Analysis
-
max time kernel
179s -
max time network
190s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
02-12-2022 16:54
Static task
static1
Behavioral task
behavioral1
Sample
cc60a3d87ac021e103a5ab312de0ea8178808d6e060fe69b5947be94c770609d.exe
Resource
win7-20220812-en
General
-
Target
cc60a3d87ac021e103a5ab312de0ea8178808d6e060fe69b5947be94c770609d.exe
-
Size
628KB
-
MD5
34a70ea0794d10fceb96fadb5df4483e
-
SHA1
6696d5b98801dcffa8d7274ef6ce734a884f9df2
-
SHA256
cc60a3d87ac021e103a5ab312de0ea8178808d6e060fe69b5947be94c770609d
-
SHA512
7d784cc70b11bbff77a89df03c2a58b81584b7c4d814ea80fa98ec972883012da860bfaf053d0be78156a09c6af903e61c4b1c1b5ce64990cbc12de1fa0ebdf8
-
SSDEEP
12288:Z6I6olZkgjeeO26i5Y3nD0RcJd+nwmW/K13qiLLOl51kfgjdlA:Z6I6ol2wYXD0mJd+nMKhjaOgjU
Malware Config
Extracted
darkcomet
Guest16
hesco.no-ip.info:1604
DC_MUTEX-7V9Z9HT
-
gencode
iijrV9uD8LxD
-
install
false
-
offline_keylogger
true
-
persistence
false
Signatures
-
Executes dropped EXE 2 IoCs
Processes:
msadrh10.exelsasrv.exepid process 4404 msadrh10.exe 3056 lsasrv.exe -
Processes:
resource yara_rule behavioral2/memory/2284-135-0x0000000000400000-0x00000000004BA000-memory.dmp upx behavioral2/memory/2284-136-0x0000000000400000-0x00000000004BA000-memory.dmp upx behavioral2/memory/2284-137-0x0000000000400000-0x00000000004BA000-memory.dmp upx behavioral2/memory/2284-139-0x0000000000400000-0x00000000004BA000-memory.dmp upx behavioral2/memory/2284-138-0x0000000000400000-0x00000000004BA000-memory.dmp upx -
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
cc60a3d87ac021e103a5ab312de0ea8178808d6e060fe69b5947be94c770609d.exemsadrh10.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Control Panel\International\Geo\Nation cc60a3d87ac021e103a5ab312de0ea8178808d6e060fe69b5947be94c770609d.exe Key value queried \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Control Panel\International\Geo\Nation msadrh10.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
msadrh10.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Microsoft® Windows® Operating System = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Templates\\msadrh10.exe" msadrh10.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
cc60a3d87ac021e103a5ab312de0ea8178808d6e060fe69b5947be94c770609d.exelsasrv.exedescription pid process target process PID 1612 set thread context of 2284 1612 cc60a3d87ac021e103a5ab312de0ea8178808d6e060fe69b5947be94c770609d.exe AppLaunch.exe PID 3056 set thread context of 4872 3056 lsasrv.exe AppLaunch.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
cc60a3d87ac021e103a5ab312de0ea8178808d6e060fe69b5947be94c770609d.exemsadrh10.exepid process 1612 cc60a3d87ac021e103a5ab312de0ea8178808d6e060fe69b5947be94c770609d.exe 1612 cc60a3d87ac021e103a5ab312de0ea8178808d6e060fe69b5947be94c770609d.exe 1612 cc60a3d87ac021e103a5ab312de0ea8178808d6e060fe69b5947be94c770609d.exe 1612 cc60a3d87ac021e103a5ab312de0ea8178808d6e060fe69b5947be94c770609d.exe 1612 cc60a3d87ac021e103a5ab312de0ea8178808d6e060fe69b5947be94c770609d.exe 1612 cc60a3d87ac021e103a5ab312de0ea8178808d6e060fe69b5947be94c770609d.exe 1612 cc60a3d87ac021e103a5ab312de0ea8178808d6e060fe69b5947be94c770609d.exe 1612 cc60a3d87ac021e103a5ab312de0ea8178808d6e060fe69b5947be94c770609d.exe 1612 cc60a3d87ac021e103a5ab312de0ea8178808d6e060fe69b5947be94c770609d.exe 1612 cc60a3d87ac021e103a5ab312de0ea8178808d6e060fe69b5947be94c770609d.exe 4404 msadrh10.exe 1612 cc60a3d87ac021e103a5ab312de0ea8178808d6e060fe69b5947be94c770609d.exe 1612 cc60a3d87ac021e103a5ab312de0ea8178808d6e060fe69b5947be94c770609d.exe 1612 cc60a3d87ac021e103a5ab312de0ea8178808d6e060fe69b5947be94c770609d.exe 1612 cc60a3d87ac021e103a5ab312de0ea8178808d6e060fe69b5947be94c770609d.exe 1612 cc60a3d87ac021e103a5ab312de0ea8178808d6e060fe69b5947be94c770609d.exe 1612 cc60a3d87ac021e103a5ab312de0ea8178808d6e060fe69b5947be94c770609d.exe 4404 msadrh10.exe 1612 cc60a3d87ac021e103a5ab312de0ea8178808d6e060fe69b5947be94c770609d.exe 4404 msadrh10.exe 1612 cc60a3d87ac021e103a5ab312de0ea8178808d6e060fe69b5947be94c770609d.exe 4404 msadrh10.exe 1612 cc60a3d87ac021e103a5ab312de0ea8178808d6e060fe69b5947be94c770609d.exe 4404 msadrh10.exe 1612 cc60a3d87ac021e103a5ab312de0ea8178808d6e060fe69b5947be94c770609d.exe 4404 msadrh10.exe 1612 cc60a3d87ac021e103a5ab312de0ea8178808d6e060fe69b5947be94c770609d.exe 4404 msadrh10.exe 4404 msadrh10.exe 1612 cc60a3d87ac021e103a5ab312de0ea8178808d6e060fe69b5947be94c770609d.exe 1612 cc60a3d87ac021e103a5ab312de0ea8178808d6e060fe69b5947be94c770609d.exe 4404 msadrh10.exe 1612 cc60a3d87ac021e103a5ab312de0ea8178808d6e060fe69b5947be94c770609d.exe 4404 msadrh10.exe 4404 msadrh10.exe 1612 cc60a3d87ac021e103a5ab312de0ea8178808d6e060fe69b5947be94c770609d.exe 4404 msadrh10.exe 1612 cc60a3d87ac021e103a5ab312de0ea8178808d6e060fe69b5947be94c770609d.exe 1612 cc60a3d87ac021e103a5ab312de0ea8178808d6e060fe69b5947be94c770609d.exe 4404 msadrh10.exe 4404 msadrh10.exe 1612 cc60a3d87ac021e103a5ab312de0ea8178808d6e060fe69b5947be94c770609d.exe 4404 msadrh10.exe 1612 cc60a3d87ac021e103a5ab312de0ea8178808d6e060fe69b5947be94c770609d.exe 1612 cc60a3d87ac021e103a5ab312de0ea8178808d6e060fe69b5947be94c770609d.exe 4404 msadrh10.exe 4404 msadrh10.exe 1612 cc60a3d87ac021e103a5ab312de0ea8178808d6e060fe69b5947be94c770609d.exe 1612 cc60a3d87ac021e103a5ab312de0ea8178808d6e060fe69b5947be94c770609d.exe 4404 msadrh10.exe 4404 msadrh10.exe 1612 cc60a3d87ac021e103a5ab312de0ea8178808d6e060fe69b5947be94c770609d.exe 1612 cc60a3d87ac021e103a5ab312de0ea8178808d6e060fe69b5947be94c770609d.exe 4404 msadrh10.exe 4404 msadrh10.exe 1612 cc60a3d87ac021e103a5ab312de0ea8178808d6e060fe69b5947be94c770609d.exe 4404 msadrh10.exe 1612 cc60a3d87ac021e103a5ab312de0ea8178808d6e060fe69b5947be94c770609d.exe 4404 msadrh10.exe 1612 cc60a3d87ac021e103a5ab312de0ea8178808d6e060fe69b5947be94c770609d.exe 4404 msadrh10.exe 4404 msadrh10.exe 4404 msadrh10.exe 1612 cc60a3d87ac021e103a5ab312de0ea8178808d6e060fe69b5947be94c770609d.exe -
Suspicious use of AdjustPrivilegeToken 51 IoCs
Processes:
cc60a3d87ac021e103a5ab312de0ea8178808d6e060fe69b5947be94c770609d.exeAppLaunch.exemsadrh10.exelsasrv.exeAppLaunch.exedescription pid process Token: SeDebugPrivilege 1612 cc60a3d87ac021e103a5ab312de0ea8178808d6e060fe69b5947be94c770609d.exe Token: SeIncreaseQuotaPrivilege 2284 AppLaunch.exe Token: SeSecurityPrivilege 2284 AppLaunch.exe Token: SeTakeOwnershipPrivilege 2284 AppLaunch.exe Token: SeLoadDriverPrivilege 2284 AppLaunch.exe Token: SeSystemProfilePrivilege 2284 AppLaunch.exe Token: SeSystemtimePrivilege 2284 AppLaunch.exe Token: SeProfSingleProcessPrivilege 2284 AppLaunch.exe Token: SeIncBasePriorityPrivilege 2284 AppLaunch.exe Token: SeCreatePagefilePrivilege 2284 AppLaunch.exe Token: SeBackupPrivilege 2284 AppLaunch.exe Token: SeRestorePrivilege 2284 AppLaunch.exe Token: SeShutdownPrivilege 2284 AppLaunch.exe Token: SeDebugPrivilege 2284 AppLaunch.exe Token: SeSystemEnvironmentPrivilege 2284 AppLaunch.exe Token: SeChangeNotifyPrivilege 2284 AppLaunch.exe Token: SeRemoteShutdownPrivilege 2284 AppLaunch.exe Token: SeUndockPrivilege 2284 AppLaunch.exe Token: SeManageVolumePrivilege 2284 AppLaunch.exe Token: SeImpersonatePrivilege 2284 AppLaunch.exe Token: SeCreateGlobalPrivilege 2284 AppLaunch.exe Token: 33 2284 AppLaunch.exe Token: 34 2284 AppLaunch.exe Token: 35 2284 AppLaunch.exe Token: 36 2284 AppLaunch.exe Token: SeDebugPrivilege 4404 msadrh10.exe Token: SeDebugPrivilege 3056 lsasrv.exe Token: SeIncreaseQuotaPrivilege 4872 AppLaunch.exe Token: SeSecurityPrivilege 4872 AppLaunch.exe Token: SeTakeOwnershipPrivilege 4872 AppLaunch.exe Token: SeLoadDriverPrivilege 4872 AppLaunch.exe Token: SeSystemProfilePrivilege 4872 AppLaunch.exe Token: SeSystemtimePrivilege 4872 AppLaunch.exe Token: SeProfSingleProcessPrivilege 4872 AppLaunch.exe Token: SeIncBasePriorityPrivilege 4872 AppLaunch.exe Token: SeCreatePagefilePrivilege 4872 AppLaunch.exe Token: SeBackupPrivilege 4872 AppLaunch.exe Token: SeRestorePrivilege 4872 AppLaunch.exe Token: SeShutdownPrivilege 4872 AppLaunch.exe Token: SeDebugPrivilege 4872 AppLaunch.exe Token: SeSystemEnvironmentPrivilege 4872 AppLaunch.exe Token: SeChangeNotifyPrivilege 4872 AppLaunch.exe Token: SeRemoteShutdownPrivilege 4872 AppLaunch.exe Token: SeUndockPrivilege 4872 AppLaunch.exe Token: SeManageVolumePrivilege 4872 AppLaunch.exe Token: SeImpersonatePrivilege 4872 AppLaunch.exe Token: SeCreateGlobalPrivilege 4872 AppLaunch.exe Token: 33 4872 AppLaunch.exe Token: 34 4872 AppLaunch.exe Token: 35 4872 AppLaunch.exe Token: 36 4872 AppLaunch.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
AppLaunch.exepid process 2284 AppLaunch.exe -
Suspicious use of WriteProcessMemory 21 IoCs
Processes:
cc60a3d87ac021e103a5ab312de0ea8178808d6e060fe69b5947be94c770609d.exemsadrh10.exelsasrv.exedescription pid process target process PID 1612 wrote to memory of 2284 1612 cc60a3d87ac021e103a5ab312de0ea8178808d6e060fe69b5947be94c770609d.exe AppLaunch.exe PID 1612 wrote to memory of 2284 1612 cc60a3d87ac021e103a5ab312de0ea8178808d6e060fe69b5947be94c770609d.exe AppLaunch.exe PID 1612 wrote to memory of 2284 1612 cc60a3d87ac021e103a5ab312de0ea8178808d6e060fe69b5947be94c770609d.exe AppLaunch.exe PID 1612 wrote to memory of 2284 1612 cc60a3d87ac021e103a5ab312de0ea8178808d6e060fe69b5947be94c770609d.exe AppLaunch.exe PID 1612 wrote to memory of 2284 1612 cc60a3d87ac021e103a5ab312de0ea8178808d6e060fe69b5947be94c770609d.exe AppLaunch.exe PID 1612 wrote to memory of 2284 1612 cc60a3d87ac021e103a5ab312de0ea8178808d6e060fe69b5947be94c770609d.exe AppLaunch.exe PID 1612 wrote to memory of 2284 1612 cc60a3d87ac021e103a5ab312de0ea8178808d6e060fe69b5947be94c770609d.exe AppLaunch.exe PID 1612 wrote to memory of 2284 1612 cc60a3d87ac021e103a5ab312de0ea8178808d6e060fe69b5947be94c770609d.exe AppLaunch.exe PID 1612 wrote to memory of 4404 1612 cc60a3d87ac021e103a5ab312de0ea8178808d6e060fe69b5947be94c770609d.exe msadrh10.exe PID 1612 wrote to memory of 4404 1612 cc60a3d87ac021e103a5ab312de0ea8178808d6e060fe69b5947be94c770609d.exe msadrh10.exe PID 4404 wrote to memory of 3056 4404 msadrh10.exe lsasrv.exe PID 4404 wrote to memory of 3056 4404 msadrh10.exe lsasrv.exe PID 4404 wrote to memory of 3056 4404 msadrh10.exe lsasrv.exe PID 3056 wrote to memory of 4872 3056 lsasrv.exe AppLaunch.exe PID 3056 wrote to memory of 4872 3056 lsasrv.exe AppLaunch.exe PID 3056 wrote to memory of 4872 3056 lsasrv.exe AppLaunch.exe PID 3056 wrote to memory of 4872 3056 lsasrv.exe AppLaunch.exe PID 3056 wrote to memory of 4872 3056 lsasrv.exe AppLaunch.exe PID 3056 wrote to memory of 4872 3056 lsasrv.exe AppLaunch.exe PID 3056 wrote to memory of 4872 3056 lsasrv.exe AppLaunch.exe PID 3056 wrote to memory of 4872 3056 lsasrv.exe AppLaunch.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\cc60a3d87ac021e103a5ab312de0ea8178808d6e060fe69b5947be94c770609d.exe"C:\Users\Admin\AppData\Local\Temp\cc60a3d87ac021e103a5ab312de0ea8178808d6e060fe69b5947be94c770609d.exe"1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exeC:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe2⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\msadrh10.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\msadrh10.exe"2⤵
- Executes dropped EXE
- Checks computer location settings
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\lsasrv.exe"C:\Users\Admin\AppData\Local\Temp\lsasrv.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exeC:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe4⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\lsasrv.exeFilesize
628KB
MD534a70ea0794d10fceb96fadb5df4483e
SHA16696d5b98801dcffa8d7274ef6ce734a884f9df2
SHA256cc60a3d87ac021e103a5ab312de0ea8178808d6e060fe69b5947be94c770609d
SHA5127d784cc70b11bbff77a89df03c2a58b81584b7c4d814ea80fa98ec972883012da860bfaf053d0be78156a09c6af903e61c4b1c1b5ce64990cbc12de1fa0ebdf8
-
C:\Users\Admin\AppData\Local\Temp\lsasrv.exeFilesize
628KB
MD534a70ea0794d10fceb96fadb5df4483e
SHA16696d5b98801dcffa8d7274ef6ce734a884f9df2
SHA256cc60a3d87ac021e103a5ab312de0ea8178808d6e060fe69b5947be94c770609d
SHA5127d784cc70b11bbff77a89df03c2a58b81584b7c4d814ea80fa98ec972883012da860bfaf053d0be78156a09c6af903e61c4b1c1b5ce64990cbc12de1fa0ebdf8
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\msadrh10.exeFilesize
6KB
MD5a289f9e85e5f59fe882766cc239b50f2
SHA18ebf0bf6dfc02166409a300c15b9ebae97a47fd3
SHA256f02603a39bbe9323efe0b71b616d760011d0f64dc4ee02a1a80f46ba5c2c5bb4
SHA512bddb139e9f1632c62c5d0621404d07202bca6cb3a16a495bca71e9d4e531d3d835c2186bd19ac97ff2640c7fbbe2494ba4d18ac7d73e3b0b7549e48074eb8b2d
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\msadrh10.exeFilesize
6KB
MD5a289f9e85e5f59fe882766cc239b50f2
SHA18ebf0bf6dfc02166409a300c15b9ebae97a47fd3
SHA256f02603a39bbe9323efe0b71b616d760011d0f64dc4ee02a1a80f46ba5c2c5bb4
SHA512bddb139e9f1632c62c5d0621404d07202bca6cb3a16a495bca71e9d4e531d3d835c2186bd19ac97ff2640c7fbbe2494ba4d18ac7d73e3b0b7549e48074eb8b2d
-
memory/1612-133-0x00000000746C0000-0x0000000074C71000-memory.dmpFilesize
5.7MB
-
memory/1612-132-0x00000000746C0000-0x0000000074C71000-memory.dmpFilesize
5.7MB
-
memory/2284-136-0x0000000000400000-0x00000000004BA000-memory.dmpFilesize
744KB
-
memory/2284-138-0x0000000000400000-0x00000000004BA000-memory.dmpFilesize
744KB
-
memory/2284-139-0x0000000000400000-0x00000000004BA000-memory.dmpFilesize
744KB
-
memory/2284-137-0x0000000000400000-0x00000000004BA000-memory.dmpFilesize
744KB
-
memory/2284-135-0x0000000000400000-0x00000000004BA000-memory.dmpFilesize
744KB
-
memory/2284-134-0x0000000000000000-mapping.dmp
-
memory/3056-145-0x0000000000000000-mapping.dmp
-
memory/3056-147-0x00000000746C0000-0x0000000074C71000-memory.dmpFilesize
5.7MB
-
memory/3056-148-0x00000000746C0000-0x0000000074C71000-memory.dmpFilesize
5.7MB
-
memory/4404-140-0x0000000000000000-mapping.dmp
-
memory/4404-143-0x00007FF99C180000-0x00007FF99CBB6000-memory.dmpFilesize
10.2MB
-
memory/4872-149-0x0000000000000000-mapping.dmp