55988f51f0e1cf4c7f85020ac6f21c37dcf5846295541db98eee4acf2b7a1c70a3f5da1dbc75feeaf2f0105e0525d2d57ecaf0b8db4196dcc2c2c3dd209b7b
-
SSDEEP
12288:6Fc1GUux1KgyM+23XN+GzKyUcAn21+srdO4gAblgKLsfPCPTPC:6Fc18v+2nN+3ytAnDwiKLEeTK
Malware Config
Extracted
darkcomet
Guest16
127.0.0.1:1604
DC_MUTEX-0PRSAK8
-
gencode
AU83b2dyG2P1
-
install
false
-
offline_keylogger
true
-
persistence
false
Signatures
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
c9d9ff232e23f1e7231a091c86955c070caf3002553713a9c3ff41d4eba37f07.exedescription pid process target process PID 1156 set thread context of 1216 1156 c9d9ff232e23f1e7231a091c86955c070caf3002553713a9c3ff41d4eba37f07.exe c9d9ff232e23f1e7231a091c86955c070caf3002553713a9c3ff41d4eba37f07.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of AdjustPrivilegeToken 23 IoCs
Processes:
c9d9ff232e23f1e7231a091c86955c070caf3002553713a9c3ff41d4eba37f07.exedescription pid process Token: SeIncreaseQuotaPrivilege 1216 c9d9ff232e23f1e7231a091c86955c070caf3002553713a9c3ff41d4eba37f07.exe Token: SeSecurityPrivilege 1216 c9d9ff232e23f1e7231a091c86955c070caf3002553713a9c3ff41d4eba37f07.exe Token: SeTakeOwnershipPrivilege 1216 c9d9ff232e23f1e7231a091c86955c070caf3002553713a9c3ff41d4eba37f07.exe Token: SeLoadDriverPrivilege 1216 c9d9ff232e23f1e7231a091c86955c070caf3002553713a9c3ff41d4eba37f07.exe Token: SeSystemProfilePrivilege 1216 c9d9ff232e23f1e7231a091c86955c070caf3002553713a9c3ff41d4eba37f07.exe Token: SeSystemtimePrivilege 1216 c9d9ff232e23f1e7231a091c86955c070caf3002553713a9c3ff41d4eba37f07.exe Token: SeProfSingleProcessPrivilege 1216 c9d9ff232e23f1e7231a091c86955c070caf3002553713a9c3ff41d4eba37f07.exe Token: SeIncBasePriorityPrivilege 1216 c9d9ff232e23f1e7231a091c86955c070caf3002553713a9c3ff41d4eba37f07.exe Token: SeCreatePagefilePrivilege 1216 c9d9ff232e23f1e7231a091c86955c070caf3002553713a9c3ff41d4eba37f07.exe Token: SeBackupPrivilege 1216 c9d9ff232e23f1e7231a091c86955c070caf3002553713a9c3ff41d4eba37f07.exe Token: SeRestorePrivilege 1216 c9d9ff232e23f1e7231a091c86955c070caf3002553713a9c3ff41d4eba37f07.exe Token: SeShutdownPrivilege 1216 c9d9ff232e23f1e7231a091c86955c070caf3002553713a9c3ff41d4eba37f07.exe Token: SeDebugPrivilege 1216 c9d9ff232e23f1e7231a091c86955c070caf3002553713a9c3ff41d4eba37f07.exe Token: SeSystemEnvironmentPrivilege 1216 c9d9ff232e23f1e7231a091c86955c070caf3002553713a9c3ff41d4eba37f07.exe Token: SeChangeNotifyPrivilege 1216 c9d9ff232e23f1e7231a091c86955c070caf3002553713a9c3ff41d4eba37f07.exe Token: SeRemoteShutdownPrivilege 1216 c9d9ff232e23f1e7231a091c86955c070caf3002553713a9c3ff41d4eba37f07.exe Token: SeUndockPrivilege 1216 c9d9ff232e23f1e7231a091c86955c070caf3002553713a9c3ff41d4eba37f07.exe Token: SeManageVolumePrivilege 1216 c9d9ff232e23f1e7231a091c86955c070caf3002553713a9c3ff41d4eba37f07.exe Token: SeImpersonatePrivilege 1216 c9d9ff232e23f1e7231a091c86955c070caf3002553713a9c3ff41d4eba37f07.exe Token: SeCreateGlobalPrivilege 1216 c9d9ff232e23f1e7231a091c86955c070caf3002553713a9c3ff41d4eba37f07.exe Token: 33 1216 c9d9ff232e23f1e7231a091c86955c070caf3002553713a9c3ff41d4eba37f07.exe Token: 34 1216 c9d9ff232e23f1e7231a091c86955c070caf3002553713a9c3ff41d4eba37f07.exe Token: 35 1216 c9d9ff232e23f1e7231a091c86955c070caf3002553713a9c3ff41d4eba37f07.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
c9d9ff232e23f1e7231a091c86955c070caf3002553713a9c3ff41d4eba37f07.exec9d9ff232e23f1e7231a091c86955c070caf3002553713a9c3ff41d4eba37f07.exepid process 1156 c9d9ff232e23f1e7231a091c86955c070caf3002553713a9c3ff41d4eba37f07.exe 1216 c9d9ff232e23f1e7231a091c86955c070caf3002553713a9c3ff41d4eba37f07.exe -
Suspicious use of WriteProcessMemory 13 IoCs
Processes:
c9d9ff232e23f1e7231a091c86955c070caf3002553713a9c3ff41d4eba37f07.exedescription pid process target process PID 1156 wrote to memory of 1216 1156 c9d9ff232e23f1e7231a091c86955c070caf3002553713a9c3ff41d4eba37f07.exe c9d9ff232e23f1e7231a091c86955c070caf3002553713a9c3ff41d4eba37f07.exe PID 1156 wrote to memory of 1216 1156 c9d9ff232e23f1e7231a091c86955c070caf3002553713a9c3ff41d4eba37f07.exe c9d9ff232e23f1e7231a091c86955c070caf3002553713a9c3ff41d4eba37f07.exe PID 1156 wrote to memory of 1216 1156 c9d9ff232e23f1e7231a091c86955c070caf3002553713a9c3ff41d4eba37f07.exe c9d9ff232e23f1e7231a091c86955c070caf3002553713a9c3ff41d4eba37f07.exe PID 1156 wrote to memory of 1216 1156 c9d9ff232e23f1e7231a091c86955c070caf3002553713a9c3ff41d4eba37f07.exe c9d9ff232e23f1e7231a091c86955c070caf3002553713a9c3ff41d4eba37f07.exe PID 1156 wrote to memory of 1216 1156 c9d9ff232e23f1e7231a091c86955c070caf3002553713a9c3ff41d4eba37f07.exe c9d9ff232e23f1e7231a091c86955c070caf3002553713a9c3ff41d4eba37f07.exe PID 1156 wrote to memory of 1216 1156 c9d9ff232e23f1e7231a091c86955c070caf3002553713a9c3ff41d4eba37f07.exe c9d9ff232e23f1e7231a091c86955c070caf3002553713a9c3ff41d4eba37f07.exe PID 1156 wrote to memory of 1216 1156 c9d9ff232e23f1e7231a091c86955c070caf3002553713a9c3ff41d4eba37f07.exe c9d9ff232e23f1e7231a091c86955c070caf3002553713a9c3ff41d4eba37f07.exe PID 1156 wrote to memory of 1216 1156 c9d9ff232e23f1e7231a091c86955c070caf3002553713a9c3ff41d4eba37f07.exe c9d9ff232e23f1e7231a091c86955c070caf3002553713a9c3ff41d4eba37f07.exe PID 1156 wrote to memory of 1216 1156 c9d9ff232e23f1e7231a091c86955c070caf3002553713a9c3ff41d4eba37f07.exe c9d9ff232e23f1e7231a091c86955c070caf3002553713a9c3ff41d4eba37f07.exe PID 1156 wrote to memory of 1216 1156 c9d9ff232e23f1e7231a091c86955c070caf3002553713a9c3ff41d4eba37f07.exe c9d9ff232e23f1e7231a091c86955c070caf3002553713a9c3ff41d4eba37f07.exe PID 1156 wrote to memory of 1216 1156 c9d9ff232e23f1e7231a091c86955c070caf3002553713a9c3ff41d4eba37f07.exe c9d9ff232e23f1e7231a091c86955c070caf3002553713a9c3ff41d4eba37f07.exe PID 1156 wrote to memory of 1216 1156 c9d9ff232e23f1e7231a091c86955c070caf3002553713a9c3ff41d4eba37f07.exe c9d9ff232e23f1e7231a091c86955c070caf3002553713a9c3ff41d4eba37f07.exe PID 1156 wrote to memory of 1216 1156 c9d9ff232e23f1e7231a091c86955c070caf3002553713a9c3ff41d4eba37f07.exe c9d9ff232e23f1e7231a091c86955c070caf3002553713a9c3ff41d4eba37f07.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\c9d9ff232e23f1e7231a091c86955c070caf3002553713a9c3ff41d4eba37f07.exe"C:\Users\Admin\AppData\Local\Temp\c9d9ff232e23f1e7231a091c86955c070caf3002553713a9c3ff41d4eba37f07.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\c9d9ff232e23f1e7231a091c86955c070caf3002553713a9c3ff41d4eba37f07.exe"C:\Users\Admin\AppData\Local\Temp\c9d9ff232e23f1e7231a091c86955c070caf3002553713a9c3ff41d4eba37f07.exe"2⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1216-56-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/1216-57-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/1216-59-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/1216-61-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/1216-63-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/1216-65-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/1216-66-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/1216-68-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/1216-70-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/1216-71-0x000000000048F888-mapping.dmp
-
memory/1216-72-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/1216-73-0x0000000075091000-0x0000000075093000-memory.dmpFilesize
8KB
-
memory/1216-74-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/1216-75-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/1216-76-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB