Analysis
-
max time kernel
171s -
max time network
35s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
03-12-2022 02:52
Static task
static1
Behavioral task
behavioral1
Sample
f34ecc9a2b4cc433afae06d4e6dee9cf9b30c78b2349ac190855c3b79de8d565.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
f34ecc9a2b4cc433afae06d4e6dee9cf9b30c78b2349ac190855c3b79de8d565.exe
Resource
win10v2004-20221111-en
General
-
Target
f34ecc9a2b4cc433afae06d4e6dee9cf9b30c78b2349ac190855c3b79de8d565.exe
-
Size
965KB
-
MD5
d48e65382aa5038a7b5006635b32b951
-
SHA1
69462a33f4c19711386f07ea3fb0cbe0d9a697cd
-
SHA256
f34ecc9a2b4cc433afae06d4e6dee9cf9b30c78b2349ac190855c3b79de8d565
-
SHA512
591b21d638a2591ba1c60165f2207e47fd5c52d681c984edb5e705ebf9b2bd7565e94309f8899473b2f3b028236304a5fdd41223c4d9145314d72b048bdbae10
-
SSDEEP
24576:QjanCAfUaJYNo5/XOqoa4Q+f1mIMVlzGqLD6h2Zg3:Qj2CNBHClLDOb
Malware Config
Extracted
darkcomet
mohamad
monasara4.no-ip.org:1604
DC_MUTEX-W41GGVQ
-
InstallPath
MSDCSC\msdcsc.exe
-
gencode
PTslBCtLGc65
-
install
true
-
offline_keylogger
true
-
persistence
false
-
reg_key
MicroUpdate
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
Processes:
vbc.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Users\\Admin\\Documents\\MSDCSC\\msdcsc.exe" vbc.exe -
Executes dropped EXE 1 IoCs
Processes:
msdcsc.exepid process 1416 msdcsc.exe -
Loads dropped DLL 1 IoCs
Processes:
vbc.exepid process 1736 vbc.exe -
Uses the VBS compiler for execution 1 TTPs
-
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
vbc.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Users\\Admin\\Documents\\MSDCSC\\msdcsc.exe" vbc.exe -
Drops file in System32 directory 2 IoCs
Processes:
f34ecc9a2b4cc433afae06d4e6dee9cf9b30c78b2349ac190855c3b79de8d565.exedescription ioc process File created C:\Windows\SysWOW64\authctl.exe f34ecc9a2b4cc433afae06d4e6dee9cf9b30c78b2349ac190855c3b79de8d565.exe File opened for modification C:\Windows\SysWOW64\authctl.exe f34ecc9a2b4cc433afae06d4e6dee9cf9b30c78b2349ac190855c3b79de8d565.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
f34ecc9a2b4cc433afae06d4e6dee9cf9b30c78b2349ac190855c3b79de8d565.exedescription pid process target process PID 1120 set thread context of 1736 1120 f34ecc9a2b4cc433afae06d4e6dee9cf9b30c78b2349ac190855c3b79de8d565.exe vbc.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
dw20.exepid process 1016 dw20.exe -
Suspicious use of AdjustPrivilegeToken 23 IoCs
Processes:
vbc.exedescription pid process Token: SeIncreaseQuotaPrivilege 1736 vbc.exe Token: SeSecurityPrivilege 1736 vbc.exe Token: SeTakeOwnershipPrivilege 1736 vbc.exe Token: SeLoadDriverPrivilege 1736 vbc.exe Token: SeSystemProfilePrivilege 1736 vbc.exe Token: SeSystemtimePrivilege 1736 vbc.exe Token: SeProfSingleProcessPrivilege 1736 vbc.exe Token: SeIncBasePriorityPrivilege 1736 vbc.exe Token: SeCreatePagefilePrivilege 1736 vbc.exe Token: SeBackupPrivilege 1736 vbc.exe Token: SeRestorePrivilege 1736 vbc.exe Token: SeShutdownPrivilege 1736 vbc.exe Token: SeDebugPrivilege 1736 vbc.exe Token: SeSystemEnvironmentPrivilege 1736 vbc.exe Token: SeChangeNotifyPrivilege 1736 vbc.exe Token: SeRemoteShutdownPrivilege 1736 vbc.exe Token: SeUndockPrivilege 1736 vbc.exe Token: SeManageVolumePrivilege 1736 vbc.exe Token: SeImpersonatePrivilege 1736 vbc.exe Token: SeCreateGlobalPrivilege 1736 vbc.exe Token: 33 1736 vbc.exe Token: 34 1736 vbc.exe Token: 35 1736 vbc.exe -
Suspicious use of WriteProcessMemory 21 IoCs
Processes:
f34ecc9a2b4cc433afae06d4e6dee9cf9b30c78b2349ac190855c3b79de8d565.exevbc.exedescription pid process target process PID 1120 wrote to memory of 1736 1120 f34ecc9a2b4cc433afae06d4e6dee9cf9b30c78b2349ac190855c3b79de8d565.exe vbc.exe PID 1120 wrote to memory of 1736 1120 f34ecc9a2b4cc433afae06d4e6dee9cf9b30c78b2349ac190855c3b79de8d565.exe vbc.exe PID 1120 wrote to memory of 1736 1120 f34ecc9a2b4cc433afae06d4e6dee9cf9b30c78b2349ac190855c3b79de8d565.exe vbc.exe PID 1120 wrote to memory of 1736 1120 f34ecc9a2b4cc433afae06d4e6dee9cf9b30c78b2349ac190855c3b79de8d565.exe vbc.exe PID 1120 wrote to memory of 1736 1120 f34ecc9a2b4cc433afae06d4e6dee9cf9b30c78b2349ac190855c3b79de8d565.exe vbc.exe PID 1120 wrote to memory of 1736 1120 f34ecc9a2b4cc433afae06d4e6dee9cf9b30c78b2349ac190855c3b79de8d565.exe vbc.exe PID 1120 wrote to memory of 1736 1120 f34ecc9a2b4cc433afae06d4e6dee9cf9b30c78b2349ac190855c3b79de8d565.exe vbc.exe PID 1120 wrote to memory of 1736 1120 f34ecc9a2b4cc433afae06d4e6dee9cf9b30c78b2349ac190855c3b79de8d565.exe vbc.exe PID 1120 wrote to memory of 1736 1120 f34ecc9a2b4cc433afae06d4e6dee9cf9b30c78b2349ac190855c3b79de8d565.exe vbc.exe PID 1120 wrote to memory of 1736 1120 f34ecc9a2b4cc433afae06d4e6dee9cf9b30c78b2349ac190855c3b79de8d565.exe vbc.exe PID 1120 wrote to memory of 1736 1120 f34ecc9a2b4cc433afae06d4e6dee9cf9b30c78b2349ac190855c3b79de8d565.exe vbc.exe PID 1120 wrote to memory of 1736 1120 f34ecc9a2b4cc433afae06d4e6dee9cf9b30c78b2349ac190855c3b79de8d565.exe vbc.exe PID 1120 wrote to memory of 1736 1120 f34ecc9a2b4cc433afae06d4e6dee9cf9b30c78b2349ac190855c3b79de8d565.exe vbc.exe PID 1120 wrote to memory of 1016 1120 f34ecc9a2b4cc433afae06d4e6dee9cf9b30c78b2349ac190855c3b79de8d565.exe dw20.exe PID 1120 wrote to memory of 1016 1120 f34ecc9a2b4cc433afae06d4e6dee9cf9b30c78b2349ac190855c3b79de8d565.exe dw20.exe PID 1120 wrote to memory of 1016 1120 f34ecc9a2b4cc433afae06d4e6dee9cf9b30c78b2349ac190855c3b79de8d565.exe dw20.exe PID 1120 wrote to memory of 1016 1120 f34ecc9a2b4cc433afae06d4e6dee9cf9b30c78b2349ac190855c3b79de8d565.exe dw20.exe PID 1736 wrote to memory of 1416 1736 vbc.exe msdcsc.exe PID 1736 wrote to memory of 1416 1736 vbc.exe msdcsc.exe PID 1736 wrote to memory of 1416 1736 vbc.exe msdcsc.exe PID 1736 wrote to memory of 1416 1736 vbc.exe msdcsc.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\f34ecc9a2b4cc433afae06d4e6dee9cf9b30c78b2349ac190855c3b79de8d565.exe"C:\Users\Admin\AppData\Local\Temp\f34ecc9a2b4cc433afae06d4e6dee9cf9b30c78b2349ac190855c3b79de8d565.exe"1⤵
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeC:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe2⤵
- Modifies WinLogon for persistence
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\Documents\MSDCSC\msdcsc.exe"C:\Users\Admin\Documents\MSDCSC\msdcsc.exe"3⤵
- Executes dropped EXE
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exedw20.exe -x -s 5642⤵
- Suspicious behavior: GetForegroundWindowSpam
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\Documents\MSDCSC\msdcsc.exeFilesize
1.1MB
MD534aa912defa18c2c129f1e09d75c1d7e
SHA19c3046324657505a30ecd9b1fdb46c05bde7d470
SHA2566df94b7fa33f1b87142adc39b3db0613fc520d9e7a5fd6a5301dd7f51f8d0386
SHA512d1ea9368f5d7166180612fd763c87afb647d088498887961f5e7fb0a10f4a808bd5928e8a3666d70ff794093c51ecca8816f75dd47652fd4eb23dce7f9aa1f98
-
C:\Users\Admin\Documents\MSDCSC\msdcsc.exeFilesize
1.1MB
MD534aa912defa18c2c129f1e09d75c1d7e
SHA19c3046324657505a30ecd9b1fdb46c05bde7d470
SHA2566df94b7fa33f1b87142adc39b3db0613fc520d9e7a5fd6a5301dd7f51f8d0386
SHA512d1ea9368f5d7166180612fd763c87afb647d088498887961f5e7fb0a10f4a808bd5928e8a3666d70ff794093c51ecca8816f75dd47652fd4eb23dce7f9aa1f98
-
\Users\Admin\Documents\MSDCSC\msdcsc.exeFilesize
1.1MB
MD534aa912defa18c2c129f1e09d75c1d7e
SHA19c3046324657505a30ecd9b1fdb46c05bde7d470
SHA2566df94b7fa33f1b87142adc39b3db0613fc520d9e7a5fd6a5301dd7f51f8d0386
SHA512d1ea9368f5d7166180612fd763c87afb647d088498887961f5e7fb0a10f4a808bd5928e8a3666d70ff794093c51ecca8816f75dd47652fd4eb23dce7f9aa1f98
-
memory/1016-74-0x0000000000000000-mapping.dmp
-
memory/1120-54-0x0000000075891000-0x0000000075893000-memory.dmpFilesize
8KB
-
memory/1120-55-0x0000000073EC0000-0x000000007446B000-memory.dmpFilesize
5.7MB
-
memory/1120-83-0x0000000073EC0000-0x000000007446B000-memory.dmpFilesize
5.7MB
-
memory/1416-79-0x0000000000000000-mapping.dmp
-
memory/1736-70-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/1736-77-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/1736-66-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/1736-71-0x000000000048F888-mapping.dmp
-
memory/1736-72-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/1736-65-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/1736-75-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/1736-68-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/1736-63-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/1736-61-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/1736-59-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/1736-57-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/1736-82-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/1736-56-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB