Analysis
-
max time kernel
165s -
max time network
203s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
02-12-2022 21:52
Static task
static1
Behavioral task
behavioral1
Sample
c9d9ff232e23f1e7231a091c86955c070caf3002553713a9c3ff41d4eba37f07.exe
Resource
win7-20221111-en
General
-
Target
c9d9ff232e23f1e7231a091c86955c070caf3002553713a9c3ff41d4eba37f07.exe
-
Size
596KB
-
MD5
82b6847860a2fb6ae84badda650bec3c
-
SHA1
fee9fcad16bef3b27a37696aa9d52bf5add80a6d
-
SHA256
c9d9ff232e23f1e7231a091c86955c070caf3002553713a9c3ff41d4eba37f07
-
SHA512
2d55988f51f0e1cf4c7f85020ac6f21c37dcf5846295541db98eee4acf2b7a1c70a3f5da1dbc75feeaf2f0105e0525d2d57ecaf0b8db4196dcc2c2c3dd209b7b
-
SSDEEP
12288:6Fc1GUux1KgyM+23XN+GzKyUcAn21+srdO4gAblgKLsfPCPTPC:6Fc18v+2nN+3ytAnDwiKLEeTK
Malware Config
Extracted
darkcomet
Guest16
127.0.0.1:1604
DC_MUTEX-0PRSAK8
-
gencode
AU83b2dyG2P1
-
install
false
-
offline_keylogger
true
-
persistence
false
Signatures
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
c9d9ff232e23f1e7231a091c86955c070caf3002553713a9c3ff41d4eba37f07.exedescription pid process target process PID 4012 set thread context of 2100 4012 c9d9ff232e23f1e7231a091c86955c070caf3002553713a9c3ff41d4eba37f07.exe c9d9ff232e23f1e7231a091c86955c070caf3002553713a9c3ff41d4eba37f07.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of AdjustPrivilegeToken 24 IoCs
Processes:
c9d9ff232e23f1e7231a091c86955c070caf3002553713a9c3ff41d4eba37f07.exedescription pid process Token: SeIncreaseQuotaPrivilege 2100 c9d9ff232e23f1e7231a091c86955c070caf3002553713a9c3ff41d4eba37f07.exe Token: SeSecurityPrivilege 2100 c9d9ff232e23f1e7231a091c86955c070caf3002553713a9c3ff41d4eba37f07.exe Token: SeTakeOwnershipPrivilege 2100 c9d9ff232e23f1e7231a091c86955c070caf3002553713a9c3ff41d4eba37f07.exe Token: SeLoadDriverPrivilege 2100 c9d9ff232e23f1e7231a091c86955c070caf3002553713a9c3ff41d4eba37f07.exe Token: SeSystemProfilePrivilege 2100 c9d9ff232e23f1e7231a091c86955c070caf3002553713a9c3ff41d4eba37f07.exe Token: SeSystemtimePrivilege 2100 c9d9ff232e23f1e7231a091c86955c070caf3002553713a9c3ff41d4eba37f07.exe Token: SeProfSingleProcessPrivilege 2100 c9d9ff232e23f1e7231a091c86955c070caf3002553713a9c3ff41d4eba37f07.exe Token: SeIncBasePriorityPrivilege 2100 c9d9ff232e23f1e7231a091c86955c070caf3002553713a9c3ff41d4eba37f07.exe Token: SeCreatePagefilePrivilege 2100 c9d9ff232e23f1e7231a091c86955c070caf3002553713a9c3ff41d4eba37f07.exe Token: SeBackupPrivilege 2100 c9d9ff232e23f1e7231a091c86955c070caf3002553713a9c3ff41d4eba37f07.exe Token: SeRestorePrivilege 2100 c9d9ff232e23f1e7231a091c86955c070caf3002553713a9c3ff41d4eba37f07.exe Token: SeShutdownPrivilege 2100 c9d9ff232e23f1e7231a091c86955c070caf3002553713a9c3ff41d4eba37f07.exe Token: SeDebugPrivilege 2100 c9d9ff232e23f1e7231a091c86955c070caf3002553713a9c3ff41d4eba37f07.exe Token: SeSystemEnvironmentPrivilege 2100 c9d9ff232e23f1e7231a091c86955c070caf3002553713a9c3ff41d4eba37f07.exe Token: SeChangeNotifyPrivilege 2100 c9d9ff232e23f1e7231a091c86955c070caf3002553713a9c3ff41d4eba37f07.exe Token: SeRemoteShutdownPrivilege 2100 c9d9ff232e23f1e7231a091c86955c070caf3002553713a9c3ff41d4eba37f07.exe Token: SeUndockPrivilege 2100 c9d9ff232e23f1e7231a091c86955c070caf3002553713a9c3ff41d4eba37f07.exe Token: SeManageVolumePrivilege 2100 c9d9ff232e23f1e7231a091c86955c070caf3002553713a9c3ff41d4eba37f07.exe Token: SeImpersonatePrivilege 2100 c9d9ff232e23f1e7231a091c86955c070caf3002553713a9c3ff41d4eba37f07.exe Token: SeCreateGlobalPrivilege 2100 c9d9ff232e23f1e7231a091c86955c070caf3002553713a9c3ff41d4eba37f07.exe Token: 33 2100 c9d9ff232e23f1e7231a091c86955c070caf3002553713a9c3ff41d4eba37f07.exe Token: 34 2100 c9d9ff232e23f1e7231a091c86955c070caf3002553713a9c3ff41d4eba37f07.exe Token: 35 2100 c9d9ff232e23f1e7231a091c86955c070caf3002553713a9c3ff41d4eba37f07.exe Token: 36 2100 c9d9ff232e23f1e7231a091c86955c070caf3002553713a9c3ff41d4eba37f07.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
c9d9ff232e23f1e7231a091c86955c070caf3002553713a9c3ff41d4eba37f07.exec9d9ff232e23f1e7231a091c86955c070caf3002553713a9c3ff41d4eba37f07.exepid process 4012 c9d9ff232e23f1e7231a091c86955c070caf3002553713a9c3ff41d4eba37f07.exe 2100 c9d9ff232e23f1e7231a091c86955c070caf3002553713a9c3ff41d4eba37f07.exe -
Suspicious use of WriteProcessMemory 14 IoCs
Processes:
c9d9ff232e23f1e7231a091c86955c070caf3002553713a9c3ff41d4eba37f07.exedescription pid process target process PID 4012 wrote to memory of 2100 4012 c9d9ff232e23f1e7231a091c86955c070caf3002553713a9c3ff41d4eba37f07.exe c9d9ff232e23f1e7231a091c86955c070caf3002553713a9c3ff41d4eba37f07.exe PID 4012 wrote to memory of 2100 4012 c9d9ff232e23f1e7231a091c86955c070caf3002553713a9c3ff41d4eba37f07.exe c9d9ff232e23f1e7231a091c86955c070caf3002553713a9c3ff41d4eba37f07.exe PID 4012 wrote to memory of 2100 4012 c9d9ff232e23f1e7231a091c86955c070caf3002553713a9c3ff41d4eba37f07.exe c9d9ff232e23f1e7231a091c86955c070caf3002553713a9c3ff41d4eba37f07.exe PID 4012 wrote to memory of 2100 4012 c9d9ff232e23f1e7231a091c86955c070caf3002553713a9c3ff41d4eba37f07.exe c9d9ff232e23f1e7231a091c86955c070caf3002553713a9c3ff41d4eba37f07.exe PID 4012 wrote to memory of 2100 4012 c9d9ff232e23f1e7231a091c86955c070caf3002553713a9c3ff41d4eba37f07.exe c9d9ff232e23f1e7231a091c86955c070caf3002553713a9c3ff41d4eba37f07.exe PID 4012 wrote to memory of 2100 4012 c9d9ff232e23f1e7231a091c86955c070caf3002553713a9c3ff41d4eba37f07.exe c9d9ff232e23f1e7231a091c86955c070caf3002553713a9c3ff41d4eba37f07.exe PID 4012 wrote to memory of 2100 4012 c9d9ff232e23f1e7231a091c86955c070caf3002553713a9c3ff41d4eba37f07.exe c9d9ff232e23f1e7231a091c86955c070caf3002553713a9c3ff41d4eba37f07.exe PID 4012 wrote to memory of 2100 4012 c9d9ff232e23f1e7231a091c86955c070caf3002553713a9c3ff41d4eba37f07.exe c9d9ff232e23f1e7231a091c86955c070caf3002553713a9c3ff41d4eba37f07.exe PID 4012 wrote to memory of 2100 4012 c9d9ff232e23f1e7231a091c86955c070caf3002553713a9c3ff41d4eba37f07.exe c9d9ff232e23f1e7231a091c86955c070caf3002553713a9c3ff41d4eba37f07.exe PID 4012 wrote to memory of 2100 4012 c9d9ff232e23f1e7231a091c86955c070caf3002553713a9c3ff41d4eba37f07.exe c9d9ff232e23f1e7231a091c86955c070caf3002553713a9c3ff41d4eba37f07.exe PID 4012 wrote to memory of 2100 4012 c9d9ff232e23f1e7231a091c86955c070caf3002553713a9c3ff41d4eba37f07.exe c9d9ff232e23f1e7231a091c86955c070caf3002553713a9c3ff41d4eba37f07.exe PID 4012 wrote to memory of 2100 4012 c9d9ff232e23f1e7231a091c86955c070caf3002553713a9c3ff41d4eba37f07.exe c9d9ff232e23f1e7231a091c86955c070caf3002553713a9c3ff41d4eba37f07.exe PID 4012 wrote to memory of 2100 4012 c9d9ff232e23f1e7231a091c86955c070caf3002553713a9c3ff41d4eba37f07.exe c9d9ff232e23f1e7231a091c86955c070caf3002553713a9c3ff41d4eba37f07.exe PID 4012 wrote to memory of 2100 4012 c9d9ff232e23f1e7231a091c86955c070caf3002553713a9c3ff41d4eba37f07.exe c9d9ff232e23f1e7231a091c86955c070caf3002553713a9c3ff41d4eba37f07.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\c9d9ff232e23f1e7231a091c86955c070caf3002553713a9c3ff41d4eba37f07.exe"C:\Users\Admin\AppData\Local\Temp\c9d9ff232e23f1e7231a091c86955c070caf3002553713a9c3ff41d4eba37f07.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\c9d9ff232e23f1e7231a091c86955c070caf3002553713a9c3ff41d4eba37f07.exe"C:\Users\Admin\AppData\Local\Temp\c9d9ff232e23f1e7231a091c86955c070caf3002553713a9c3ff41d4eba37f07.exe"2⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2100-134-0x0000000000000000-mapping.dmp
-
memory/2100-135-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/2100-136-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/2100-137-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/2100-138-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/2100-139-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB