Analysis
-
max time kernel
153s -
max time network
174s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
03-12-2022 02:29
Static task
static1
Behavioral task
behavioral1
Sample
4123a31a7bc25e6a62bc2a0b63a09f123c8e357bdfd5c4e7f183e7f010149f5f.exe
Resource
win7-20221111-en
General
-
Target
4123a31a7bc25e6a62bc2a0b63a09f123c8e357bdfd5c4e7f183e7f010149f5f.exe
-
Size
772KB
-
MD5
68e8582308a2f05401ef6d076facd012
-
SHA1
2b2c9ed47453a7b8ef988da3d74af01e6d4340e6
-
SHA256
4123a31a7bc25e6a62bc2a0b63a09f123c8e357bdfd5c4e7f183e7f010149f5f
-
SHA512
14bd663c9c9ee8f4ac12774a14fd7a33108cf1fe7fed7afc8730719585e00521c4b12f03c5aba993f0ce98b6532794163b69c5a8bed84f71965c2d3f6e4fdcbc
-
SSDEEP
12288:7CuQHZyt8xPBhU2BNt1tBPOVsoaDWal2fdFP/Jh+xD6ikf:7CBxZjBl2DaOfTnbYW5f
Malware Config
Extracted
darkcomet
giriamo
178.239.178.177:200
DC_MUTEX-MBX97KS
-
gencode
RTdAVRUtBLYH
-
install
false
-
offline_keylogger
true
-
persistence
false
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
WinUpdate.exepid process 580 WinUpdate.exe -
Sets file to hidden 1 TTPs 2 IoCs
Modifies file attributes to stop it showing in Explorer etc.
Processes:
attrib.exeattrib.exepid process 1100 attrib.exe 316 attrib.exe -
Loads dropped DLL 1 IoCs
Processes:
4123a31a7bc25e6a62bc2a0b63a09f123c8e357bdfd5c4e7f183e7f010149f5f.exepid process 1260 4123a31a7bc25e6a62bc2a0b63a09f123c8e357bdfd5c4e7f183e7f010149f5f.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
4123a31a7bc25e6a62bc2a0b63a09f123c8e357bdfd5c4e7f183e7f010149f5f.exedescription pid process target process PID 1260 set thread context of 580 1260 4123a31a7bc25e6a62bc2a0b63a09f123c8e357bdfd5c4e7f183e7f010149f5f.exe WinUpdate.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
4123a31a7bc25e6a62bc2a0b63a09f123c8e357bdfd5c4e7f183e7f010149f5f.exepid process 1260 4123a31a7bc25e6a62bc2a0b63a09f123c8e357bdfd5c4e7f183e7f010149f5f.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
WinUpdate.exepid process 580 WinUpdate.exe -
Suspicious use of AdjustPrivilegeToken 24 IoCs
Processes:
4123a31a7bc25e6a62bc2a0b63a09f123c8e357bdfd5c4e7f183e7f010149f5f.exeWinUpdate.exedescription pid process Token: SeDebugPrivilege 1260 4123a31a7bc25e6a62bc2a0b63a09f123c8e357bdfd5c4e7f183e7f010149f5f.exe Token: SeIncreaseQuotaPrivilege 580 WinUpdate.exe Token: SeSecurityPrivilege 580 WinUpdate.exe Token: SeTakeOwnershipPrivilege 580 WinUpdate.exe Token: SeLoadDriverPrivilege 580 WinUpdate.exe Token: SeSystemProfilePrivilege 580 WinUpdate.exe Token: SeSystemtimePrivilege 580 WinUpdate.exe Token: SeProfSingleProcessPrivilege 580 WinUpdate.exe Token: SeIncBasePriorityPrivilege 580 WinUpdate.exe Token: SeCreatePagefilePrivilege 580 WinUpdate.exe Token: SeBackupPrivilege 580 WinUpdate.exe Token: SeRestorePrivilege 580 WinUpdate.exe Token: SeShutdownPrivilege 580 WinUpdate.exe Token: SeDebugPrivilege 580 WinUpdate.exe Token: SeSystemEnvironmentPrivilege 580 WinUpdate.exe Token: SeChangeNotifyPrivilege 580 WinUpdate.exe Token: SeRemoteShutdownPrivilege 580 WinUpdate.exe Token: SeUndockPrivilege 580 WinUpdate.exe Token: SeManageVolumePrivilege 580 WinUpdate.exe Token: SeImpersonatePrivilege 580 WinUpdate.exe Token: SeCreateGlobalPrivilege 580 WinUpdate.exe Token: 33 580 WinUpdate.exe Token: 34 580 WinUpdate.exe Token: 35 580 WinUpdate.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
DllHost.exepid process 1952 DllHost.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
WinUpdate.exepid process 580 WinUpdate.exe -
Suspicious use of WriteProcessMemory 55 IoCs
Processes:
4123a31a7bc25e6a62bc2a0b63a09f123c8e357bdfd5c4e7f183e7f010149f5f.exeWinUpdate.execmd.execmd.exedescription pid process target process PID 1260 wrote to memory of 580 1260 4123a31a7bc25e6a62bc2a0b63a09f123c8e357bdfd5c4e7f183e7f010149f5f.exe WinUpdate.exe PID 1260 wrote to memory of 580 1260 4123a31a7bc25e6a62bc2a0b63a09f123c8e357bdfd5c4e7f183e7f010149f5f.exe WinUpdate.exe PID 1260 wrote to memory of 580 1260 4123a31a7bc25e6a62bc2a0b63a09f123c8e357bdfd5c4e7f183e7f010149f5f.exe WinUpdate.exe PID 1260 wrote to memory of 580 1260 4123a31a7bc25e6a62bc2a0b63a09f123c8e357bdfd5c4e7f183e7f010149f5f.exe WinUpdate.exe PID 1260 wrote to memory of 580 1260 4123a31a7bc25e6a62bc2a0b63a09f123c8e357bdfd5c4e7f183e7f010149f5f.exe WinUpdate.exe PID 1260 wrote to memory of 580 1260 4123a31a7bc25e6a62bc2a0b63a09f123c8e357bdfd5c4e7f183e7f010149f5f.exe WinUpdate.exe PID 1260 wrote to memory of 580 1260 4123a31a7bc25e6a62bc2a0b63a09f123c8e357bdfd5c4e7f183e7f010149f5f.exe WinUpdate.exe PID 1260 wrote to memory of 580 1260 4123a31a7bc25e6a62bc2a0b63a09f123c8e357bdfd5c4e7f183e7f010149f5f.exe WinUpdate.exe PID 1260 wrote to memory of 580 1260 4123a31a7bc25e6a62bc2a0b63a09f123c8e357bdfd5c4e7f183e7f010149f5f.exe WinUpdate.exe PID 1260 wrote to memory of 580 1260 4123a31a7bc25e6a62bc2a0b63a09f123c8e357bdfd5c4e7f183e7f010149f5f.exe WinUpdate.exe PID 1260 wrote to memory of 580 1260 4123a31a7bc25e6a62bc2a0b63a09f123c8e357bdfd5c4e7f183e7f010149f5f.exe WinUpdate.exe PID 1260 wrote to memory of 580 1260 4123a31a7bc25e6a62bc2a0b63a09f123c8e357bdfd5c4e7f183e7f010149f5f.exe WinUpdate.exe PID 1260 wrote to memory of 580 1260 4123a31a7bc25e6a62bc2a0b63a09f123c8e357bdfd5c4e7f183e7f010149f5f.exe WinUpdate.exe PID 1260 wrote to memory of 580 1260 4123a31a7bc25e6a62bc2a0b63a09f123c8e357bdfd5c4e7f183e7f010149f5f.exe WinUpdate.exe PID 1260 wrote to memory of 580 1260 4123a31a7bc25e6a62bc2a0b63a09f123c8e357bdfd5c4e7f183e7f010149f5f.exe WinUpdate.exe PID 1260 wrote to memory of 580 1260 4123a31a7bc25e6a62bc2a0b63a09f123c8e357bdfd5c4e7f183e7f010149f5f.exe WinUpdate.exe PID 580 wrote to memory of 1592 580 WinUpdate.exe cmd.exe PID 580 wrote to memory of 1592 580 WinUpdate.exe cmd.exe PID 580 wrote to memory of 1592 580 WinUpdate.exe cmd.exe PID 580 wrote to memory of 1592 580 WinUpdate.exe cmd.exe PID 580 wrote to memory of 1012 580 WinUpdate.exe cmd.exe PID 580 wrote to memory of 1012 580 WinUpdate.exe cmd.exe PID 580 wrote to memory of 1012 580 WinUpdate.exe cmd.exe PID 580 wrote to memory of 1012 580 WinUpdate.exe cmd.exe PID 1592 wrote to memory of 316 1592 cmd.exe attrib.exe PID 1592 wrote to memory of 316 1592 cmd.exe attrib.exe PID 1592 wrote to memory of 316 1592 cmd.exe attrib.exe PID 1592 wrote to memory of 316 1592 cmd.exe attrib.exe PID 1012 wrote to memory of 1100 1012 cmd.exe attrib.exe PID 1012 wrote to memory of 1100 1012 cmd.exe attrib.exe PID 1012 wrote to memory of 1100 1012 cmd.exe attrib.exe PID 1012 wrote to memory of 1100 1012 cmd.exe attrib.exe PID 580 wrote to memory of 832 580 WinUpdate.exe notepad.exe PID 580 wrote to memory of 832 580 WinUpdate.exe notepad.exe PID 580 wrote to memory of 832 580 WinUpdate.exe notepad.exe PID 580 wrote to memory of 832 580 WinUpdate.exe notepad.exe PID 580 wrote to memory of 832 580 WinUpdate.exe notepad.exe PID 580 wrote to memory of 832 580 WinUpdate.exe notepad.exe PID 580 wrote to memory of 832 580 WinUpdate.exe notepad.exe PID 580 wrote to memory of 832 580 WinUpdate.exe notepad.exe PID 580 wrote to memory of 832 580 WinUpdate.exe notepad.exe PID 580 wrote to memory of 832 580 WinUpdate.exe notepad.exe PID 580 wrote to memory of 832 580 WinUpdate.exe notepad.exe PID 580 wrote to memory of 832 580 WinUpdate.exe notepad.exe PID 580 wrote to memory of 832 580 WinUpdate.exe notepad.exe PID 580 wrote to memory of 832 580 WinUpdate.exe notepad.exe PID 580 wrote to memory of 832 580 WinUpdate.exe notepad.exe PID 580 wrote to memory of 832 580 WinUpdate.exe notepad.exe PID 580 wrote to memory of 832 580 WinUpdate.exe notepad.exe PID 580 wrote to memory of 832 580 WinUpdate.exe notepad.exe PID 580 wrote to memory of 832 580 WinUpdate.exe notepad.exe PID 580 wrote to memory of 832 580 WinUpdate.exe notepad.exe PID 580 wrote to memory of 832 580 WinUpdate.exe notepad.exe PID 580 wrote to memory of 832 580 WinUpdate.exe notepad.exe PID 580 wrote to memory of 832 580 WinUpdate.exe notepad.exe -
Views/modifies file attributes 1 TTPs 2 IoCs
Processes:
attrib.exeattrib.exepid process 316 attrib.exe 1100 attrib.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\4123a31a7bc25e6a62bc2a0b63a09f123c8e357bdfd5c4e7f183e7f010149f5f.exe"C:\Users\Admin\AppData\Local\Temp\4123a31a7bc25e6a62bc2a0b63a09f123c8e357bdfd5c4e7f183e7f010149f5f.exe"1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\AppLunch\WinUpdate.exeC:\Users\Admin\AppData\Local\Temp\\AppLunch\WinUpdate.exe2⤵
- Executes dropped EXE
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp\AppLunch\WinUpdate.exe" +s +h3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Users\Admin\AppData\Local\Temp\AppLunch\WinUpdate.exe" +s +h4⤵
- Sets file to hidden
- Views/modifies file attributes
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp\AppLunch" +s +h3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Users\Admin\AppData\Local\Temp\AppLunch" +s +h4⤵
- Sets file to hidden
- Views/modifies file attributes
-
C:\Windows\SysWOW64\notepad.exenotepad3⤵
-
C:\Windows\SysWOW64\DllHost.exeC:\Windows\SysWOW64\DllHost.exe /Processid:{76D0CB12-7604-4048-B83C-1005C7DDC503}1⤵
- Suspicious use of FindShellTrayWindow
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\487436_494555917273809_1558112035_N.JPGFilesize
18KB
MD513c2d008789cd754f9be4e88b07e66b5
SHA1bf2cd3b19ac27b59115761bc0f451aace0467ae7
SHA2567a0ff3bc01cab8f1afd116473965076b3c5071f92523c4dc3aa968a8e9cfb3e5
SHA512151d75e7843009e81cd5f6c49e4f46087999ce4525e177db83c716840dcaa937dc6e8b2624e4ef3112ded3f7d9d2e9ca9410765908337ec02380e6a6f84deab7
-
C:\Users\Admin\AppData\Local\Temp\AppLunch\WinUpdate.exeFilesize
1.1MB
MD534aa912defa18c2c129f1e09d75c1d7e
SHA19c3046324657505a30ecd9b1fdb46c05bde7d470
SHA2566df94b7fa33f1b87142adc39b3db0613fc520d9e7a5fd6a5301dd7f51f8d0386
SHA512d1ea9368f5d7166180612fd763c87afb647d088498887961f5e7fb0a10f4a808bd5928e8a3666d70ff794093c51ecca8816f75dd47652fd4eb23dce7f9aa1f98
-
C:\Users\Admin\AppData\Local\Temp\AppLunch\WinUpdate.exeFilesize
1.1MB
MD534aa912defa18c2c129f1e09d75c1d7e
SHA19c3046324657505a30ecd9b1fdb46c05bde7d470
SHA2566df94b7fa33f1b87142adc39b3db0613fc520d9e7a5fd6a5301dd7f51f8d0386
SHA512d1ea9368f5d7166180612fd763c87afb647d088498887961f5e7fb0a10f4a808bd5928e8a3666d70ff794093c51ecca8816f75dd47652fd4eb23dce7f9aa1f98
-
\Users\Admin\AppData\Local\Temp\AppLunch\WinUpdate.exeFilesize
1.1MB
MD534aa912defa18c2c129f1e09d75c1d7e
SHA19c3046324657505a30ecd9b1fdb46c05bde7d470
SHA2566df94b7fa33f1b87142adc39b3db0613fc520d9e7a5fd6a5301dd7f51f8d0386
SHA512d1ea9368f5d7166180612fd763c87afb647d088498887961f5e7fb0a10f4a808bd5928e8a3666d70ff794093c51ecca8816f75dd47652fd4eb23dce7f9aa1f98
-
memory/316-82-0x0000000000000000-mapping.dmp
-
memory/580-62-0x0000000000400000-0x00000000004B6000-memory.dmpFilesize
728KB
-
memory/580-76-0x0000000000400000-0x00000000004B6000-memory.dmpFilesize
728KB
-
memory/580-90-0x0000000000400000-0x00000000004B6000-memory.dmpFilesize
728KB
-
memory/580-64-0x0000000000400000-0x00000000004B6000-memory.dmpFilesize
728KB
-
memory/580-66-0x0000000000400000-0x00000000004B6000-memory.dmpFilesize
728KB
-
memory/580-69-0x0000000000400000-0x00000000004B6000-memory.dmpFilesize
728KB
-
memory/580-68-0x0000000000400000-0x00000000004B6000-memory.dmpFilesize
728KB
-
memory/580-71-0x0000000000400000-0x00000000004B6000-memory.dmpFilesize
728KB
-
memory/580-74-0x000000000048F888-mapping.dmp
-
memory/580-73-0x0000000000400000-0x00000000004B6000-memory.dmpFilesize
728KB
-
memory/580-59-0x0000000000400000-0x00000000004B6000-memory.dmpFilesize
728KB
-
memory/580-60-0x0000000000400000-0x00000000004B6000-memory.dmpFilesize
728KB
-
memory/580-78-0x0000000000400000-0x00000000004B6000-memory.dmpFilesize
728KB
-
memory/580-84-0x0000000000400000-0x00000000004B6000-memory.dmpFilesize
728KB
-
memory/832-87-0x0000000000000000-mapping.dmp
-
memory/1012-81-0x0000000000000000-mapping.dmp
-
memory/1100-83-0x0000000000000000-mapping.dmp
-
memory/1260-56-0x0000000074C90000-0x000000007523B000-memory.dmpFilesize
5.7MB
-
memory/1260-57-0x00000000003B5000-0x00000000003C6000-memory.dmpFilesize
68KB
-
memory/1260-55-0x0000000074C90000-0x000000007523B000-memory.dmpFilesize
5.7MB
-
memory/1260-89-0x00000000003B5000-0x00000000003C6000-memory.dmpFilesize
68KB
-
memory/1260-54-0x0000000075C41000-0x0000000075C43000-memory.dmpFilesize
8KB
-
memory/1592-80-0x0000000000000000-mapping.dmp