Analysis
-
max time kernel
158s -
max time network
31s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
03-12-2022 02:52
Static task
static1
Behavioral task
behavioral1
Sample
f33357da6977b1dad53c52c18710f84b58d48a1225848bcba3148e4a4f67b569.exe
Resource
win7-20221111-en
General
-
Target
f33357da6977b1dad53c52c18710f84b58d48a1225848bcba3148e4a4f67b569.exe
-
Size
724KB
-
MD5
f517871829e8cbab778a5015d7b14afe
-
SHA1
056164b8b5ca5c2eaaca8fdbaccc13216232682e
-
SHA256
f33357da6977b1dad53c52c18710f84b58d48a1225848bcba3148e4a4f67b569
-
SHA512
b8502bb184b61ed098d3da5806f54405e9e542ccf8317bdef477ba538371f6acb58df03d155c282be5c417d0dd977614ad1befad3813505a82464fb71628c608
-
SSDEEP
12288:MBdaKTua5Jw4CZo+HLqY9fl0OLTyi9wG1D6avNfBaCRZqD02QcQXKcDq6Rgi//Kg:wrigKfnHLLXfGGMy4YcQXKcDq6Rg6/Kg
Malware Config
Extracted
darkcomet
Slave
127.0.0.1:1604
DC_MUTEX-94LKTR2
-
gencode
PUyr7vQgVqSS
-
install
false
-
offline_keylogger
true
-
persistence
false
Signatures
-
Processes:
cvtres.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" cvtres.exe -
Executes dropped EXE 1 IoCs
Processes:
explorer.exepid process 1448 explorer.exe -
Loads dropped DLL 2 IoCs
Processes:
f33357da6977b1dad53c52c18710f84b58d48a1225848bcba3148e4a4f67b569.exepid process 1064 f33357da6977b1dad53c52c18710f84b58d48a1225848bcba3148e4a4f67b569.exe 1064 f33357da6977b1dad53c52c18710f84b58d48a1225848bcba3148e4a4f67b569.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
explorer.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\18.exe = "C:\\Users\\Admin\\AppData\\RoamingMicrosoft\\System\\Services\\18.exe" explorer.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
explorer.exedescription pid process target process PID 1448 set thread context of 1192 1448 explorer.exe cvtres.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of AdjustPrivilegeToken 23 IoCs
Processes:
cvtres.exedescription pid process Token: SeIncreaseQuotaPrivilege 1192 cvtres.exe Token: SeSecurityPrivilege 1192 cvtres.exe Token: SeTakeOwnershipPrivilege 1192 cvtres.exe Token: SeLoadDriverPrivilege 1192 cvtres.exe Token: SeSystemProfilePrivilege 1192 cvtres.exe Token: SeSystemtimePrivilege 1192 cvtres.exe Token: SeProfSingleProcessPrivilege 1192 cvtres.exe Token: SeIncBasePriorityPrivilege 1192 cvtres.exe Token: SeCreatePagefilePrivilege 1192 cvtres.exe Token: SeBackupPrivilege 1192 cvtres.exe Token: SeRestorePrivilege 1192 cvtres.exe Token: SeShutdownPrivilege 1192 cvtres.exe Token: SeDebugPrivilege 1192 cvtres.exe Token: SeSystemEnvironmentPrivilege 1192 cvtres.exe Token: SeChangeNotifyPrivilege 1192 cvtres.exe Token: SeRemoteShutdownPrivilege 1192 cvtres.exe Token: SeUndockPrivilege 1192 cvtres.exe Token: SeManageVolumePrivilege 1192 cvtres.exe Token: SeImpersonatePrivilege 1192 cvtres.exe Token: SeCreateGlobalPrivilege 1192 cvtres.exe Token: 33 1192 cvtres.exe Token: 34 1192 cvtres.exe Token: 35 1192 cvtres.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
cvtres.exepid process 1192 cvtres.exe -
Suspicious use of WriteProcessMemory 17 IoCs
Processes:
f33357da6977b1dad53c52c18710f84b58d48a1225848bcba3148e4a4f67b569.exeexplorer.exedescription pid process target process PID 1064 wrote to memory of 1448 1064 f33357da6977b1dad53c52c18710f84b58d48a1225848bcba3148e4a4f67b569.exe explorer.exe PID 1064 wrote to memory of 1448 1064 f33357da6977b1dad53c52c18710f84b58d48a1225848bcba3148e4a4f67b569.exe explorer.exe PID 1064 wrote to memory of 1448 1064 f33357da6977b1dad53c52c18710f84b58d48a1225848bcba3148e4a4f67b569.exe explorer.exe PID 1064 wrote to memory of 1448 1064 f33357da6977b1dad53c52c18710f84b58d48a1225848bcba3148e4a4f67b569.exe explorer.exe PID 1448 wrote to memory of 1192 1448 explorer.exe cvtres.exe PID 1448 wrote to memory of 1192 1448 explorer.exe cvtres.exe PID 1448 wrote to memory of 1192 1448 explorer.exe cvtres.exe PID 1448 wrote to memory of 1192 1448 explorer.exe cvtres.exe PID 1448 wrote to memory of 1192 1448 explorer.exe cvtres.exe PID 1448 wrote to memory of 1192 1448 explorer.exe cvtres.exe PID 1448 wrote to memory of 1192 1448 explorer.exe cvtres.exe PID 1448 wrote to memory of 1192 1448 explorer.exe cvtres.exe PID 1448 wrote to memory of 1192 1448 explorer.exe cvtres.exe PID 1448 wrote to memory of 1192 1448 explorer.exe cvtres.exe PID 1448 wrote to memory of 1192 1448 explorer.exe cvtres.exe PID 1448 wrote to memory of 1192 1448 explorer.exe cvtres.exe PID 1448 wrote to memory of 1192 1448 explorer.exe cvtres.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\f33357da6977b1dad53c52c18710f84b58d48a1225848bcba3148e4a4f67b569.exe"C:\Users\Admin\AppData\Local\Temp\f33357da6977b1dad53c52c18710f84b58d48a1225848bcba3148e4a4f67b569.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\explorer.exe"C:\Users\Admin\AppData\Roaming\explorer.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exeC:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe3⤵
- Windows security bypass
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\explorer.exeFilesize
724KB
MD5f517871829e8cbab778a5015d7b14afe
SHA1056164b8b5ca5c2eaaca8fdbaccc13216232682e
SHA256f33357da6977b1dad53c52c18710f84b58d48a1225848bcba3148e4a4f67b569
SHA512b8502bb184b61ed098d3da5806f54405e9e542ccf8317bdef477ba538371f6acb58df03d155c282be5c417d0dd977614ad1befad3813505a82464fb71628c608
-
C:\Users\Admin\AppData\Roaming\explorer.exeFilesize
724KB
MD5f517871829e8cbab778a5015d7b14afe
SHA1056164b8b5ca5c2eaaca8fdbaccc13216232682e
SHA256f33357da6977b1dad53c52c18710f84b58d48a1225848bcba3148e4a4f67b569
SHA512b8502bb184b61ed098d3da5806f54405e9e542ccf8317bdef477ba538371f6acb58df03d155c282be5c417d0dd977614ad1befad3813505a82464fb71628c608
-
\Users\Admin\AppData\Roaming\explorer.exeFilesize
724KB
MD5f517871829e8cbab778a5015d7b14afe
SHA1056164b8b5ca5c2eaaca8fdbaccc13216232682e
SHA256f33357da6977b1dad53c52c18710f84b58d48a1225848bcba3148e4a4f67b569
SHA512b8502bb184b61ed098d3da5806f54405e9e542ccf8317bdef477ba538371f6acb58df03d155c282be5c417d0dd977614ad1befad3813505a82464fb71628c608
-
\Users\Admin\AppData\Roaming\explorer.exeFilesize
724KB
MD5f517871829e8cbab778a5015d7b14afe
SHA1056164b8b5ca5c2eaaca8fdbaccc13216232682e
SHA256f33357da6977b1dad53c52c18710f84b58d48a1225848bcba3148e4a4f67b569
SHA512b8502bb184b61ed098d3da5806f54405e9e542ccf8317bdef477ba538371f6acb58df03d155c282be5c417d0dd977614ad1befad3813505a82464fb71628c608
-
memory/1064-62-0x0000000074CB0000-0x000000007525B000-memory.dmpFilesize
5.7MB
-
memory/1064-55-0x0000000074CB0000-0x000000007525B000-memory.dmpFilesize
5.7MB
-
memory/1064-54-0x0000000075BA1000-0x0000000075BA3000-memory.dmpFilesize
8KB
-
memory/1192-69-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/1192-74-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/1192-64-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/1192-65-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/1192-67-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/1192-85-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/1192-71-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/1192-83-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/1192-73-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/1192-76-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/1192-78-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/1192-79-0x000000000048F888-mapping.dmp
-
memory/1192-80-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/1192-84-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/1448-58-0x0000000000000000-mapping.dmp
-
memory/1448-81-0x0000000074CB0000-0x000000007525B000-memory.dmpFilesize
5.7MB
-
memory/1448-63-0x0000000074CB0000-0x000000007525B000-memory.dmpFilesize
5.7MB