Analysis
-
max time kernel
152s -
max time network
208s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
02/12/2022, 00:24
Static task
static1
Behavioral task
behavioral1
Sample
2b82a7a043bd29de7ba54c94bec39e9de4f87a73ad190854fdeb8cdfeaf2241a.exe
Resource
win7-20220901-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
2b82a7a043bd29de7ba54c94bec39e9de4f87a73ad190854fdeb8cdfeaf2241a.exe
Resource
win10v2004-20221111-en
windows10-2004-x64
11 signatures
150 seconds
General
-
Target
2b82a7a043bd29de7ba54c94bec39e9de4f87a73ad190854fdeb8cdfeaf2241a.exe
-
Size
961KB
-
MD5
6de62ee64a02fb75ac1df28065be60df
-
SHA1
2ad0a9ebba4bcefff7c8a83d5dad3b46848d6c80
-
SHA256
2b82a7a043bd29de7ba54c94bec39e9de4f87a73ad190854fdeb8cdfeaf2241a
-
SHA512
6dc118cba6d9347106129ba9245e23f220e5819cf66c17fc9deb8f473f16effdb4f6cdeef224238c780ca5dab5db505d982d8f906e922e4f08a4a19246c82dc7
-
SSDEEP
12288:m1fdGG5lr9eNfruFNKsvV0fk56iggwxAXAr6uMDBR8DQrRnmIRsHD9kJBJIBs6r7:mrrafw4W5jwxiAfM9a2+HRa38h1J
Score
10/10
Malware Config
Extracted
Family
darkcomet
Botnet
NEWS
C2
orizon-serveur.no-ip.org:1604
Mutex
DC_MUTEX-J0RBJC8
Attributes
-
gencode
ggWyYxtGDhlF
-
install
false
-
offline_keylogger
true
-
persistence
false
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 2344 bcmwls32.exe -
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Control Panel\International\Geo\Nation 2b82a7a043bd29de7ba54c94bec39e9de4f87a73ad190854fdeb8cdfeaf2241a.exe Key value queried \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Control Panel\International\Geo\Nation bcmwls32.exe -
Uses the VBS compiler for execution 1 TTPs
-
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Software\Microsoft\Windows\CurrentVersion\Run reg.exe Set value (str) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\bcmwls32.exe = "C:\\Users\\Admin\\AppData\\Roaming\\bcmwls32.exe" reg.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2344 set thread context of 3368 2344 bcmwls32.exe 98 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 56 IoCs
pid Process 5060 2b82a7a043bd29de7ba54c94bec39e9de4f87a73ad190854fdeb8cdfeaf2241a.exe 5060 2b82a7a043bd29de7ba54c94bec39e9de4f87a73ad190854fdeb8cdfeaf2241a.exe 5060 2b82a7a043bd29de7ba54c94bec39e9de4f87a73ad190854fdeb8cdfeaf2241a.exe 5060 2b82a7a043bd29de7ba54c94bec39e9de4f87a73ad190854fdeb8cdfeaf2241a.exe 5060 2b82a7a043bd29de7ba54c94bec39e9de4f87a73ad190854fdeb8cdfeaf2241a.exe 5060 2b82a7a043bd29de7ba54c94bec39e9de4f87a73ad190854fdeb8cdfeaf2241a.exe 5060 2b82a7a043bd29de7ba54c94bec39e9de4f87a73ad190854fdeb8cdfeaf2241a.exe 5060 2b82a7a043bd29de7ba54c94bec39e9de4f87a73ad190854fdeb8cdfeaf2241a.exe 5060 2b82a7a043bd29de7ba54c94bec39e9de4f87a73ad190854fdeb8cdfeaf2241a.exe 5060 2b82a7a043bd29de7ba54c94bec39e9de4f87a73ad190854fdeb8cdfeaf2241a.exe 5060 2b82a7a043bd29de7ba54c94bec39e9de4f87a73ad190854fdeb8cdfeaf2241a.exe 5060 2b82a7a043bd29de7ba54c94bec39e9de4f87a73ad190854fdeb8cdfeaf2241a.exe 5060 2b82a7a043bd29de7ba54c94bec39e9de4f87a73ad190854fdeb8cdfeaf2241a.exe 5060 2b82a7a043bd29de7ba54c94bec39e9de4f87a73ad190854fdeb8cdfeaf2241a.exe 5060 2b82a7a043bd29de7ba54c94bec39e9de4f87a73ad190854fdeb8cdfeaf2241a.exe 5060 2b82a7a043bd29de7ba54c94bec39e9de4f87a73ad190854fdeb8cdfeaf2241a.exe 5060 2b82a7a043bd29de7ba54c94bec39e9de4f87a73ad190854fdeb8cdfeaf2241a.exe 5060 2b82a7a043bd29de7ba54c94bec39e9de4f87a73ad190854fdeb8cdfeaf2241a.exe 5060 2b82a7a043bd29de7ba54c94bec39e9de4f87a73ad190854fdeb8cdfeaf2241a.exe 5060 2b82a7a043bd29de7ba54c94bec39e9de4f87a73ad190854fdeb8cdfeaf2241a.exe 5060 2b82a7a043bd29de7ba54c94bec39e9de4f87a73ad190854fdeb8cdfeaf2241a.exe 5060 2b82a7a043bd29de7ba54c94bec39e9de4f87a73ad190854fdeb8cdfeaf2241a.exe 5060 2b82a7a043bd29de7ba54c94bec39e9de4f87a73ad190854fdeb8cdfeaf2241a.exe 5060 2b82a7a043bd29de7ba54c94bec39e9de4f87a73ad190854fdeb8cdfeaf2241a.exe 5060 2b82a7a043bd29de7ba54c94bec39e9de4f87a73ad190854fdeb8cdfeaf2241a.exe 5060 2b82a7a043bd29de7ba54c94bec39e9de4f87a73ad190854fdeb8cdfeaf2241a.exe 5060 2b82a7a043bd29de7ba54c94bec39e9de4f87a73ad190854fdeb8cdfeaf2241a.exe 2344 bcmwls32.exe 2344 bcmwls32.exe 2344 bcmwls32.exe 2344 bcmwls32.exe 2344 bcmwls32.exe 2344 bcmwls32.exe 2344 bcmwls32.exe 2344 bcmwls32.exe 2344 bcmwls32.exe 2344 bcmwls32.exe 2344 bcmwls32.exe 2344 bcmwls32.exe 2344 bcmwls32.exe 2344 bcmwls32.exe 2344 bcmwls32.exe 2344 bcmwls32.exe 2344 bcmwls32.exe 2344 bcmwls32.exe 2344 bcmwls32.exe 2344 bcmwls32.exe 2344 bcmwls32.exe 2344 bcmwls32.exe 2344 bcmwls32.exe 2344 bcmwls32.exe 2344 bcmwls32.exe 2344 bcmwls32.exe 2344 bcmwls32.exe 2344 bcmwls32.exe 2344 bcmwls32.exe -
Suspicious use of AdjustPrivilegeToken 26 IoCs
description pid Process Token: SeDebugPrivilege 5060 2b82a7a043bd29de7ba54c94bec39e9de4f87a73ad190854fdeb8cdfeaf2241a.exe Token: SeDebugPrivilege 2344 bcmwls32.exe Token: SeIncreaseQuotaPrivilege 3368 vbc.exe Token: SeSecurityPrivilege 3368 vbc.exe Token: SeTakeOwnershipPrivilege 3368 vbc.exe Token: SeLoadDriverPrivilege 3368 vbc.exe Token: SeSystemProfilePrivilege 3368 vbc.exe Token: SeSystemtimePrivilege 3368 vbc.exe Token: SeProfSingleProcessPrivilege 3368 vbc.exe Token: SeIncBasePriorityPrivilege 3368 vbc.exe Token: SeCreatePagefilePrivilege 3368 vbc.exe Token: SeBackupPrivilege 3368 vbc.exe Token: SeRestorePrivilege 3368 vbc.exe Token: SeShutdownPrivilege 3368 vbc.exe Token: SeDebugPrivilege 3368 vbc.exe Token: SeSystemEnvironmentPrivilege 3368 vbc.exe Token: SeChangeNotifyPrivilege 3368 vbc.exe Token: SeRemoteShutdownPrivilege 3368 vbc.exe Token: SeUndockPrivilege 3368 vbc.exe Token: SeManageVolumePrivilege 3368 vbc.exe Token: SeImpersonatePrivilege 3368 vbc.exe Token: SeCreateGlobalPrivilege 3368 vbc.exe Token: 33 3368 vbc.exe Token: 34 3368 vbc.exe Token: 35 3368 vbc.exe Token: 36 3368 vbc.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 3368 vbc.exe -
Suspicious use of WriteProcessMemory 26 IoCs
description pid Process procid_target PID 5060 wrote to memory of 3516 5060 2b82a7a043bd29de7ba54c94bec39e9de4f87a73ad190854fdeb8cdfeaf2241a.exe 89 PID 5060 wrote to memory of 3516 5060 2b82a7a043bd29de7ba54c94bec39e9de4f87a73ad190854fdeb8cdfeaf2241a.exe 89 PID 5060 wrote to memory of 3516 5060 2b82a7a043bd29de7ba54c94bec39e9de4f87a73ad190854fdeb8cdfeaf2241a.exe 89 PID 5060 wrote to memory of 2344 5060 2b82a7a043bd29de7ba54c94bec39e9de4f87a73ad190854fdeb8cdfeaf2241a.exe 91 PID 5060 wrote to memory of 2344 5060 2b82a7a043bd29de7ba54c94bec39e9de4f87a73ad190854fdeb8cdfeaf2241a.exe 91 PID 5060 wrote to memory of 2344 5060 2b82a7a043bd29de7ba54c94bec39e9de4f87a73ad190854fdeb8cdfeaf2241a.exe 91 PID 2344 wrote to memory of 3920 2344 bcmwls32.exe 94 PID 2344 wrote to memory of 3920 2344 bcmwls32.exe 94 PID 2344 wrote to memory of 3920 2344 bcmwls32.exe 94 PID 3920 wrote to memory of 1844 3920 cmd.exe 97 PID 3920 wrote to memory of 1844 3920 cmd.exe 97 PID 3920 wrote to memory of 1844 3920 cmd.exe 97 PID 2344 wrote to memory of 3368 2344 bcmwls32.exe 98 PID 2344 wrote to memory of 3368 2344 bcmwls32.exe 98 PID 2344 wrote to memory of 3368 2344 bcmwls32.exe 98 PID 2344 wrote to memory of 3368 2344 bcmwls32.exe 98 PID 2344 wrote to memory of 3368 2344 bcmwls32.exe 98 PID 2344 wrote to memory of 3368 2344 bcmwls32.exe 98 PID 2344 wrote to memory of 3368 2344 bcmwls32.exe 98 PID 2344 wrote to memory of 3368 2344 bcmwls32.exe 98 PID 2344 wrote to memory of 3368 2344 bcmwls32.exe 98 PID 2344 wrote to memory of 3368 2344 bcmwls32.exe 98 PID 2344 wrote to memory of 3368 2344 bcmwls32.exe 98 PID 2344 wrote to memory of 3368 2344 bcmwls32.exe 98 PID 2344 wrote to memory of 3368 2344 bcmwls32.exe 98 PID 2344 wrote to memory of 3368 2344 bcmwls32.exe 98
Processes
-
C:\Users\Admin\AppData\Local\Temp\2b82a7a043bd29de7ba54c94bec39e9de4f87a73ad190854fdeb8cdfeaf2241a.exe"C:\Users\Admin\AppData\Local\Temp\2b82a7a043bd29de7ba54c94bec39e9de4f87a73ad190854fdeb8cdfeaf2241a.exe"1⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5060 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c copy "C:\Users\Admin\AppData\Local\Temp\2b82a7a043bd29de7ba54c94bec39e9de4f87a73ad190854fdeb8cdfeaf2241a.exe" "C:\Users\Admin\AppData\Roaming\bcmwls32.exe" /Y & exit2⤵PID:3516
-
-
C:\Users\Admin\AppData\Roaming\bcmwls32.exeC:\Users\Admin\AppData\Roaming\bcmwls32.exe2⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2344 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "bcmwls32.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\bcmwls32.exe" & exit3⤵
- Suspicious use of WriteProcessMemory
PID:3920 -
C:\Windows\SysWOW64\reg.exereg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "bcmwls32.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\bcmwls32.exe"4⤵
- Adds Run key to start application
PID:1844
-
-
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeC:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe3⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:3368
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
961KB
MD56de62ee64a02fb75ac1df28065be60df
SHA12ad0a9ebba4bcefff7c8a83d5dad3b46848d6c80
SHA2562b82a7a043bd29de7ba54c94bec39e9de4f87a73ad190854fdeb8cdfeaf2241a
SHA5126dc118cba6d9347106129ba9245e23f220e5819cf66c17fc9deb8f473f16effdb4f6cdeef224238c780ca5dab5db505d982d8f906e922e4f08a4a19246c82dc7
-
Filesize
961KB
MD56de62ee64a02fb75ac1df28065be60df
SHA12ad0a9ebba4bcefff7c8a83d5dad3b46848d6c80
SHA2562b82a7a043bd29de7ba54c94bec39e9de4f87a73ad190854fdeb8cdfeaf2241a
SHA5126dc118cba6d9347106129ba9245e23f220e5819cf66c17fc9deb8f473f16effdb4f6cdeef224238c780ca5dab5db505d982d8f906e922e4f08a4a19246c82dc7