Analysis
-
max time kernel
154s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
02-12-2022 23:28
Static task
static1
Behavioral task
behavioral1
Sample
ae5aa015798898802e277ff25fa8678f688f9df22ad9d15d849409d3d83b925d.exe
Resource
win7-20221111-en
General
-
Target
ae5aa015798898802e277ff25fa8678f688f9df22ad9d15d849409d3d83b925d.exe
-
Size
534KB
-
MD5
8093d7e4d74c549ee8c185c655f47e65
-
SHA1
4cefa845db22a23f0cb5e1b99ad8a1bcd5795ccc
-
SHA256
ae5aa015798898802e277ff25fa8678f688f9df22ad9d15d849409d3d83b925d
-
SHA512
954e90d6b857e8cac84137e12ddb9d775ece68eabbebdea5a5651a172b7a52f76443ba0cbeef980161839b2192e0be9e0903808d0544e49b92ee02ce2cbb474d
-
SSDEEP
12288:Hhqmauq42dSMeIdh07uRCxBzh9pVnfLSPijpmcUHlMSn8qcpuT:HhqmauqW8tAxBLdjpmoI08
Malware Config
Extracted
darkcomet
HF
cyber-dos.no-ip.org:1337
DC_MUTEX-EYQES59
-
InstallPath
java32\java.exe
-
gencode
vP5N1dBnHx0W
-
install
true
-
offline_keylogger
true
-
persistence
true
-
reg_key
java
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
Processes:
vbc.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\java32\\java.exe" vbc.exe -
Executes dropped EXE 1 IoCs
Processes:
java.exepid process 4024 java.exe -
Sets file to hidden 1 TTPs 2 IoCs
Modifies file attributes to stop it showing in Explorer etc.
Processes:
attrib.exeattrib.exepid process 216 attrib.exe 4460 attrib.exe -
Processes:
resource yara_rule behavioral2/memory/960-134-0x0000000000400000-0x00000000004B7000-memory.dmp upx behavioral2/memory/960-135-0x0000000000400000-0x00000000004B7000-memory.dmp upx behavioral2/memory/960-136-0x0000000000400000-0x00000000004B7000-memory.dmp upx behavioral2/memory/960-138-0x0000000000400000-0x00000000004B7000-memory.dmp upx behavioral2/memory/960-139-0x0000000000400000-0x00000000004B7000-memory.dmp upx behavioral2/memory/960-147-0x0000000000400000-0x00000000004B7000-memory.dmp upx -
Uses the VBS compiler for execution 1 TTPs
-
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
ae5aa015798898802e277ff25fa8678f688f9df22ad9d15d849409d3d83b925d.exevbc.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindosU = "C:\\Users\\Admin\\AppData\\Local\\Temp\\WindosU.exe" ae5aa015798898802e277ff25fa8678f688f9df22ad9d15d849409d3d83b925d.exe Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\java = "C:\\Windows\\system32\\java32\\java.exe" vbc.exe -
Drops autorun.inf file 1 TTPs 4 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
Processes:
ae5aa015798898802e277ff25fa8678f688f9df22ad9d15d849409d3d83b925d.exedescription ioc process File opened for modification C:\autorun.inf ae5aa015798898802e277ff25fa8678f688f9df22ad9d15d849409d3d83b925d.exe File created D:\autorun.inf ae5aa015798898802e277ff25fa8678f688f9df22ad9d15d849409d3d83b925d.exe File opened for modification D:\autorun.inf ae5aa015798898802e277ff25fa8678f688f9df22ad9d15d849409d3d83b925d.exe File created C:\autorun.inf ae5aa015798898802e277ff25fa8678f688f9df22ad9d15d849409d3d83b925d.exe -
Drops file in System32 directory 3 IoCs
Processes:
vbc.exedescription ioc process File created C:\Windows\SysWOW64\java32\java.exe vbc.exe File opened for modification C:\Windows\SysWOW64\java32\java.exe vbc.exe File opened for modification C:\Windows\SysWOW64\java32\ vbc.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
ae5aa015798898802e277ff25fa8678f688f9df22ad9d15d849409d3d83b925d.exedescription pid process target process PID 4084 set thread context of 960 4084 ae5aa015798898802e277ff25fa8678f688f9df22ad9d15d849409d3d83b925d.exe vbc.exe -
Drops file in Windows directory 2 IoCs
Processes:
attrib.exeattrib.exedescription ioc process File opened for modification C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe attrib.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v2.0.50727 attrib.exe -
Suspicious use of AdjustPrivilegeToken 24 IoCs
Processes:
vbc.exedescription pid process Token: SeIncreaseQuotaPrivilege 960 vbc.exe Token: SeSecurityPrivilege 960 vbc.exe Token: SeTakeOwnershipPrivilege 960 vbc.exe Token: SeLoadDriverPrivilege 960 vbc.exe Token: SeSystemProfilePrivilege 960 vbc.exe Token: SeSystemtimePrivilege 960 vbc.exe Token: SeProfSingleProcessPrivilege 960 vbc.exe Token: SeIncBasePriorityPrivilege 960 vbc.exe Token: SeCreatePagefilePrivilege 960 vbc.exe Token: SeBackupPrivilege 960 vbc.exe Token: SeRestorePrivilege 960 vbc.exe Token: SeShutdownPrivilege 960 vbc.exe Token: SeDebugPrivilege 960 vbc.exe Token: SeSystemEnvironmentPrivilege 960 vbc.exe Token: SeChangeNotifyPrivilege 960 vbc.exe Token: SeRemoteShutdownPrivilege 960 vbc.exe Token: SeUndockPrivilege 960 vbc.exe Token: SeManageVolumePrivilege 960 vbc.exe Token: SeImpersonatePrivilege 960 vbc.exe Token: SeCreateGlobalPrivilege 960 vbc.exe Token: 33 960 vbc.exe Token: 34 960 vbc.exe Token: 35 960 vbc.exe Token: 36 960 vbc.exe -
Suspicious use of WriteProcessMemory 23 IoCs
Processes:
ae5aa015798898802e277ff25fa8678f688f9df22ad9d15d849409d3d83b925d.exevbc.execmd.execmd.exedescription pid process target process PID 4084 wrote to memory of 960 4084 ae5aa015798898802e277ff25fa8678f688f9df22ad9d15d849409d3d83b925d.exe vbc.exe PID 4084 wrote to memory of 960 4084 ae5aa015798898802e277ff25fa8678f688f9df22ad9d15d849409d3d83b925d.exe vbc.exe PID 4084 wrote to memory of 960 4084 ae5aa015798898802e277ff25fa8678f688f9df22ad9d15d849409d3d83b925d.exe vbc.exe PID 4084 wrote to memory of 960 4084 ae5aa015798898802e277ff25fa8678f688f9df22ad9d15d849409d3d83b925d.exe vbc.exe PID 4084 wrote to memory of 960 4084 ae5aa015798898802e277ff25fa8678f688f9df22ad9d15d849409d3d83b925d.exe vbc.exe PID 4084 wrote to memory of 960 4084 ae5aa015798898802e277ff25fa8678f688f9df22ad9d15d849409d3d83b925d.exe vbc.exe PID 4084 wrote to memory of 960 4084 ae5aa015798898802e277ff25fa8678f688f9df22ad9d15d849409d3d83b925d.exe vbc.exe PID 4084 wrote to memory of 960 4084 ae5aa015798898802e277ff25fa8678f688f9df22ad9d15d849409d3d83b925d.exe vbc.exe PID 960 wrote to memory of 788 960 vbc.exe cmd.exe PID 960 wrote to memory of 788 960 vbc.exe cmd.exe PID 960 wrote to memory of 788 960 vbc.exe cmd.exe PID 960 wrote to memory of 3636 960 vbc.exe cmd.exe PID 960 wrote to memory of 3636 960 vbc.exe cmd.exe PID 960 wrote to memory of 3636 960 vbc.exe cmd.exe PID 3636 wrote to memory of 216 3636 cmd.exe attrib.exe PID 3636 wrote to memory of 216 3636 cmd.exe attrib.exe PID 3636 wrote to memory of 216 3636 cmd.exe attrib.exe PID 788 wrote to memory of 4460 788 cmd.exe attrib.exe PID 788 wrote to memory of 4460 788 cmd.exe attrib.exe PID 788 wrote to memory of 4460 788 cmd.exe attrib.exe PID 960 wrote to memory of 4024 960 vbc.exe java.exe PID 960 wrote to memory of 4024 960 vbc.exe java.exe PID 960 wrote to memory of 4024 960 vbc.exe java.exe -
Views/modifies file attributes 1 TTPs 2 IoCs
Processes:
attrib.exeattrib.exepid process 216 attrib.exe 4460 attrib.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\ae5aa015798898802e277ff25fa8678f688f9df22ad9d15d849409d3d83b925d.exe"C:\Users\Admin\AppData\Local\Temp\ae5aa015798898802e277ff25fa8678f688f9df22ad9d15d849409d3d83b925d.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeC:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe2⤵
- Modifies WinLogon for persistence
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" +s +h3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" +s +h4⤵
- Sets file to hidden
- Drops file in Windows directory
- Views/modifies file attributes
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\Microsoft.NET\Framework\v2.0.50727" +s +h3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\Microsoft.NET\Framework\v2.0.50727" +s +h4⤵
- Sets file to hidden
- Drops file in Windows directory
- Views/modifies file attributes
-
C:\Windows\SysWOW64\java32\java.exe"C:\Windows\system32\java32\java.exe"3⤵
- Executes dropped EXE
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Windows\SysWOW64\java32\java.exeFilesize
1.1MB
MD5d881de17aa8f2e2c08cbb7b265f928f9
SHA108936aebc87decf0af6e8eada191062b5e65ac2a
SHA256b3a37093609f9a20ad60b85a9fa9de2ba674cba9b5bd687729440c70ba619ca0
SHA5125f23bfb1b8740247b36ed0ab741738c7d4c949736129e767213e321607d1ccd3e3a8428e4ba44bd28a275b5e3f6206285b1a522514b7ef7ea5e698d90a713d34
-
C:\Windows\SysWOW64\java32\java.exeFilesize
1.1MB
MD5d881de17aa8f2e2c08cbb7b265f928f9
SHA108936aebc87decf0af6e8eada191062b5e65ac2a
SHA256b3a37093609f9a20ad60b85a9fa9de2ba674cba9b5bd687729440c70ba619ca0
SHA5125f23bfb1b8740247b36ed0ab741738c7d4c949736129e767213e321607d1ccd3e3a8428e4ba44bd28a275b5e3f6206285b1a522514b7ef7ea5e698d90a713d34
-
memory/216-142-0x0000000000000000-mapping.dmp
-
memory/788-140-0x0000000000000000-mapping.dmp
-
memory/960-136-0x0000000000400000-0x00000000004B7000-memory.dmpFilesize
732KB
-
memory/960-138-0x0000000000400000-0x00000000004B7000-memory.dmpFilesize
732KB
-
memory/960-139-0x0000000000400000-0x00000000004B7000-memory.dmpFilesize
732KB
-
memory/960-135-0x0000000000400000-0x00000000004B7000-memory.dmpFilesize
732KB
-
memory/960-134-0x0000000000400000-0x00000000004B7000-memory.dmpFilesize
732KB
-
memory/960-133-0x0000000000000000-mapping.dmp
-
memory/960-147-0x0000000000400000-0x00000000004B7000-memory.dmpFilesize
732KB
-
memory/3636-141-0x0000000000000000-mapping.dmp
-
memory/4024-144-0x0000000000000000-mapping.dmp
-
memory/4084-137-0x0000000074A30000-0x0000000074FE1000-memory.dmpFilesize
5.7MB
-
memory/4084-132-0x0000000074A30000-0x0000000074FE1000-memory.dmpFilesize
5.7MB
-
memory/4460-143-0x0000000000000000-mapping.dmp