Analysis
-
max time kernel
162s -
max time network
170s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
02-12-2022 17:41
Static task
static1
Behavioral task
behavioral1
Sample
add5258839eba2f2e7a3f1c3378eacd734b52b7919c5c04fadd6e1ce41934ece.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
add5258839eba2f2e7a3f1c3378eacd734b52b7919c5c04fadd6e1ce41934ece.exe
Resource
win10v2004-20220812-en
General
-
Target
add5258839eba2f2e7a3f1c3378eacd734b52b7919c5c04fadd6e1ce41934ece.exe
-
Size
609KB
-
MD5
acd56cef01889b7ff2b8b1f39cbcf3f5
-
SHA1
683cfb3d1096845a611737ba331dc97629696900
-
SHA256
add5258839eba2f2e7a3f1c3378eacd734b52b7919c5c04fadd6e1ce41934ece
-
SHA512
254b25a4907582c6a9d7b562448b800376fdf490119d5972282b6f5b89f58ee3a5d6ecb70c83a663cf32e28a880da249a97212a5768dbec978b18b7338bb3744
-
SSDEEP
12288:use58KBby4sgTDh25dau/ONUBWGNQcEqFWEAr7BwhP42GlkshJRDdQQ9gU/:usepmg3hbqBucE/EAWhw20dQGg
Malware Config
Extracted
darkcomet
windowsreg
heyhey123.no-ip.org:1803
DC_MUTEX-Q4WFDU4
-
gencode
u5zZfFtsaBH9
-
install
false
-
offline_keylogger
true
-
persistence
false
Signatures
-
Executes dropped EXE 2 IoCs
Processes:
tmpDC7A.tmp.exetmpDC7A.tmp.exepid process 3080 tmpDC7A.tmp.exe 5044 tmpDC7A.tmp.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
add5258839eba2f2e7a3f1c3378eacd734b52b7919c5c04fadd6e1ce41934ece.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation add5258839eba2f2e7a3f1c3378eacd734b52b7919c5c04fadd6e1ce41934ece.exe -
Uses the VBS compiler for execution 1 TTPs
-
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
tmpDC7A.tmp.exetmpDC7A.tmp.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\1251160321 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\tmpDC7A.tmp.exe\"" tmpDC7A.tmp.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\1617546977 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\tmpDC7A.tmp.exe\"" tmpDC7A.tmp.exe -
Drops desktop.ini file(s) 2 IoCs
Processes:
add5258839eba2f2e7a3f1c3378eacd734b52b7919c5c04fadd6e1ce41934ece.exedescription ioc process File created C:\Windows\assembly\Desktop.ini add5258839eba2f2e7a3f1c3378eacd734b52b7919c5c04fadd6e1ce41934ece.exe File opened for modification C:\Windows\assembly\Desktop.ini add5258839eba2f2e7a3f1c3378eacd734b52b7919c5c04fadd6e1ce41934ece.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
add5258839eba2f2e7a3f1c3378eacd734b52b7919c5c04fadd6e1ce41934ece.exedescription pid process target process PID 736 set thread context of 636 736 add5258839eba2f2e7a3f1c3378eacd734b52b7919c5c04fadd6e1ce41934ece.exe vbc.exe -
Drops file in Windows directory 3 IoCs
Processes:
add5258839eba2f2e7a3f1c3378eacd734b52b7919c5c04fadd6e1ce41934ece.exedescription ioc process File opened for modification C:\Windows\assembly add5258839eba2f2e7a3f1c3378eacd734b52b7919c5c04fadd6e1ce41934ece.exe File created C:\Windows\assembly\Desktop.ini add5258839eba2f2e7a3f1c3378eacd734b52b7919c5c04fadd6e1ce41934ece.exe File opened for modification C:\Windows\assembly\Desktop.ini add5258839eba2f2e7a3f1c3378eacd734b52b7919c5c04fadd6e1ce41934ece.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of AdjustPrivilegeToken 27 IoCs
Processes:
add5258839eba2f2e7a3f1c3378eacd734b52b7919c5c04fadd6e1ce41934ece.exetmpDC7A.tmp.exetmpDC7A.tmp.exevbc.exedescription pid process Token: SeDebugPrivilege 736 add5258839eba2f2e7a3f1c3378eacd734b52b7919c5c04fadd6e1ce41934ece.exe Token: SeDebugPrivilege 3080 tmpDC7A.tmp.exe Token: SeDebugPrivilege 5044 tmpDC7A.tmp.exe Token: SeIncreaseQuotaPrivilege 636 vbc.exe Token: SeSecurityPrivilege 636 vbc.exe Token: SeTakeOwnershipPrivilege 636 vbc.exe Token: SeLoadDriverPrivilege 636 vbc.exe Token: SeSystemProfilePrivilege 636 vbc.exe Token: SeSystemtimePrivilege 636 vbc.exe Token: SeProfSingleProcessPrivilege 636 vbc.exe Token: SeIncBasePriorityPrivilege 636 vbc.exe Token: SeCreatePagefilePrivilege 636 vbc.exe Token: SeBackupPrivilege 636 vbc.exe Token: SeRestorePrivilege 636 vbc.exe Token: SeShutdownPrivilege 636 vbc.exe Token: SeDebugPrivilege 636 vbc.exe Token: SeSystemEnvironmentPrivilege 636 vbc.exe Token: SeChangeNotifyPrivilege 636 vbc.exe Token: SeRemoteShutdownPrivilege 636 vbc.exe Token: SeUndockPrivilege 636 vbc.exe Token: SeManageVolumePrivilege 636 vbc.exe Token: SeImpersonatePrivilege 636 vbc.exe Token: SeCreateGlobalPrivilege 636 vbc.exe Token: 33 636 vbc.exe Token: 34 636 vbc.exe Token: 35 636 vbc.exe Token: 36 636 vbc.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
vbc.exepid process 636 vbc.exe -
Suspicious use of WriteProcessMemory 20 IoCs
Processes:
add5258839eba2f2e7a3f1c3378eacd734b52b7919c5c04fadd6e1ce41934ece.exedescription pid process target process PID 736 wrote to memory of 3080 736 add5258839eba2f2e7a3f1c3378eacd734b52b7919c5c04fadd6e1ce41934ece.exe tmpDC7A.tmp.exe PID 736 wrote to memory of 3080 736 add5258839eba2f2e7a3f1c3378eacd734b52b7919c5c04fadd6e1ce41934ece.exe tmpDC7A.tmp.exe PID 736 wrote to memory of 3080 736 add5258839eba2f2e7a3f1c3378eacd734b52b7919c5c04fadd6e1ce41934ece.exe tmpDC7A.tmp.exe PID 736 wrote to memory of 5044 736 add5258839eba2f2e7a3f1c3378eacd734b52b7919c5c04fadd6e1ce41934ece.exe tmpDC7A.tmp.exe PID 736 wrote to memory of 5044 736 add5258839eba2f2e7a3f1c3378eacd734b52b7919c5c04fadd6e1ce41934ece.exe tmpDC7A.tmp.exe PID 736 wrote to memory of 5044 736 add5258839eba2f2e7a3f1c3378eacd734b52b7919c5c04fadd6e1ce41934ece.exe tmpDC7A.tmp.exe PID 736 wrote to memory of 636 736 add5258839eba2f2e7a3f1c3378eacd734b52b7919c5c04fadd6e1ce41934ece.exe vbc.exe PID 736 wrote to memory of 636 736 add5258839eba2f2e7a3f1c3378eacd734b52b7919c5c04fadd6e1ce41934ece.exe vbc.exe PID 736 wrote to memory of 636 736 add5258839eba2f2e7a3f1c3378eacd734b52b7919c5c04fadd6e1ce41934ece.exe vbc.exe PID 736 wrote to memory of 636 736 add5258839eba2f2e7a3f1c3378eacd734b52b7919c5c04fadd6e1ce41934ece.exe vbc.exe PID 736 wrote to memory of 636 736 add5258839eba2f2e7a3f1c3378eacd734b52b7919c5c04fadd6e1ce41934ece.exe vbc.exe PID 736 wrote to memory of 636 736 add5258839eba2f2e7a3f1c3378eacd734b52b7919c5c04fadd6e1ce41934ece.exe vbc.exe PID 736 wrote to memory of 636 736 add5258839eba2f2e7a3f1c3378eacd734b52b7919c5c04fadd6e1ce41934ece.exe vbc.exe PID 736 wrote to memory of 636 736 add5258839eba2f2e7a3f1c3378eacd734b52b7919c5c04fadd6e1ce41934ece.exe vbc.exe PID 736 wrote to memory of 636 736 add5258839eba2f2e7a3f1c3378eacd734b52b7919c5c04fadd6e1ce41934ece.exe vbc.exe PID 736 wrote to memory of 636 736 add5258839eba2f2e7a3f1c3378eacd734b52b7919c5c04fadd6e1ce41934ece.exe vbc.exe PID 736 wrote to memory of 636 736 add5258839eba2f2e7a3f1c3378eacd734b52b7919c5c04fadd6e1ce41934ece.exe vbc.exe PID 736 wrote to memory of 636 736 add5258839eba2f2e7a3f1c3378eacd734b52b7919c5c04fadd6e1ce41934ece.exe vbc.exe PID 736 wrote to memory of 636 736 add5258839eba2f2e7a3f1c3378eacd734b52b7919c5c04fadd6e1ce41934ece.exe vbc.exe PID 736 wrote to memory of 636 736 add5258839eba2f2e7a3f1c3378eacd734b52b7919c5c04fadd6e1ce41934ece.exe vbc.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\add5258839eba2f2e7a3f1c3378eacd734b52b7919c5c04fadd6e1ce41934ece.exe"C:\Users\Admin\AppData\Local\Temp\add5258839eba2f2e7a3f1c3378eacd734b52b7919c5c04fadd6e1ce41934ece.exe"1⤵
- Checks computer location settings
- Drops desktop.ini file(s)
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\tmpDC7A.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpDC7A.tmp.exe" -p2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\tmpDC7A.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpDC7A.tmp.exe" -p2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeC:\Windows\Microsoft.NET\Framework\v2.0.50727\\vbc.exe2⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v2.0_32\UsageLogs\tmpDC7A.tmp.exe.logFilesize
217B
MD5594f9a7c2c9174efbb2099b6b21ca0c1
SHA1859abbb672399e195267d2ebd57395ae9153dcd0
SHA2563f56509adf13b45203567538dcd316e5217122182ff5b051da5ea2edc6bbc9a7
SHA51213680a4fb1d115efb80d1fc2888420c48af6429360b6d14d77a60ed57d15c29233f424955e4b840a131d40881507b1465beeac1aa258b6ca20d311a668240b7d
-
C:\Users\Admin\AppData\Local\Temp\tmpDC7A.tmp.exeFilesize
609KB
MD5acd56cef01889b7ff2b8b1f39cbcf3f5
SHA1683cfb3d1096845a611737ba331dc97629696900
SHA256add5258839eba2f2e7a3f1c3378eacd734b52b7919c5c04fadd6e1ce41934ece
SHA512254b25a4907582c6a9d7b562448b800376fdf490119d5972282b6f5b89f58ee3a5d6ecb70c83a663cf32e28a880da249a97212a5768dbec978b18b7338bb3744
-
C:\Users\Admin\AppData\Local\Temp\tmpDC7A.tmp.exeFilesize
609KB
MD5acd56cef01889b7ff2b8b1f39cbcf3f5
SHA1683cfb3d1096845a611737ba331dc97629696900
SHA256add5258839eba2f2e7a3f1c3378eacd734b52b7919c5c04fadd6e1ce41934ece
SHA512254b25a4907582c6a9d7b562448b800376fdf490119d5972282b6f5b89f58ee3a5d6ecb70c83a663cf32e28a880da249a97212a5768dbec978b18b7338bb3744
-
C:\Users\Admin\AppData\Local\Temp\tmpDC7A.tmp.exeFilesize
609KB
MD5acd56cef01889b7ff2b8b1f39cbcf3f5
SHA1683cfb3d1096845a611737ba331dc97629696900
SHA256add5258839eba2f2e7a3f1c3378eacd734b52b7919c5c04fadd6e1ce41934ece
SHA512254b25a4907582c6a9d7b562448b800376fdf490119d5972282b6f5b89f58ee3a5d6ecb70c83a663cf32e28a880da249a97212a5768dbec978b18b7338bb3744
-
memory/636-143-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/636-141-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/636-140-0x0000000000000000-mapping.dmp
-
memory/636-142-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/636-145-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/636-147-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/736-132-0x0000000075360000-0x0000000075911000-memory.dmpFilesize
5.7MB
-
memory/736-146-0x0000000075360000-0x0000000075911000-memory.dmpFilesize
5.7MB
-
memory/3080-136-0x0000000075360000-0x0000000075911000-memory.dmpFilesize
5.7MB
-
memory/3080-133-0x0000000000000000-mapping.dmp
-
memory/5044-137-0x0000000000000000-mapping.dmp
-
memory/5044-144-0x0000000075360000-0x0000000075911000-memory.dmpFilesize
5.7MB