Analysis
-
max time kernel
186s -
max time network
194s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
02-12-2022 12:47
Static task
static1
Behavioral task
behavioral1
Sample
cb15f9234cadbfd951c61339905693f6c8554fa2c89a31028da87774b55870f8.exe
Resource
win7-20221111-en
General
-
Target
cb15f9234cadbfd951c61339905693f6c8554fa2c89a31028da87774b55870f8.exe
-
Size
396KB
-
MD5
d7f4b00a1c6f756a97bbd409e0e01e28
-
SHA1
7d0325baff23fc02a924c0033d9ca5205770ab94
-
SHA256
cb15f9234cadbfd951c61339905693f6c8554fa2c89a31028da87774b55870f8
-
SHA512
db4454bcc0bc09952ac46dd18aa9a41971c52624394795c84d81625f3ba1a9f484918379d767b97a0dc9a8f232df10e541f232e42f6211e116aadbb09f896911
-
SSDEEP
6144:yzuqM8bSZzkD9MvPGm7uDwG6tVsa8ez4d6O5Gtl50LyNdsy9eIkZg0ar:j8yE9cuvDkWazhD9dsyMI8cr
Malware Config
Extracted
darkcomet
victima
critical.zapto.org:1604
DC_MUTEX-ADY5V62
-
InstallPath
Windsound\soundloader.exe
-
gencode
abg2bucWtxxq
-
install
true
-
offline_keylogger
true
-
persistence
false
-
reg_key
MicroUpdate
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
Processes:
cb15f9234cadbfd951c61339905693f6c8554fa2c89a31028da87774b55870f8.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Users\\Admin\\AppData\\Roaming\\Windsound\\soundloader.exe" cb15f9234cadbfd951c61339905693f6c8554fa2c89a31028da87774b55870f8.exe -
Modifies firewall policy service 2 TTPs 3 IoCs
Processes:
soundloader.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "0" soundloader.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile soundloader.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" soundloader.exe -
Executes dropped EXE 2 IoCs
Processes:
soundloader.exesoundloader.exepid process 5060 soundloader.exe 4540 soundloader.exe -
Processes:
resource yara_rule behavioral2/memory/4820-135-0x0000000000400000-0x00000000004B9000-memory.dmp upx behavioral2/memory/4820-136-0x0000000000400000-0x00000000004B9000-memory.dmp upx behavioral2/memory/4820-137-0x0000000000400000-0x00000000004B9000-memory.dmp upx behavioral2/memory/4820-138-0x0000000000400000-0x00000000004B9000-memory.dmp upx behavioral2/memory/4820-139-0x0000000000400000-0x00000000004B9000-memory.dmp upx behavioral2/memory/4540-149-0x0000000000400000-0x00000000004B9000-memory.dmp upx behavioral2/memory/4540-150-0x0000000000400000-0x00000000004B9000-memory.dmp upx behavioral2/memory/4540-151-0x0000000000400000-0x00000000004B9000-memory.dmp upx behavioral2/memory/4540-152-0x0000000000400000-0x00000000004B9000-memory.dmp upx -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
cb15f9234cadbfd951c61339905693f6c8554fa2c89a31028da87774b55870f8.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\Control Panel\International\Geo\Nation cb15f9234cadbfd951c61339905693f6c8554fa2c89a31028da87774b55870f8.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
cb15f9234cadbfd951c61339905693f6c8554fa2c89a31028da87774b55870f8.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Users\\Admin\\AppData\\Roaming\\Windsound\\soundloader.exe" cb15f9234cadbfd951c61339905693f6c8554fa2c89a31028da87774b55870f8.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
cb15f9234cadbfd951c61339905693f6c8554fa2c89a31028da87774b55870f8.exesoundloader.exedescription pid process target process PID 4420 set thread context of 4820 4420 cb15f9234cadbfd951c61339905693f6c8554fa2c89a31028da87774b55870f8.exe cb15f9234cadbfd951c61339905693f6c8554fa2c89a31028da87774b55870f8.exe PID 5060 set thread context of 4540 5060 soundloader.exe soundloader.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Modifies registry class 1 IoCs
Processes:
cb15f9234cadbfd951c61339905693f6c8554fa2c89a31028da87774b55870f8.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ cb15f9234cadbfd951c61339905693f6c8554fa2c89a31028da87774b55870f8.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
soundloader.exepid process 4540 soundloader.exe -
Suspicious use of AdjustPrivilegeToken 48 IoCs
Processes:
cb15f9234cadbfd951c61339905693f6c8554fa2c89a31028da87774b55870f8.exesoundloader.exedescription pid process Token: SeIncreaseQuotaPrivilege 4820 cb15f9234cadbfd951c61339905693f6c8554fa2c89a31028da87774b55870f8.exe Token: SeSecurityPrivilege 4820 cb15f9234cadbfd951c61339905693f6c8554fa2c89a31028da87774b55870f8.exe Token: SeTakeOwnershipPrivilege 4820 cb15f9234cadbfd951c61339905693f6c8554fa2c89a31028da87774b55870f8.exe Token: SeLoadDriverPrivilege 4820 cb15f9234cadbfd951c61339905693f6c8554fa2c89a31028da87774b55870f8.exe Token: SeSystemProfilePrivilege 4820 cb15f9234cadbfd951c61339905693f6c8554fa2c89a31028da87774b55870f8.exe Token: SeSystemtimePrivilege 4820 cb15f9234cadbfd951c61339905693f6c8554fa2c89a31028da87774b55870f8.exe Token: SeProfSingleProcessPrivilege 4820 cb15f9234cadbfd951c61339905693f6c8554fa2c89a31028da87774b55870f8.exe Token: SeIncBasePriorityPrivilege 4820 cb15f9234cadbfd951c61339905693f6c8554fa2c89a31028da87774b55870f8.exe Token: SeCreatePagefilePrivilege 4820 cb15f9234cadbfd951c61339905693f6c8554fa2c89a31028da87774b55870f8.exe Token: SeBackupPrivilege 4820 cb15f9234cadbfd951c61339905693f6c8554fa2c89a31028da87774b55870f8.exe Token: SeRestorePrivilege 4820 cb15f9234cadbfd951c61339905693f6c8554fa2c89a31028da87774b55870f8.exe Token: SeShutdownPrivilege 4820 cb15f9234cadbfd951c61339905693f6c8554fa2c89a31028da87774b55870f8.exe Token: SeDebugPrivilege 4820 cb15f9234cadbfd951c61339905693f6c8554fa2c89a31028da87774b55870f8.exe Token: SeSystemEnvironmentPrivilege 4820 cb15f9234cadbfd951c61339905693f6c8554fa2c89a31028da87774b55870f8.exe Token: SeChangeNotifyPrivilege 4820 cb15f9234cadbfd951c61339905693f6c8554fa2c89a31028da87774b55870f8.exe Token: SeRemoteShutdownPrivilege 4820 cb15f9234cadbfd951c61339905693f6c8554fa2c89a31028da87774b55870f8.exe Token: SeUndockPrivilege 4820 cb15f9234cadbfd951c61339905693f6c8554fa2c89a31028da87774b55870f8.exe Token: SeManageVolumePrivilege 4820 cb15f9234cadbfd951c61339905693f6c8554fa2c89a31028da87774b55870f8.exe Token: SeImpersonatePrivilege 4820 cb15f9234cadbfd951c61339905693f6c8554fa2c89a31028da87774b55870f8.exe Token: SeCreateGlobalPrivilege 4820 cb15f9234cadbfd951c61339905693f6c8554fa2c89a31028da87774b55870f8.exe Token: 33 4820 cb15f9234cadbfd951c61339905693f6c8554fa2c89a31028da87774b55870f8.exe Token: 34 4820 cb15f9234cadbfd951c61339905693f6c8554fa2c89a31028da87774b55870f8.exe Token: 35 4820 cb15f9234cadbfd951c61339905693f6c8554fa2c89a31028da87774b55870f8.exe Token: 36 4820 cb15f9234cadbfd951c61339905693f6c8554fa2c89a31028da87774b55870f8.exe Token: SeIncreaseQuotaPrivilege 4540 soundloader.exe Token: SeSecurityPrivilege 4540 soundloader.exe Token: SeTakeOwnershipPrivilege 4540 soundloader.exe Token: SeLoadDriverPrivilege 4540 soundloader.exe Token: SeSystemProfilePrivilege 4540 soundloader.exe Token: SeSystemtimePrivilege 4540 soundloader.exe Token: SeProfSingleProcessPrivilege 4540 soundloader.exe Token: SeIncBasePriorityPrivilege 4540 soundloader.exe Token: SeCreatePagefilePrivilege 4540 soundloader.exe Token: SeBackupPrivilege 4540 soundloader.exe Token: SeRestorePrivilege 4540 soundloader.exe Token: SeShutdownPrivilege 4540 soundloader.exe Token: SeDebugPrivilege 4540 soundloader.exe Token: SeSystemEnvironmentPrivilege 4540 soundloader.exe Token: SeChangeNotifyPrivilege 4540 soundloader.exe Token: SeRemoteShutdownPrivilege 4540 soundloader.exe Token: SeUndockPrivilege 4540 soundloader.exe Token: SeManageVolumePrivilege 4540 soundloader.exe Token: SeImpersonatePrivilege 4540 soundloader.exe Token: SeCreateGlobalPrivilege 4540 soundloader.exe Token: 33 4540 soundloader.exe Token: 34 4540 soundloader.exe Token: 35 4540 soundloader.exe Token: 36 4540 soundloader.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
Processes:
cb15f9234cadbfd951c61339905693f6c8554fa2c89a31028da87774b55870f8.exesoundloader.exesoundloader.exepid process 4420 cb15f9234cadbfd951c61339905693f6c8554fa2c89a31028da87774b55870f8.exe 5060 soundloader.exe 4540 soundloader.exe -
Suspicious use of WriteProcessMemory 19 IoCs
Processes:
cb15f9234cadbfd951c61339905693f6c8554fa2c89a31028da87774b55870f8.execb15f9234cadbfd951c61339905693f6c8554fa2c89a31028da87774b55870f8.exesoundloader.exedescription pid process target process PID 4420 wrote to memory of 4820 4420 cb15f9234cadbfd951c61339905693f6c8554fa2c89a31028da87774b55870f8.exe cb15f9234cadbfd951c61339905693f6c8554fa2c89a31028da87774b55870f8.exe PID 4420 wrote to memory of 4820 4420 cb15f9234cadbfd951c61339905693f6c8554fa2c89a31028da87774b55870f8.exe cb15f9234cadbfd951c61339905693f6c8554fa2c89a31028da87774b55870f8.exe PID 4420 wrote to memory of 4820 4420 cb15f9234cadbfd951c61339905693f6c8554fa2c89a31028da87774b55870f8.exe cb15f9234cadbfd951c61339905693f6c8554fa2c89a31028da87774b55870f8.exe PID 4420 wrote to memory of 4820 4420 cb15f9234cadbfd951c61339905693f6c8554fa2c89a31028da87774b55870f8.exe cb15f9234cadbfd951c61339905693f6c8554fa2c89a31028da87774b55870f8.exe PID 4420 wrote to memory of 4820 4420 cb15f9234cadbfd951c61339905693f6c8554fa2c89a31028da87774b55870f8.exe cb15f9234cadbfd951c61339905693f6c8554fa2c89a31028da87774b55870f8.exe PID 4420 wrote to memory of 4820 4420 cb15f9234cadbfd951c61339905693f6c8554fa2c89a31028da87774b55870f8.exe cb15f9234cadbfd951c61339905693f6c8554fa2c89a31028da87774b55870f8.exe PID 4420 wrote to memory of 4820 4420 cb15f9234cadbfd951c61339905693f6c8554fa2c89a31028da87774b55870f8.exe cb15f9234cadbfd951c61339905693f6c8554fa2c89a31028da87774b55870f8.exe PID 4420 wrote to memory of 4820 4420 cb15f9234cadbfd951c61339905693f6c8554fa2c89a31028da87774b55870f8.exe cb15f9234cadbfd951c61339905693f6c8554fa2c89a31028da87774b55870f8.exe PID 4820 wrote to memory of 5060 4820 cb15f9234cadbfd951c61339905693f6c8554fa2c89a31028da87774b55870f8.exe soundloader.exe PID 4820 wrote to memory of 5060 4820 cb15f9234cadbfd951c61339905693f6c8554fa2c89a31028da87774b55870f8.exe soundloader.exe PID 4820 wrote to memory of 5060 4820 cb15f9234cadbfd951c61339905693f6c8554fa2c89a31028da87774b55870f8.exe soundloader.exe PID 5060 wrote to memory of 4540 5060 soundloader.exe soundloader.exe PID 5060 wrote to memory of 4540 5060 soundloader.exe soundloader.exe PID 5060 wrote to memory of 4540 5060 soundloader.exe soundloader.exe PID 5060 wrote to memory of 4540 5060 soundloader.exe soundloader.exe PID 5060 wrote to memory of 4540 5060 soundloader.exe soundloader.exe PID 5060 wrote to memory of 4540 5060 soundloader.exe soundloader.exe PID 5060 wrote to memory of 4540 5060 soundloader.exe soundloader.exe PID 5060 wrote to memory of 4540 5060 soundloader.exe soundloader.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\cb15f9234cadbfd951c61339905693f6c8554fa2c89a31028da87774b55870f8.exe"C:\Users\Admin\AppData\Local\Temp\cb15f9234cadbfd951c61339905693f6c8554fa2c89a31028da87774b55870f8.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\cb15f9234cadbfd951c61339905693f6c8554fa2c89a31028da87774b55870f8.exe"C:\Users\Admin\AppData\Local\Temp\cb15f9234cadbfd951c61339905693f6c8554fa2c89a31028da87774b55870f8.exe"2⤵
- Modifies WinLogon for persistence
- Checks computer location settings
- Adds Run key to start application
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Windsound\soundloader.exe"C:\Users\Admin\AppData\Roaming\Windsound\soundloader.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Windsound\soundloader.exe"C:\Users\Admin\AppData\Roaming\Windsound\soundloader.exe"4⤵
- Modifies firewall policy service
- Executes dropped EXE
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\Windsound\soundloader.exeFilesize
396KB
MD5d7f4b00a1c6f756a97bbd409e0e01e28
SHA17d0325baff23fc02a924c0033d9ca5205770ab94
SHA256cb15f9234cadbfd951c61339905693f6c8554fa2c89a31028da87774b55870f8
SHA512db4454bcc0bc09952ac46dd18aa9a41971c52624394795c84d81625f3ba1a9f484918379d767b97a0dc9a8f232df10e541f232e42f6211e116aadbb09f896911
-
C:\Users\Admin\AppData\Roaming\Windsound\soundloader.exeFilesize
396KB
MD5d7f4b00a1c6f756a97bbd409e0e01e28
SHA17d0325baff23fc02a924c0033d9ca5205770ab94
SHA256cb15f9234cadbfd951c61339905693f6c8554fa2c89a31028da87774b55870f8
SHA512db4454bcc0bc09952ac46dd18aa9a41971c52624394795c84d81625f3ba1a9f484918379d767b97a0dc9a8f232df10e541f232e42f6211e116aadbb09f896911
-
C:\Users\Admin\AppData\Roaming\Windsound\soundloader.exeFilesize
396KB
MD5d7f4b00a1c6f756a97bbd409e0e01e28
SHA17d0325baff23fc02a924c0033d9ca5205770ab94
SHA256cb15f9234cadbfd951c61339905693f6c8554fa2c89a31028da87774b55870f8
SHA512db4454bcc0bc09952ac46dd18aa9a41971c52624394795c84d81625f3ba1a9f484918379d767b97a0dc9a8f232df10e541f232e42f6211e116aadbb09f896911
-
memory/4540-152-0x0000000000400000-0x00000000004B9000-memory.dmpFilesize
740KB
-
memory/4540-151-0x0000000000400000-0x00000000004B9000-memory.dmpFilesize
740KB
-
memory/4540-150-0x0000000000400000-0x00000000004B9000-memory.dmpFilesize
740KB
-
memory/4540-149-0x0000000000400000-0x00000000004B9000-memory.dmpFilesize
740KB
-
memory/4540-145-0x0000000000000000-mapping.dmp
-
memory/4820-137-0x0000000000400000-0x00000000004B9000-memory.dmpFilesize
740KB
-
memory/4820-139-0x0000000000400000-0x00000000004B9000-memory.dmpFilesize
740KB
-
memory/4820-138-0x0000000000400000-0x00000000004B9000-memory.dmpFilesize
740KB
-
memory/4820-134-0x0000000000000000-mapping.dmp
-
memory/4820-136-0x0000000000400000-0x00000000004B9000-memory.dmpFilesize
740KB
-
memory/4820-135-0x0000000000400000-0x00000000004B9000-memory.dmpFilesize
740KB
-
memory/5060-140-0x0000000000000000-mapping.dmp