Analysis
-
max time kernel
98s -
max time network
32s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
02-12-2022 21:56
Static task
static1
Behavioral task
behavioral1
Sample
c4dab5471ab7c23e71f8e5796d55c8bf2d7c3a4e8ebba7637d47321aca764c5b.exe
Resource
win7-20221111-en
General
-
Target
c4dab5471ab7c23e71f8e5796d55c8bf2d7c3a4e8ebba7637d47321aca764c5b.exe
-
Size
300KB
-
MD5
cc0b280b1138859bedd6af39377526a5
-
SHA1
861cecd1d68a5ee192e69e5f1cf028114ec1b7af
-
SHA256
c4dab5471ab7c23e71f8e5796d55c8bf2d7c3a4e8ebba7637d47321aca764c5b
-
SHA512
b002cfc305630fca9c6af061ff032aae88ae0aaa185628808d717ce1eb0ef4802d916a9f78e8582b97e64981d7f1c0ecce4eee35df9f6c5e2d2bbcbead5d51ff
-
SSDEEP
6144:YRk2kQjwtxwiG9Gl9St23NZCB0lsvW8gco/LDLPOj03p2KZhE:YR49x6EmslevWQIHDOj03p2
Malware Config
Extracted
darkcomet
Guest16
jjb4xt3r.myftp.biz:1604
DC_MUTEX-8JY3N3Z
-
InstallPath
MSDCSC\msdcsc.exe
-
gencode
SjbmmcfPKkjH
-
install
true
-
offline_keylogger
true
-
persistence
true
-
reg_key
MicroUpdate
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
Processes:
vbc.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Users\\Admin\\Documents\\MSDCSC\\msdcsc.exe" vbc.exe -
Executes dropped EXE 1 IoCs
Processes:
msdcsc.exepid process 1408 msdcsc.exe -
Sets file to hidden 1 TTPs 2 IoCs
Modifies file attributes to stop it showing in Explorer etc.
Processes:
attrib.exeattrib.exepid process 1068 attrib.exe 544 attrib.exe -
Processes:
resource yara_rule behavioral1/memory/1128-56-0x0000000000400000-0x00000000004B9000-memory.dmp upx behavioral1/memory/1128-58-0x0000000000400000-0x00000000004B9000-memory.dmp upx behavioral1/memory/1128-60-0x0000000000400000-0x00000000004B9000-memory.dmp upx behavioral1/memory/1128-62-0x0000000000400000-0x00000000004B9000-memory.dmp upx behavioral1/memory/1128-64-0x0000000000400000-0x00000000004B9000-memory.dmp upx behavioral1/memory/1128-66-0x0000000000400000-0x00000000004B9000-memory.dmp upx behavioral1/memory/1128-76-0x0000000000400000-0x00000000004B9000-memory.dmp upx -
Loads dropped DLL 1 IoCs
Processes:
vbc.exepid process 1128 vbc.exe -
Uses the VBS compiler for execution 1 TTPs
-
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
vbc.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Users\\Admin\\Documents\\MSDCSC\\msdcsc.exe" vbc.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
c4dab5471ab7c23e71f8e5796d55c8bf2d7c3a4e8ebba7637d47321aca764c5b.exedescription pid process target process PID 472 set thread context of 1128 472 c4dab5471ab7c23e71f8e5796d55c8bf2d7c3a4e8ebba7637d47321aca764c5b.exe vbc.exe -
Drops file in Windows directory 2 IoCs
Processes:
attrib.exeattrib.exedescription ioc process File opened for modification C:\Windows\Microsoft.NET\Framework\v2.0.50727 attrib.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe attrib.exe -
Suspicious use of AdjustPrivilegeToken 23 IoCs
Processes:
vbc.exedescription pid process Token: SeIncreaseQuotaPrivilege 1128 vbc.exe Token: SeSecurityPrivilege 1128 vbc.exe Token: SeTakeOwnershipPrivilege 1128 vbc.exe Token: SeLoadDriverPrivilege 1128 vbc.exe Token: SeSystemProfilePrivilege 1128 vbc.exe Token: SeSystemtimePrivilege 1128 vbc.exe Token: SeProfSingleProcessPrivilege 1128 vbc.exe Token: SeIncBasePriorityPrivilege 1128 vbc.exe Token: SeCreatePagefilePrivilege 1128 vbc.exe Token: SeBackupPrivilege 1128 vbc.exe Token: SeRestorePrivilege 1128 vbc.exe Token: SeShutdownPrivilege 1128 vbc.exe Token: SeDebugPrivilege 1128 vbc.exe Token: SeSystemEnvironmentPrivilege 1128 vbc.exe Token: SeChangeNotifyPrivilege 1128 vbc.exe Token: SeRemoteShutdownPrivilege 1128 vbc.exe Token: SeUndockPrivilege 1128 vbc.exe Token: SeManageVolumePrivilege 1128 vbc.exe Token: SeImpersonatePrivilege 1128 vbc.exe Token: SeCreateGlobalPrivilege 1128 vbc.exe Token: 33 1128 vbc.exe Token: 34 1128 vbc.exe Token: 35 1128 vbc.exe -
Suspicious use of WriteProcessMemory 46 IoCs
Processes:
c4dab5471ab7c23e71f8e5796d55c8bf2d7c3a4e8ebba7637d47321aca764c5b.exevbc.execmd.execmd.exedescription pid process target process PID 472 wrote to memory of 1128 472 c4dab5471ab7c23e71f8e5796d55c8bf2d7c3a4e8ebba7637d47321aca764c5b.exe vbc.exe PID 472 wrote to memory of 1128 472 c4dab5471ab7c23e71f8e5796d55c8bf2d7c3a4e8ebba7637d47321aca764c5b.exe vbc.exe PID 472 wrote to memory of 1128 472 c4dab5471ab7c23e71f8e5796d55c8bf2d7c3a4e8ebba7637d47321aca764c5b.exe vbc.exe PID 472 wrote to memory of 1128 472 c4dab5471ab7c23e71f8e5796d55c8bf2d7c3a4e8ebba7637d47321aca764c5b.exe vbc.exe PID 472 wrote to memory of 1128 472 c4dab5471ab7c23e71f8e5796d55c8bf2d7c3a4e8ebba7637d47321aca764c5b.exe vbc.exe PID 472 wrote to memory of 1128 472 c4dab5471ab7c23e71f8e5796d55c8bf2d7c3a4e8ebba7637d47321aca764c5b.exe vbc.exe PID 472 wrote to memory of 1128 472 c4dab5471ab7c23e71f8e5796d55c8bf2d7c3a4e8ebba7637d47321aca764c5b.exe vbc.exe PID 472 wrote to memory of 1128 472 c4dab5471ab7c23e71f8e5796d55c8bf2d7c3a4e8ebba7637d47321aca764c5b.exe vbc.exe PID 1128 wrote to memory of 900 1128 vbc.exe cmd.exe PID 1128 wrote to memory of 900 1128 vbc.exe cmd.exe PID 1128 wrote to memory of 900 1128 vbc.exe cmd.exe PID 1128 wrote to memory of 900 1128 vbc.exe cmd.exe PID 1128 wrote to memory of 1720 1128 vbc.exe cmd.exe PID 1128 wrote to memory of 1720 1128 vbc.exe cmd.exe PID 1128 wrote to memory of 1720 1128 vbc.exe cmd.exe PID 1128 wrote to memory of 1720 1128 vbc.exe cmd.exe PID 1128 wrote to memory of 2004 1128 vbc.exe notepad.exe PID 1128 wrote to memory of 2004 1128 vbc.exe notepad.exe PID 1128 wrote to memory of 2004 1128 vbc.exe notepad.exe PID 1128 wrote to memory of 2004 1128 vbc.exe notepad.exe PID 1128 wrote to memory of 2004 1128 vbc.exe notepad.exe PID 1128 wrote to memory of 2004 1128 vbc.exe notepad.exe PID 1128 wrote to memory of 2004 1128 vbc.exe notepad.exe PID 1128 wrote to memory of 2004 1128 vbc.exe notepad.exe PID 1128 wrote to memory of 2004 1128 vbc.exe notepad.exe PID 1128 wrote to memory of 2004 1128 vbc.exe notepad.exe PID 1128 wrote to memory of 2004 1128 vbc.exe notepad.exe PID 1128 wrote to memory of 2004 1128 vbc.exe notepad.exe PID 1128 wrote to memory of 2004 1128 vbc.exe notepad.exe PID 1128 wrote to memory of 2004 1128 vbc.exe notepad.exe PID 1128 wrote to memory of 2004 1128 vbc.exe notepad.exe PID 1128 wrote to memory of 2004 1128 vbc.exe notepad.exe PID 1128 wrote to memory of 2004 1128 vbc.exe notepad.exe PID 1128 wrote to memory of 2004 1128 vbc.exe notepad.exe PID 900 wrote to memory of 544 900 cmd.exe attrib.exe PID 900 wrote to memory of 544 900 cmd.exe attrib.exe PID 900 wrote to memory of 544 900 cmd.exe attrib.exe PID 900 wrote to memory of 544 900 cmd.exe attrib.exe PID 1720 wrote to memory of 1068 1720 cmd.exe attrib.exe PID 1720 wrote to memory of 1068 1720 cmd.exe attrib.exe PID 1720 wrote to memory of 1068 1720 cmd.exe attrib.exe PID 1720 wrote to memory of 1068 1720 cmd.exe attrib.exe PID 1128 wrote to memory of 1408 1128 vbc.exe msdcsc.exe PID 1128 wrote to memory of 1408 1128 vbc.exe msdcsc.exe PID 1128 wrote to memory of 1408 1128 vbc.exe msdcsc.exe PID 1128 wrote to memory of 1408 1128 vbc.exe msdcsc.exe -
Views/modifies file attributes 1 TTPs 2 IoCs
Processes:
attrib.exeattrib.exepid process 544 attrib.exe 1068 attrib.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\c4dab5471ab7c23e71f8e5796d55c8bf2d7c3a4e8ebba7637d47321aca764c5b.exe"C:\Users\Admin\AppData\Local\Temp\c4dab5471ab7c23e71f8e5796d55c8bf2d7c3a4e8ebba7637d47321aca764c5b.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:472 -
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeC:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe2⤵
- Modifies WinLogon for persistence
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1128 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" +s +h3⤵
- Suspicious use of WriteProcessMemory
PID:900 -
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" +s +h4⤵
- Sets file to hidden
- Drops file in Windows directory
- Views/modifies file attributes
PID:544 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\Microsoft.NET\Framework\v2.0.50727" +s +h3⤵
- Suspicious use of WriteProcessMemory
PID:1720 -
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\Microsoft.NET\Framework\v2.0.50727" +s +h4⤵
- Sets file to hidden
- Drops file in Windows directory
- Views/modifies file attributes
PID:1068 -
C:\Windows\SysWOW64\notepad.exenotepad3⤵PID:2004
-
C:\Users\Admin\Documents\MSDCSC\msdcsc.exe"C:\Users\Admin\Documents\MSDCSC\msdcsc.exe"3⤵
- Executes dropped EXE
PID:1408
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\Documents\MSDCSC\msdcsc.exeFilesize
1.1MB
MD534aa912defa18c2c129f1e09d75c1d7e
SHA19c3046324657505a30ecd9b1fdb46c05bde7d470
SHA2566df94b7fa33f1b87142adc39b3db0613fc520d9e7a5fd6a5301dd7f51f8d0386
SHA512d1ea9368f5d7166180612fd763c87afb647d088498887961f5e7fb0a10f4a808bd5928e8a3666d70ff794093c51ecca8816f75dd47652fd4eb23dce7f9aa1f98
-
C:\Users\Admin\Documents\MSDCSC\msdcsc.exeFilesize
1.1MB
MD534aa912defa18c2c129f1e09d75c1d7e
SHA19c3046324657505a30ecd9b1fdb46c05bde7d470
SHA2566df94b7fa33f1b87142adc39b3db0613fc520d9e7a5fd6a5301dd7f51f8d0386
SHA512d1ea9368f5d7166180612fd763c87afb647d088498887961f5e7fb0a10f4a808bd5928e8a3666d70ff794093c51ecca8816f75dd47652fd4eb23dce7f9aa1f98
-
\Users\Admin\Documents\MSDCSC\msdcsc.exeFilesize
1.1MB
MD534aa912defa18c2c129f1e09d75c1d7e
SHA19c3046324657505a30ecd9b1fdb46c05bde7d470
SHA2566df94b7fa33f1b87142adc39b3db0613fc520d9e7a5fd6a5301dd7f51f8d0386
SHA512d1ea9368f5d7166180612fd763c87afb647d088498887961f5e7fb0a10f4a808bd5928e8a3666d70ff794093c51ecca8816f75dd47652fd4eb23dce7f9aa1f98
-
memory/472-65-0x0000000074000000-0x00000000745AB000-memory.dmpFilesize
5.7MB
-
memory/472-54-0x0000000074DA1000-0x0000000074DA3000-memory.dmpFilesize
8KB
-
memory/544-71-0x0000000000000000-mapping.dmp
-
memory/900-67-0x0000000000000000-mapping.dmp
-
memory/1068-72-0x0000000000000000-mapping.dmp
-
memory/1128-61-0x00000000004B6A00-mapping.dmp
-
memory/1128-66-0x0000000000400000-0x00000000004B9000-memory.dmpFilesize
740KB
-
memory/1128-64-0x0000000000400000-0x00000000004B9000-memory.dmpFilesize
740KB
-
memory/1128-62-0x0000000000400000-0x00000000004B9000-memory.dmpFilesize
740KB
-
memory/1128-60-0x0000000000400000-0x00000000004B9000-memory.dmpFilesize
740KB
-
memory/1128-58-0x0000000000400000-0x00000000004B9000-memory.dmpFilesize
740KB
-
memory/1128-56-0x0000000000400000-0x00000000004B9000-memory.dmpFilesize
740KB
-
memory/1128-76-0x0000000000400000-0x00000000004B9000-memory.dmpFilesize
740KB
-
memory/1128-55-0x0000000000400000-0x00000000004B9000-memory.dmpFilesize
740KB
-
memory/1408-74-0x0000000000000000-mapping.dmp
-
memory/1720-68-0x0000000000000000-mapping.dmp
-
memory/2004-69-0x0000000000000000-mapping.dmp