Analysis
-
max time kernel
152s -
max time network
46s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
02-12-2022 16:54
Static task
static1
Behavioral task
behavioral1
Sample
cc60a3d87ac021e103a5ab312de0ea8178808d6e060fe69b5947be94c770609d.exe
Resource
win7-20220812-en
General
-
Target
cc60a3d87ac021e103a5ab312de0ea8178808d6e060fe69b5947be94c770609d.exe
-
Size
628KB
-
MD5
34a70ea0794d10fceb96fadb5df4483e
-
SHA1
6696d5b98801dcffa8d7274ef6ce734a884f9df2
-
SHA256
cc60a3d87ac021e103a5ab312de0ea8178808d6e060fe69b5947be94c770609d
-
SHA512
7d784cc70b11bbff77a89df03c2a58b81584b7c4d814ea80fa98ec972883012da860bfaf053d0be78156a09c6af903e61c4b1c1b5ce64990cbc12de1fa0ebdf8
-
SSDEEP
12288:Z6I6olZkgjeeO26i5Y3nD0RcJd+nwmW/K13qiLLOl51kfgjdlA:Z6I6ol2wYXD0mJd+nMKhjaOgjU
Malware Config
Extracted
darkcomet
Guest16
hesco.no-ip.info:1604
DC_MUTEX-7V9Z9HT
-
gencode
iijrV9uD8LxD
-
install
false
-
offline_keylogger
true
-
persistence
false
Signatures
-
Executes dropped EXE 2 IoCs
Processes:
msadrh10.exelsasrv.exepid process 1452 msadrh10.exe 904 lsasrv.exe -
Processes:
resource yara_rule behavioral1/memory/1728-58-0x0000000000400000-0x00000000004BA000-memory.dmp upx behavioral1/memory/1728-60-0x0000000000400000-0x00000000004BA000-memory.dmp upx behavioral1/memory/1728-61-0x0000000000400000-0x00000000004BA000-memory.dmp upx behavioral1/memory/1728-63-0x0000000000400000-0x00000000004BA000-memory.dmp upx behavioral1/memory/1728-65-0x0000000000400000-0x00000000004BA000-memory.dmp upx behavioral1/memory/1728-72-0x0000000000400000-0x00000000004BA000-memory.dmp upx behavioral1/memory/1728-74-0x0000000000400000-0x00000000004BA000-memory.dmp upx behavioral1/memory/1728-75-0x0000000000400000-0x00000000004BA000-memory.dmp upx -
Loads dropped DLL 2 IoCs
Processes:
cc60a3d87ac021e103a5ab312de0ea8178808d6e060fe69b5947be94c770609d.exepid process 1980 cc60a3d87ac021e103a5ab312de0ea8178808d6e060fe69b5947be94c770609d.exe 1980 cc60a3d87ac021e103a5ab312de0ea8178808d6e060fe69b5947be94c770609d.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
msadrh10.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft® Windows® Operating System = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Templates\\msadrh10.exe" msadrh10.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
cc60a3d87ac021e103a5ab312de0ea8178808d6e060fe69b5947be94c770609d.exelsasrv.exedescription pid process target process PID 1980 set thread context of 1728 1980 cc60a3d87ac021e103a5ab312de0ea8178808d6e060fe69b5947be94c770609d.exe AppLaunch.exe PID 904 set thread context of 1572 904 lsasrv.exe AppLaunch.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
cc60a3d87ac021e103a5ab312de0ea8178808d6e060fe69b5947be94c770609d.exemsadrh10.exepid process 1980 cc60a3d87ac021e103a5ab312de0ea8178808d6e060fe69b5947be94c770609d.exe 1980 cc60a3d87ac021e103a5ab312de0ea8178808d6e060fe69b5947be94c770609d.exe 1452 msadrh10.exe 1980 cc60a3d87ac021e103a5ab312de0ea8178808d6e060fe69b5947be94c770609d.exe 1452 msadrh10.exe 1980 cc60a3d87ac021e103a5ab312de0ea8178808d6e060fe69b5947be94c770609d.exe 1452 msadrh10.exe 1980 cc60a3d87ac021e103a5ab312de0ea8178808d6e060fe69b5947be94c770609d.exe 1452 msadrh10.exe 1980 cc60a3d87ac021e103a5ab312de0ea8178808d6e060fe69b5947be94c770609d.exe 1452 msadrh10.exe 1980 cc60a3d87ac021e103a5ab312de0ea8178808d6e060fe69b5947be94c770609d.exe 1452 msadrh10.exe 1980 cc60a3d87ac021e103a5ab312de0ea8178808d6e060fe69b5947be94c770609d.exe 1452 msadrh10.exe 1980 cc60a3d87ac021e103a5ab312de0ea8178808d6e060fe69b5947be94c770609d.exe 1452 msadrh10.exe 1980 cc60a3d87ac021e103a5ab312de0ea8178808d6e060fe69b5947be94c770609d.exe 1452 msadrh10.exe 1980 cc60a3d87ac021e103a5ab312de0ea8178808d6e060fe69b5947be94c770609d.exe 1452 msadrh10.exe 1980 cc60a3d87ac021e103a5ab312de0ea8178808d6e060fe69b5947be94c770609d.exe 1452 msadrh10.exe 1980 cc60a3d87ac021e103a5ab312de0ea8178808d6e060fe69b5947be94c770609d.exe 1452 msadrh10.exe 1980 cc60a3d87ac021e103a5ab312de0ea8178808d6e060fe69b5947be94c770609d.exe 1452 msadrh10.exe 1980 cc60a3d87ac021e103a5ab312de0ea8178808d6e060fe69b5947be94c770609d.exe 1452 msadrh10.exe 1980 cc60a3d87ac021e103a5ab312de0ea8178808d6e060fe69b5947be94c770609d.exe 1452 msadrh10.exe 1980 cc60a3d87ac021e103a5ab312de0ea8178808d6e060fe69b5947be94c770609d.exe 1452 msadrh10.exe 1980 cc60a3d87ac021e103a5ab312de0ea8178808d6e060fe69b5947be94c770609d.exe 1452 msadrh10.exe 1980 cc60a3d87ac021e103a5ab312de0ea8178808d6e060fe69b5947be94c770609d.exe 1452 msadrh10.exe 1980 cc60a3d87ac021e103a5ab312de0ea8178808d6e060fe69b5947be94c770609d.exe 1452 msadrh10.exe 1980 cc60a3d87ac021e103a5ab312de0ea8178808d6e060fe69b5947be94c770609d.exe 1452 msadrh10.exe 1980 cc60a3d87ac021e103a5ab312de0ea8178808d6e060fe69b5947be94c770609d.exe 1452 msadrh10.exe 1980 cc60a3d87ac021e103a5ab312de0ea8178808d6e060fe69b5947be94c770609d.exe 1452 msadrh10.exe 1980 cc60a3d87ac021e103a5ab312de0ea8178808d6e060fe69b5947be94c770609d.exe 1452 msadrh10.exe 1980 cc60a3d87ac021e103a5ab312de0ea8178808d6e060fe69b5947be94c770609d.exe 1452 msadrh10.exe 1980 cc60a3d87ac021e103a5ab312de0ea8178808d6e060fe69b5947be94c770609d.exe 1452 msadrh10.exe 1980 cc60a3d87ac021e103a5ab312de0ea8178808d6e060fe69b5947be94c770609d.exe 1452 msadrh10.exe 1980 cc60a3d87ac021e103a5ab312de0ea8178808d6e060fe69b5947be94c770609d.exe 1452 msadrh10.exe 1980 cc60a3d87ac021e103a5ab312de0ea8178808d6e060fe69b5947be94c770609d.exe 1452 msadrh10.exe 1980 cc60a3d87ac021e103a5ab312de0ea8178808d6e060fe69b5947be94c770609d.exe 1452 msadrh10.exe 1980 cc60a3d87ac021e103a5ab312de0ea8178808d6e060fe69b5947be94c770609d.exe 1452 msadrh10.exe 1980 cc60a3d87ac021e103a5ab312de0ea8178808d6e060fe69b5947be94c770609d.exe 1452 msadrh10.exe 1980 cc60a3d87ac021e103a5ab312de0ea8178808d6e060fe69b5947be94c770609d.exe -
Suspicious use of AdjustPrivilegeToken 49 IoCs
Processes:
cc60a3d87ac021e103a5ab312de0ea8178808d6e060fe69b5947be94c770609d.exeAppLaunch.exemsadrh10.exelsasrv.exeAppLaunch.exedescription pid process Token: SeDebugPrivilege 1980 cc60a3d87ac021e103a5ab312de0ea8178808d6e060fe69b5947be94c770609d.exe Token: SeIncreaseQuotaPrivilege 1728 AppLaunch.exe Token: SeSecurityPrivilege 1728 AppLaunch.exe Token: SeTakeOwnershipPrivilege 1728 AppLaunch.exe Token: SeLoadDriverPrivilege 1728 AppLaunch.exe Token: SeSystemProfilePrivilege 1728 AppLaunch.exe Token: SeSystemtimePrivilege 1728 AppLaunch.exe Token: SeProfSingleProcessPrivilege 1728 AppLaunch.exe Token: SeIncBasePriorityPrivilege 1728 AppLaunch.exe Token: SeCreatePagefilePrivilege 1728 AppLaunch.exe Token: SeBackupPrivilege 1728 AppLaunch.exe Token: SeRestorePrivilege 1728 AppLaunch.exe Token: SeShutdownPrivilege 1728 AppLaunch.exe Token: SeDebugPrivilege 1728 AppLaunch.exe Token: SeSystemEnvironmentPrivilege 1728 AppLaunch.exe Token: SeChangeNotifyPrivilege 1728 AppLaunch.exe Token: SeRemoteShutdownPrivilege 1728 AppLaunch.exe Token: SeUndockPrivilege 1728 AppLaunch.exe Token: SeManageVolumePrivilege 1728 AppLaunch.exe Token: SeImpersonatePrivilege 1728 AppLaunch.exe Token: SeCreateGlobalPrivilege 1728 AppLaunch.exe Token: 33 1728 AppLaunch.exe Token: 34 1728 AppLaunch.exe Token: 35 1728 AppLaunch.exe Token: SeDebugPrivilege 1452 msadrh10.exe Token: SeDebugPrivilege 904 lsasrv.exe Token: SeIncreaseQuotaPrivilege 1572 AppLaunch.exe Token: SeSecurityPrivilege 1572 AppLaunch.exe Token: SeTakeOwnershipPrivilege 1572 AppLaunch.exe Token: SeLoadDriverPrivilege 1572 AppLaunch.exe Token: SeSystemProfilePrivilege 1572 AppLaunch.exe Token: SeSystemtimePrivilege 1572 AppLaunch.exe Token: SeProfSingleProcessPrivilege 1572 AppLaunch.exe Token: SeIncBasePriorityPrivilege 1572 AppLaunch.exe Token: SeCreatePagefilePrivilege 1572 AppLaunch.exe Token: SeBackupPrivilege 1572 AppLaunch.exe Token: SeRestorePrivilege 1572 AppLaunch.exe Token: SeShutdownPrivilege 1572 AppLaunch.exe Token: SeDebugPrivilege 1572 AppLaunch.exe Token: SeSystemEnvironmentPrivilege 1572 AppLaunch.exe Token: SeChangeNotifyPrivilege 1572 AppLaunch.exe Token: SeRemoteShutdownPrivilege 1572 AppLaunch.exe Token: SeUndockPrivilege 1572 AppLaunch.exe Token: SeManageVolumePrivilege 1572 AppLaunch.exe Token: SeImpersonatePrivilege 1572 AppLaunch.exe Token: SeCreateGlobalPrivilege 1572 AppLaunch.exe Token: 33 1572 AppLaunch.exe Token: 34 1572 AppLaunch.exe Token: 35 1572 AppLaunch.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
AppLaunch.exepid process 1728 AppLaunch.exe -
Suspicious use of WriteProcessMemory 30 IoCs
Processes:
cc60a3d87ac021e103a5ab312de0ea8178808d6e060fe69b5947be94c770609d.exemsadrh10.exelsasrv.exedescription pid process target process PID 1980 wrote to memory of 1728 1980 cc60a3d87ac021e103a5ab312de0ea8178808d6e060fe69b5947be94c770609d.exe AppLaunch.exe PID 1980 wrote to memory of 1728 1980 cc60a3d87ac021e103a5ab312de0ea8178808d6e060fe69b5947be94c770609d.exe AppLaunch.exe PID 1980 wrote to memory of 1728 1980 cc60a3d87ac021e103a5ab312de0ea8178808d6e060fe69b5947be94c770609d.exe AppLaunch.exe PID 1980 wrote to memory of 1728 1980 cc60a3d87ac021e103a5ab312de0ea8178808d6e060fe69b5947be94c770609d.exe AppLaunch.exe PID 1980 wrote to memory of 1728 1980 cc60a3d87ac021e103a5ab312de0ea8178808d6e060fe69b5947be94c770609d.exe AppLaunch.exe PID 1980 wrote to memory of 1728 1980 cc60a3d87ac021e103a5ab312de0ea8178808d6e060fe69b5947be94c770609d.exe AppLaunch.exe PID 1980 wrote to memory of 1728 1980 cc60a3d87ac021e103a5ab312de0ea8178808d6e060fe69b5947be94c770609d.exe AppLaunch.exe PID 1980 wrote to memory of 1728 1980 cc60a3d87ac021e103a5ab312de0ea8178808d6e060fe69b5947be94c770609d.exe AppLaunch.exe PID 1980 wrote to memory of 1728 1980 cc60a3d87ac021e103a5ab312de0ea8178808d6e060fe69b5947be94c770609d.exe AppLaunch.exe PID 1980 wrote to memory of 1728 1980 cc60a3d87ac021e103a5ab312de0ea8178808d6e060fe69b5947be94c770609d.exe AppLaunch.exe PID 1980 wrote to memory of 1728 1980 cc60a3d87ac021e103a5ab312de0ea8178808d6e060fe69b5947be94c770609d.exe AppLaunch.exe PID 1980 wrote to memory of 1452 1980 cc60a3d87ac021e103a5ab312de0ea8178808d6e060fe69b5947be94c770609d.exe msadrh10.exe PID 1980 wrote to memory of 1452 1980 cc60a3d87ac021e103a5ab312de0ea8178808d6e060fe69b5947be94c770609d.exe msadrh10.exe PID 1980 wrote to memory of 1452 1980 cc60a3d87ac021e103a5ab312de0ea8178808d6e060fe69b5947be94c770609d.exe msadrh10.exe PID 1980 wrote to memory of 1452 1980 cc60a3d87ac021e103a5ab312de0ea8178808d6e060fe69b5947be94c770609d.exe msadrh10.exe PID 1452 wrote to memory of 904 1452 msadrh10.exe lsasrv.exe PID 1452 wrote to memory of 904 1452 msadrh10.exe lsasrv.exe PID 1452 wrote to memory of 904 1452 msadrh10.exe lsasrv.exe PID 1452 wrote to memory of 904 1452 msadrh10.exe lsasrv.exe PID 904 wrote to memory of 1572 904 lsasrv.exe AppLaunch.exe PID 904 wrote to memory of 1572 904 lsasrv.exe AppLaunch.exe PID 904 wrote to memory of 1572 904 lsasrv.exe AppLaunch.exe PID 904 wrote to memory of 1572 904 lsasrv.exe AppLaunch.exe PID 904 wrote to memory of 1572 904 lsasrv.exe AppLaunch.exe PID 904 wrote to memory of 1572 904 lsasrv.exe AppLaunch.exe PID 904 wrote to memory of 1572 904 lsasrv.exe AppLaunch.exe PID 904 wrote to memory of 1572 904 lsasrv.exe AppLaunch.exe PID 904 wrote to memory of 1572 904 lsasrv.exe AppLaunch.exe PID 904 wrote to memory of 1572 904 lsasrv.exe AppLaunch.exe PID 904 wrote to memory of 1572 904 lsasrv.exe AppLaunch.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\cc60a3d87ac021e103a5ab312de0ea8178808d6e060fe69b5947be94c770609d.exe"C:\Users\Admin\AppData\Local\Temp\cc60a3d87ac021e103a5ab312de0ea8178808d6e060fe69b5947be94c770609d.exe"1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exeC:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe2⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\msadrh10.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\msadrh10.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\lsasrv.exe"C:\Users\Admin\AppData\Local\Temp\lsasrv.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exeC:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe4⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\lsasrv.exeFilesize
628KB
MD534a70ea0794d10fceb96fadb5df4483e
SHA16696d5b98801dcffa8d7274ef6ce734a884f9df2
SHA256cc60a3d87ac021e103a5ab312de0ea8178808d6e060fe69b5947be94c770609d
SHA5127d784cc70b11bbff77a89df03c2a58b81584b7c4d814ea80fa98ec972883012da860bfaf053d0be78156a09c6af903e61c4b1c1b5ce64990cbc12de1fa0ebdf8
-
C:\Users\Admin\AppData\Local\Temp\lsasrv.exeFilesize
628KB
MD534a70ea0794d10fceb96fadb5df4483e
SHA16696d5b98801dcffa8d7274ef6ce734a884f9df2
SHA256cc60a3d87ac021e103a5ab312de0ea8178808d6e060fe69b5947be94c770609d
SHA5127d784cc70b11bbff77a89df03c2a58b81584b7c4d814ea80fa98ec972883012da860bfaf053d0be78156a09c6af903e61c4b1c1b5ce64990cbc12de1fa0ebdf8
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\msadrh10.exeFilesize
6KB
MD5a289f9e85e5f59fe882766cc239b50f2
SHA18ebf0bf6dfc02166409a300c15b9ebae97a47fd3
SHA256f02603a39bbe9323efe0b71b616d760011d0f64dc4ee02a1a80f46ba5c2c5bb4
SHA512bddb139e9f1632c62c5d0621404d07202bca6cb3a16a495bca71e9d4e531d3d835c2186bd19ac97ff2640c7fbbe2494ba4d18ac7d73e3b0b7549e48074eb8b2d
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\msadrh10.exeFilesize
6KB
MD5a289f9e85e5f59fe882766cc239b50f2
SHA18ebf0bf6dfc02166409a300c15b9ebae97a47fd3
SHA256f02603a39bbe9323efe0b71b616d760011d0f64dc4ee02a1a80f46ba5c2c5bb4
SHA512bddb139e9f1632c62c5d0621404d07202bca6cb3a16a495bca71e9d4e531d3d835c2186bd19ac97ff2640c7fbbe2494ba4d18ac7d73e3b0b7549e48074eb8b2d
-
\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\msadrh10.exeFilesize
6KB
MD5a289f9e85e5f59fe882766cc239b50f2
SHA18ebf0bf6dfc02166409a300c15b9ebae97a47fd3
SHA256f02603a39bbe9323efe0b71b616d760011d0f64dc4ee02a1a80f46ba5c2c5bb4
SHA512bddb139e9f1632c62c5d0621404d07202bca6cb3a16a495bca71e9d4e531d3d835c2186bd19ac97ff2640c7fbbe2494ba4d18ac7d73e3b0b7549e48074eb8b2d
-
\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\msadrh10.exeFilesize
6KB
MD5a289f9e85e5f59fe882766cc239b50f2
SHA18ebf0bf6dfc02166409a300c15b9ebae97a47fd3
SHA256f02603a39bbe9323efe0b71b616d760011d0f64dc4ee02a1a80f46ba5c2c5bb4
SHA512bddb139e9f1632c62c5d0621404d07202bca6cb3a16a495bca71e9d4e531d3d835c2186bd19ac97ff2640c7fbbe2494ba4d18ac7d73e3b0b7549e48074eb8b2d
-
memory/904-79-0x0000000000000000-mapping.dmp
-
memory/904-82-0x0000000074360000-0x000000007490B000-memory.dmpFilesize
5.7MB
-
memory/904-84-0x0000000074360000-0x000000007490B000-memory.dmpFilesize
5.7MB
-
memory/1452-76-0x000007FEFB831000-0x000007FEFB833000-memory.dmpFilesize
8KB
-
memory/1452-73-0x000007FEF3440000-0x000007FEF3E63000-memory.dmpFilesize
10.1MB
-
memory/1452-68-0x0000000000000000-mapping.dmp
-
memory/1572-90-0x00000000004B8BB0-mapping.dmp
-
memory/1572-98-0x000000000047B000-0x00000000004B9000-memory.dmpFilesize
248KB
-
memory/1728-61-0x0000000000400000-0x00000000004BA000-memory.dmpFilesize
744KB
-
memory/1728-58-0x0000000000400000-0x00000000004BA000-memory.dmpFilesize
744KB
-
memory/1728-74-0x0000000000400000-0x00000000004BA000-memory.dmpFilesize
744KB
-
memory/1728-75-0x0000000000400000-0x00000000004BA000-memory.dmpFilesize
744KB
-
memory/1728-65-0x0000000000400000-0x00000000004BA000-memory.dmpFilesize
744KB
-
memory/1728-63-0x0000000000400000-0x00000000004BA000-memory.dmpFilesize
744KB
-
memory/1728-77-0x000000000047B000-0x00000000004B9000-memory.dmpFilesize
248KB
-
memory/1728-57-0x0000000000400000-0x00000000004BA000-memory.dmpFilesize
744KB
-
memory/1728-62-0x00000000004B8BB0-mapping.dmp
-
memory/1728-60-0x0000000000400000-0x00000000004BA000-memory.dmpFilesize
744KB
-
memory/1728-72-0x0000000000400000-0x00000000004BA000-memory.dmpFilesize
744KB
-
memory/1728-83-0x000000000047B000-0x00000000004B9000-memory.dmpFilesize
248KB
-
memory/1980-54-0x0000000076031000-0x0000000076033000-memory.dmpFilesize
8KB
-
memory/1980-56-0x0000000074360000-0x000000007490B000-memory.dmpFilesize
5.7MB
-
memory/1980-55-0x0000000074360000-0x000000007490B000-memory.dmpFilesize
5.7MB