Analysis
-
max time kernel
168s -
max time network
67s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
02-12-2022 12:47
Static task
static1
Behavioral task
behavioral1
Sample
cb15f9234cadbfd951c61339905693f6c8554fa2c89a31028da87774b55870f8.exe
Resource
win7-20221111-en
General
-
Target
cb15f9234cadbfd951c61339905693f6c8554fa2c89a31028da87774b55870f8.exe
-
Size
396KB
-
MD5
d7f4b00a1c6f756a97bbd409e0e01e28
-
SHA1
7d0325baff23fc02a924c0033d9ca5205770ab94
-
SHA256
cb15f9234cadbfd951c61339905693f6c8554fa2c89a31028da87774b55870f8
-
SHA512
db4454bcc0bc09952ac46dd18aa9a41971c52624394795c84d81625f3ba1a9f484918379d767b97a0dc9a8f232df10e541f232e42f6211e116aadbb09f896911
-
SSDEEP
6144:yzuqM8bSZzkD9MvPGm7uDwG6tVsa8ez4d6O5Gtl50LyNdsy9eIkZg0ar:j8yE9cuvDkWazhD9dsyMI8cr
Malware Config
Extracted
darkcomet
victima
critical.zapto.org:1604
DC_MUTEX-ADY5V62
-
InstallPath
Windsound\soundloader.exe
-
gencode
abg2bucWtxxq
-
install
true
-
offline_keylogger
true
-
persistence
false
-
reg_key
MicroUpdate
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
Processes:
cb15f9234cadbfd951c61339905693f6c8554fa2c89a31028da87774b55870f8.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Users\\Admin\\AppData\\Roaming\\Windsound\\soundloader.exe" cb15f9234cadbfd951c61339905693f6c8554fa2c89a31028da87774b55870f8.exe -
Modifies firewall policy service 2 TTPs 3 IoCs
Processes:
soundloader.exedescription ioc process Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile soundloader.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" soundloader.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "0" soundloader.exe -
Executes dropped EXE 2 IoCs
Processes:
soundloader.exesoundloader.exepid process 332 soundloader.exe 1788 soundloader.exe -
Processes:
resource yara_rule behavioral1/memory/1924-57-0x0000000000400000-0x00000000004B9000-memory.dmp upx behavioral1/memory/1924-59-0x0000000000400000-0x00000000004B9000-memory.dmp upx behavioral1/memory/1924-60-0x0000000000400000-0x00000000004B9000-memory.dmp upx behavioral1/memory/1924-62-0x0000000000400000-0x00000000004B9000-memory.dmp upx behavioral1/memory/1924-63-0x0000000000400000-0x00000000004B9000-memory.dmp upx behavioral1/memory/1924-65-0x0000000000400000-0x00000000004B9000-memory.dmp upx behavioral1/memory/1924-66-0x0000000000400000-0x00000000004B9000-memory.dmp upx behavioral1/memory/1924-71-0x0000000000400000-0x00000000004B9000-memory.dmp upx behavioral1/memory/1788-84-0x0000000000400000-0x00000000004B9000-memory.dmp upx behavioral1/memory/1788-85-0x0000000000400000-0x00000000004B9000-memory.dmp upx behavioral1/memory/1788-86-0x0000000000400000-0x00000000004B9000-memory.dmp upx behavioral1/memory/1788-87-0x0000000000400000-0x00000000004B9000-memory.dmp upx -
Loads dropped DLL 2 IoCs
Processes:
cb15f9234cadbfd951c61339905693f6c8554fa2c89a31028da87774b55870f8.exepid process 1924 cb15f9234cadbfd951c61339905693f6c8554fa2c89a31028da87774b55870f8.exe 1924 cb15f9234cadbfd951c61339905693f6c8554fa2c89a31028da87774b55870f8.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
cb15f9234cadbfd951c61339905693f6c8554fa2c89a31028da87774b55870f8.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Users\\Admin\\AppData\\Roaming\\Windsound\\soundloader.exe" cb15f9234cadbfd951c61339905693f6c8554fa2c89a31028da87774b55870f8.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
cb15f9234cadbfd951c61339905693f6c8554fa2c89a31028da87774b55870f8.exesoundloader.exedescription pid process target process PID 1968 set thread context of 1924 1968 cb15f9234cadbfd951c61339905693f6c8554fa2c89a31028da87774b55870f8.exe cb15f9234cadbfd951c61339905693f6c8554fa2c89a31028da87774b55870f8.exe PID 332 set thread context of 1788 332 soundloader.exe soundloader.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
soundloader.exepid process 1788 soundloader.exe -
Suspicious use of AdjustPrivilegeToken 46 IoCs
Processes:
cb15f9234cadbfd951c61339905693f6c8554fa2c89a31028da87774b55870f8.exesoundloader.exedescription pid process Token: SeIncreaseQuotaPrivilege 1924 cb15f9234cadbfd951c61339905693f6c8554fa2c89a31028da87774b55870f8.exe Token: SeSecurityPrivilege 1924 cb15f9234cadbfd951c61339905693f6c8554fa2c89a31028da87774b55870f8.exe Token: SeTakeOwnershipPrivilege 1924 cb15f9234cadbfd951c61339905693f6c8554fa2c89a31028da87774b55870f8.exe Token: SeLoadDriverPrivilege 1924 cb15f9234cadbfd951c61339905693f6c8554fa2c89a31028da87774b55870f8.exe Token: SeSystemProfilePrivilege 1924 cb15f9234cadbfd951c61339905693f6c8554fa2c89a31028da87774b55870f8.exe Token: SeSystemtimePrivilege 1924 cb15f9234cadbfd951c61339905693f6c8554fa2c89a31028da87774b55870f8.exe Token: SeProfSingleProcessPrivilege 1924 cb15f9234cadbfd951c61339905693f6c8554fa2c89a31028da87774b55870f8.exe Token: SeIncBasePriorityPrivilege 1924 cb15f9234cadbfd951c61339905693f6c8554fa2c89a31028da87774b55870f8.exe Token: SeCreatePagefilePrivilege 1924 cb15f9234cadbfd951c61339905693f6c8554fa2c89a31028da87774b55870f8.exe Token: SeBackupPrivilege 1924 cb15f9234cadbfd951c61339905693f6c8554fa2c89a31028da87774b55870f8.exe Token: SeRestorePrivilege 1924 cb15f9234cadbfd951c61339905693f6c8554fa2c89a31028da87774b55870f8.exe Token: SeShutdownPrivilege 1924 cb15f9234cadbfd951c61339905693f6c8554fa2c89a31028da87774b55870f8.exe Token: SeDebugPrivilege 1924 cb15f9234cadbfd951c61339905693f6c8554fa2c89a31028da87774b55870f8.exe Token: SeSystemEnvironmentPrivilege 1924 cb15f9234cadbfd951c61339905693f6c8554fa2c89a31028da87774b55870f8.exe Token: SeChangeNotifyPrivilege 1924 cb15f9234cadbfd951c61339905693f6c8554fa2c89a31028da87774b55870f8.exe Token: SeRemoteShutdownPrivilege 1924 cb15f9234cadbfd951c61339905693f6c8554fa2c89a31028da87774b55870f8.exe Token: SeUndockPrivilege 1924 cb15f9234cadbfd951c61339905693f6c8554fa2c89a31028da87774b55870f8.exe Token: SeManageVolumePrivilege 1924 cb15f9234cadbfd951c61339905693f6c8554fa2c89a31028da87774b55870f8.exe Token: SeImpersonatePrivilege 1924 cb15f9234cadbfd951c61339905693f6c8554fa2c89a31028da87774b55870f8.exe Token: SeCreateGlobalPrivilege 1924 cb15f9234cadbfd951c61339905693f6c8554fa2c89a31028da87774b55870f8.exe Token: 33 1924 cb15f9234cadbfd951c61339905693f6c8554fa2c89a31028da87774b55870f8.exe Token: 34 1924 cb15f9234cadbfd951c61339905693f6c8554fa2c89a31028da87774b55870f8.exe Token: 35 1924 cb15f9234cadbfd951c61339905693f6c8554fa2c89a31028da87774b55870f8.exe Token: SeIncreaseQuotaPrivilege 1788 soundloader.exe Token: SeSecurityPrivilege 1788 soundloader.exe Token: SeTakeOwnershipPrivilege 1788 soundloader.exe Token: SeLoadDriverPrivilege 1788 soundloader.exe Token: SeSystemProfilePrivilege 1788 soundloader.exe Token: SeSystemtimePrivilege 1788 soundloader.exe Token: SeProfSingleProcessPrivilege 1788 soundloader.exe Token: SeIncBasePriorityPrivilege 1788 soundloader.exe Token: SeCreatePagefilePrivilege 1788 soundloader.exe Token: SeBackupPrivilege 1788 soundloader.exe Token: SeRestorePrivilege 1788 soundloader.exe Token: SeShutdownPrivilege 1788 soundloader.exe Token: SeDebugPrivilege 1788 soundloader.exe Token: SeSystemEnvironmentPrivilege 1788 soundloader.exe Token: SeChangeNotifyPrivilege 1788 soundloader.exe Token: SeRemoteShutdownPrivilege 1788 soundloader.exe Token: SeUndockPrivilege 1788 soundloader.exe Token: SeManageVolumePrivilege 1788 soundloader.exe Token: SeImpersonatePrivilege 1788 soundloader.exe Token: SeCreateGlobalPrivilege 1788 soundloader.exe Token: 33 1788 soundloader.exe Token: 34 1788 soundloader.exe Token: 35 1788 soundloader.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
Processes:
cb15f9234cadbfd951c61339905693f6c8554fa2c89a31028da87774b55870f8.exesoundloader.exesoundloader.exepid process 1968 cb15f9234cadbfd951c61339905693f6c8554fa2c89a31028da87774b55870f8.exe 332 soundloader.exe 1788 soundloader.exe -
Suspicious use of WriteProcessMemory 20 IoCs
Processes:
cb15f9234cadbfd951c61339905693f6c8554fa2c89a31028da87774b55870f8.execb15f9234cadbfd951c61339905693f6c8554fa2c89a31028da87774b55870f8.exesoundloader.exedescription pid process target process PID 1968 wrote to memory of 1924 1968 cb15f9234cadbfd951c61339905693f6c8554fa2c89a31028da87774b55870f8.exe cb15f9234cadbfd951c61339905693f6c8554fa2c89a31028da87774b55870f8.exe PID 1968 wrote to memory of 1924 1968 cb15f9234cadbfd951c61339905693f6c8554fa2c89a31028da87774b55870f8.exe cb15f9234cadbfd951c61339905693f6c8554fa2c89a31028da87774b55870f8.exe PID 1968 wrote to memory of 1924 1968 cb15f9234cadbfd951c61339905693f6c8554fa2c89a31028da87774b55870f8.exe cb15f9234cadbfd951c61339905693f6c8554fa2c89a31028da87774b55870f8.exe PID 1968 wrote to memory of 1924 1968 cb15f9234cadbfd951c61339905693f6c8554fa2c89a31028da87774b55870f8.exe cb15f9234cadbfd951c61339905693f6c8554fa2c89a31028da87774b55870f8.exe PID 1968 wrote to memory of 1924 1968 cb15f9234cadbfd951c61339905693f6c8554fa2c89a31028da87774b55870f8.exe cb15f9234cadbfd951c61339905693f6c8554fa2c89a31028da87774b55870f8.exe PID 1968 wrote to memory of 1924 1968 cb15f9234cadbfd951c61339905693f6c8554fa2c89a31028da87774b55870f8.exe cb15f9234cadbfd951c61339905693f6c8554fa2c89a31028da87774b55870f8.exe PID 1968 wrote to memory of 1924 1968 cb15f9234cadbfd951c61339905693f6c8554fa2c89a31028da87774b55870f8.exe cb15f9234cadbfd951c61339905693f6c8554fa2c89a31028da87774b55870f8.exe PID 1968 wrote to memory of 1924 1968 cb15f9234cadbfd951c61339905693f6c8554fa2c89a31028da87774b55870f8.exe cb15f9234cadbfd951c61339905693f6c8554fa2c89a31028da87774b55870f8.exe PID 1924 wrote to memory of 332 1924 cb15f9234cadbfd951c61339905693f6c8554fa2c89a31028da87774b55870f8.exe soundloader.exe PID 1924 wrote to memory of 332 1924 cb15f9234cadbfd951c61339905693f6c8554fa2c89a31028da87774b55870f8.exe soundloader.exe PID 1924 wrote to memory of 332 1924 cb15f9234cadbfd951c61339905693f6c8554fa2c89a31028da87774b55870f8.exe soundloader.exe PID 1924 wrote to memory of 332 1924 cb15f9234cadbfd951c61339905693f6c8554fa2c89a31028da87774b55870f8.exe soundloader.exe PID 332 wrote to memory of 1788 332 soundloader.exe soundloader.exe PID 332 wrote to memory of 1788 332 soundloader.exe soundloader.exe PID 332 wrote to memory of 1788 332 soundloader.exe soundloader.exe PID 332 wrote to memory of 1788 332 soundloader.exe soundloader.exe PID 332 wrote to memory of 1788 332 soundloader.exe soundloader.exe PID 332 wrote to memory of 1788 332 soundloader.exe soundloader.exe PID 332 wrote to memory of 1788 332 soundloader.exe soundloader.exe PID 332 wrote to memory of 1788 332 soundloader.exe soundloader.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\cb15f9234cadbfd951c61339905693f6c8554fa2c89a31028da87774b55870f8.exe"C:\Users\Admin\AppData\Local\Temp\cb15f9234cadbfd951c61339905693f6c8554fa2c89a31028da87774b55870f8.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\cb15f9234cadbfd951c61339905693f6c8554fa2c89a31028da87774b55870f8.exe"C:\Users\Admin\AppData\Local\Temp\cb15f9234cadbfd951c61339905693f6c8554fa2c89a31028da87774b55870f8.exe"2⤵
- Modifies WinLogon for persistence
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Windsound\soundloader.exe"C:\Users\Admin\AppData\Roaming\Windsound\soundloader.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Windsound\soundloader.exe"C:\Users\Admin\AppData\Roaming\Windsound\soundloader.exe"4⤵
- Modifies firewall policy service
- Executes dropped EXE
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\Windsound\soundloader.exeFilesize
396KB
MD5d7f4b00a1c6f756a97bbd409e0e01e28
SHA17d0325baff23fc02a924c0033d9ca5205770ab94
SHA256cb15f9234cadbfd951c61339905693f6c8554fa2c89a31028da87774b55870f8
SHA512db4454bcc0bc09952ac46dd18aa9a41971c52624394795c84d81625f3ba1a9f484918379d767b97a0dc9a8f232df10e541f232e42f6211e116aadbb09f896911
-
C:\Users\Admin\AppData\Roaming\Windsound\soundloader.exeFilesize
396KB
MD5d7f4b00a1c6f756a97bbd409e0e01e28
SHA17d0325baff23fc02a924c0033d9ca5205770ab94
SHA256cb15f9234cadbfd951c61339905693f6c8554fa2c89a31028da87774b55870f8
SHA512db4454bcc0bc09952ac46dd18aa9a41971c52624394795c84d81625f3ba1a9f484918379d767b97a0dc9a8f232df10e541f232e42f6211e116aadbb09f896911
-
C:\Users\Admin\AppData\Roaming\Windsound\soundloader.exeFilesize
396KB
MD5d7f4b00a1c6f756a97bbd409e0e01e28
SHA17d0325baff23fc02a924c0033d9ca5205770ab94
SHA256cb15f9234cadbfd951c61339905693f6c8554fa2c89a31028da87774b55870f8
SHA512db4454bcc0bc09952ac46dd18aa9a41971c52624394795c84d81625f3ba1a9f484918379d767b97a0dc9a8f232df10e541f232e42f6211e116aadbb09f896911
-
\Users\Admin\AppData\Roaming\Windsound\soundloader.exeFilesize
396KB
MD5d7f4b00a1c6f756a97bbd409e0e01e28
SHA17d0325baff23fc02a924c0033d9ca5205770ab94
SHA256cb15f9234cadbfd951c61339905693f6c8554fa2c89a31028da87774b55870f8
SHA512db4454bcc0bc09952ac46dd18aa9a41971c52624394795c84d81625f3ba1a9f484918379d767b97a0dc9a8f232df10e541f232e42f6211e116aadbb09f896911
-
\Users\Admin\AppData\Roaming\Windsound\soundloader.exeFilesize
396KB
MD5d7f4b00a1c6f756a97bbd409e0e01e28
SHA17d0325baff23fc02a924c0033d9ca5205770ab94
SHA256cb15f9234cadbfd951c61339905693f6c8554fa2c89a31028da87774b55870f8
SHA512db4454bcc0bc09952ac46dd18aa9a41971c52624394795c84d81625f3ba1a9f484918379d767b97a0dc9a8f232df10e541f232e42f6211e116aadbb09f896911
-
memory/332-69-0x0000000000000000-mapping.dmp
-
memory/1788-80-0x00000000004B7AB0-mapping.dmp
-
memory/1788-87-0x0000000000400000-0x00000000004B9000-memory.dmpFilesize
740KB
-
memory/1788-86-0x0000000000400000-0x00000000004B9000-memory.dmpFilesize
740KB
-
memory/1788-85-0x0000000000400000-0x00000000004B9000-memory.dmpFilesize
740KB
-
memory/1788-84-0x0000000000400000-0x00000000004B9000-memory.dmpFilesize
740KB
-
memory/1924-56-0x0000000000400000-0x00000000004B9000-memory.dmpFilesize
740KB
-
memory/1924-60-0x0000000000400000-0x00000000004B9000-memory.dmpFilesize
740KB
-
memory/1924-61-0x00000000004B7AB0-mapping.dmp
-
memory/1924-71-0x0000000000400000-0x00000000004B9000-memory.dmpFilesize
740KB
-
memory/1924-59-0x0000000000400000-0x00000000004B9000-memory.dmpFilesize
740KB
-
memory/1924-62-0x0000000000400000-0x00000000004B9000-memory.dmpFilesize
740KB
-
memory/1924-57-0x0000000000400000-0x00000000004B9000-memory.dmpFilesize
740KB
-
memory/1924-63-0x0000000000400000-0x00000000004B9000-memory.dmpFilesize
740KB
-
memory/1924-66-0x0000000000400000-0x00000000004B9000-memory.dmpFilesize
740KB
-
memory/1924-65-0x0000000000400000-0x00000000004B9000-memory.dmpFilesize
740KB
-
memory/1924-64-0x0000000076931000-0x0000000076933000-memory.dmpFilesize
8KB