Analysis
-
max time kernel
144s -
max time network
161s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
03-12-2022 02:49
Static task
static1
Behavioral task
behavioral1
Sample
b4d1ddba5d16a8e7d588a47b82ae1edd515ce9a7fc49e2463711e230fe7efd0a.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
b4d1ddba5d16a8e7d588a47b82ae1edd515ce9a7fc49e2463711e230fe7efd0a.exe
Resource
win10v2004-20220812-en
General
-
Target
b4d1ddba5d16a8e7d588a47b82ae1edd515ce9a7fc49e2463711e230fe7efd0a.exe
-
Size
609KB
-
MD5
331da72e491868ab31ce11fe02f5bb15
-
SHA1
bfbf35096f56e92f08815487e1cbb088efaf31e9
-
SHA256
b4d1ddba5d16a8e7d588a47b82ae1edd515ce9a7fc49e2463711e230fe7efd0a
-
SHA512
2b3930150894fb1b6e3f41fd5edeb25f6a68de005a9a20bdd02418a190805a9291c6185d2f7a8e3e3d4a42cbec92fc29d69b76d4d4cd486dd75963ccd6e6c71f
-
SSDEEP
12288:gzyFWnsipV73N8rA/gC+apkmvReK7E9zF9wTtTEC9NTvER+dZ07boQK1bhHl3:WfZpV7N8rA4i3Rak1JNLI+0oQ+hF
Malware Config
Extracted
darkcomet
Guest16
216.38.2.194:1608
DC_MUTEX-B3GGRXH
-
gencode
x22S1Hl5yBQe
-
install
false
-
offline_keylogger
true
-
persistence
false
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
tmpCA1B.tmp.exepid process 2228 tmpCA1B.tmp.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
b4d1ddba5d16a8e7d588a47b82ae1edd515ce9a7fc49e2463711e230fe7efd0a.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation b4d1ddba5d16a8e7d588a47b82ae1edd515ce9a7fc49e2463711e230fe7efd0a.exe -
Uses the VBS compiler for execution 1 TTPs
-
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
tmpCA1B.tmp.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\1709170799 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\tmpCA1B.tmp.exe\"" tmpCA1B.tmp.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
b4d1ddba5d16a8e7d588a47b82ae1edd515ce9a7fc49e2463711e230fe7efd0a.exedescription pid process target process PID 4840 set thread context of 1080 4840 b4d1ddba5d16a8e7d588a47b82ae1edd515ce9a7fc49e2463711e230fe7efd0a.exe vbc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of AdjustPrivilegeToken 26 IoCs
Processes:
b4d1ddba5d16a8e7d588a47b82ae1edd515ce9a7fc49e2463711e230fe7efd0a.exetmpCA1B.tmp.exevbc.exedescription pid process Token: SeDebugPrivilege 4840 b4d1ddba5d16a8e7d588a47b82ae1edd515ce9a7fc49e2463711e230fe7efd0a.exe Token: SeDebugPrivilege 2228 tmpCA1B.tmp.exe Token: SeIncreaseQuotaPrivilege 1080 vbc.exe Token: SeSecurityPrivilege 1080 vbc.exe Token: SeTakeOwnershipPrivilege 1080 vbc.exe Token: SeLoadDriverPrivilege 1080 vbc.exe Token: SeSystemProfilePrivilege 1080 vbc.exe Token: SeSystemtimePrivilege 1080 vbc.exe Token: SeProfSingleProcessPrivilege 1080 vbc.exe Token: SeIncBasePriorityPrivilege 1080 vbc.exe Token: SeCreatePagefilePrivilege 1080 vbc.exe Token: SeBackupPrivilege 1080 vbc.exe Token: SeRestorePrivilege 1080 vbc.exe Token: SeShutdownPrivilege 1080 vbc.exe Token: SeDebugPrivilege 1080 vbc.exe Token: SeSystemEnvironmentPrivilege 1080 vbc.exe Token: SeChangeNotifyPrivilege 1080 vbc.exe Token: SeRemoteShutdownPrivilege 1080 vbc.exe Token: SeUndockPrivilege 1080 vbc.exe Token: SeManageVolumePrivilege 1080 vbc.exe Token: SeImpersonatePrivilege 1080 vbc.exe Token: SeCreateGlobalPrivilege 1080 vbc.exe Token: 33 1080 vbc.exe Token: 34 1080 vbc.exe Token: 35 1080 vbc.exe Token: 36 1080 vbc.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
vbc.exepid process 1080 vbc.exe -
Suspicious use of WriteProcessMemory 17 IoCs
Processes:
b4d1ddba5d16a8e7d588a47b82ae1edd515ce9a7fc49e2463711e230fe7efd0a.exedescription pid process target process PID 4840 wrote to memory of 2228 4840 b4d1ddba5d16a8e7d588a47b82ae1edd515ce9a7fc49e2463711e230fe7efd0a.exe tmpCA1B.tmp.exe PID 4840 wrote to memory of 2228 4840 b4d1ddba5d16a8e7d588a47b82ae1edd515ce9a7fc49e2463711e230fe7efd0a.exe tmpCA1B.tmp.exe PID 4840 wrote to memory of 2228 4840 b4d1ddba5d16a8e7d588a47b82ae1edd515ce9a7fc49e2463711e230fe7efd0a.exe tmpCA1B.tmp.exe PID 4840 wrote to memory of 1080 4840 b4d1ddba5d16a8e7d588a47b82ae1edd515ce9a7fc49e2463711e230fe7efd0a.exe vbc.exe PID 4840 wrote to memory of 1080 4840 b4d1ddba5d16a8e7d588a47b82ae1edd515ce9a7fc49e2463711e230fe7efd0a.exe vbc.exe PID 4840 wrote to memory of 1080 4840 b4d1ddba5d16a8e7d588a47b82ae1edd515ce9a7fc49e2463711e230fe7efd0a.exe vbc.exe PID 4840 wrote to memory of 1080 4840 b4d1ddba5d16a8e7d588a47b82ae1edd515ce9a7fc49e2463711e230fe7efd0a.exe vbc.exe PID 4840 wrote to memory of 1080 4840 b4d1ddba5d16a8e7d588a47b82ae1edd515ce9a7fc49e2463711e230fe7efd0a.exe vbc.exe PID 4840 wrote to memory of 1080 4840 b4d1ddba5d16a8e7d588a47b82ae1edd515ce9a7fc49e2463711e230fe7efd0a.exe vbc.exe PID 4840 wrote to memory of 1080 4840 b4d1ddba5d16a8e7d588a47b82ae1edd515ce9a7fc49e2463711e230fe7efd0a.exe vbc.exe PID 4840 wrote to memory of 1080 4840 b4d1ddba5d16a8e7d588a47b82ae1edd515ce9a7fc49e2463711e230fe7efd0a.exe vbc.exe PID 4840 wrote to memory of 1080 4840 b4d1ddba5d16a8e7d588a47b82ae1edd515ce9a7fc49e2463711e230fe7efd0a.exe vbc.exe PID 4840 wrote to memory of 1080 4840 b4d1ddba5d16a8e7d588a47b82ae1edd515ce9a7fc49e2463711e230fe7efd0a.exe vbc.exe PID 4840 wrote to memory of 1080 4840 b4d1ddba5d16a8e7d588a47b82ae1edd515ce9a7fc49e2463711e230fe7efd0a.exe vbc.exe PID 4840 wrote to memory of 1080 4840 b4d1ddba5d16a8e7d588a47b82ae1edd515ce9a7fc49e2463711e230fe7efd0a.exe vbc.exe PID 4840 wrote to memory of 1080 4840 b4d1ddba5d16a8e7d588a47b82ae1edd515ce9a7fc49e2463711e230fe7efd0a.exe vbc.exe PID 4840 wrote to memory of 1080 4840 b4d1ddba5d16a8e7d588a47b82ae1edd515ce9a7fc49e2463711e230fe7efd0a.exe vbc.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\b4d1ddba5d16a8e7d588a47b82ae1edd515ce9a7fc49e2463711e230fe7efd0a.exe"C:\Users\Admin\AppData\Local\Temp\b4d1ddba5d16a8e7d588a47b82ae1edd515ce9a7fc49e2463711e230fe7efd0a.exe"1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\tmpCA1B.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpCA1B.tmp.exe" /pq2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\\vbc.exe"2⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmpCA1B.tmp.exeFilesize
609KB
MD5331da72e491868ab31ce11fe02f5bb15
SHA1bfbf35096f56e92f08815487e1cbb088efaf31e9
SHA256b4d1ddba5d16a8e7d588a47b82ae1edd515ce9a7fc49e2463711e230fe7efd0a
SHA5122b3930150894fb1b6e3f41fd5edeb25f6a68de005a9a20bdd02418a190805a9291c6185d2f7a8e3e3d4a42cbec92fc29d69b76d4d4cd486dd75963ccd6e6c71f
-
C:\Users\Admin\AppData\Local\Temp\tmpCA1B.tmp.exeFilesize
609KB
MD5331da72e491868ab31ce11fe02f5bb15
SHA1bfbf35096f56e92f08815487e1cbb088efaf31e9
SHA256b4d1ddba5d16a8e7d588a47b82ae1edd515ce9a7fc49e2463711e230fe7efd0a
SHA5122b3930150894fb1b6e3f41fd5edeb25f6a68de005a9a20bdd02418a190805a9291c6185d2f7a8e3e3d4a42cbec92fc29d69b76d4d4cd486dd75963ccd6e6c71f
-
memory/1080-140-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/1080-146-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/1080-152-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/1080-150-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/1080-148-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/1080-139-0x0000000000000000-mapping.dmp
-
memory/1080-147-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/1080-141-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/1080-142-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/1080-144-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/2228-134-0x0000000000000000-mapping.dmp
-
memory/2228-138-0x00000000746C0000-0x0000000074C71000-memory.dmpFilesize
5.7MB
-
memory/2228-137-0x00000000746C0000-0x0000000074C71000-memory.dmpFilesize
5.7MB
-
memory/4840-132-0x00000000746C0000-0x0000000074C71000-memory.dmpFilesize
5.7MB
-
memory/4840-151-0x00000000746C0000-0x0000000074C71000-memory.dmpFilesize
5.7MB
-
memory/4840-133-0x00000000746C0000-0x0000000074C71000-memory.dmpFilesize
5.7MB