Analysis
-
max time kernel
178s -
max time network
190s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
03-12-2022 02:52
Static task
static1
Behavioral task
behavioral1
Sample
f33357da6977b1dad53c52c18710f84b58d48a1225848bcba3148e4a4f67b569.exe
Resource
win7-20221111-en
General
-
Target
f33357da6977b1dad53c52c18710f84b58d48a1225848bcba3148e4a4f67b569.exe
-
Size
724KB
-
MD5
f517871829e8cbab778a5015d7b14afe
-
SHA1
056164b8b5ca5c2eaaca8fdbaccc13216232682e
-
SHA256
f33357da6977b1dad53c52c18710f84b58d48a1225848bcba3148e4a4f67b569
-
SHA512
b8502bb184b61ed098d3da5806f54405e9e542ccf8317bdef477ba538371f6acb58df03d155c282be5c417d0dd977614ad1befad3813505a82464fb71628c608
-
SSDEEP
12288:MBdaKTua5Jw4CZo+HLqY9fl0OLTyi9wG1D6avNfBaCRZqD02QcQXKcDq6Rgi//Kg:wrigKfnHLLXfGGMy4YcQXKcDq6Rg6/Kg
Malware Config
Extracted
darkcomet
Slave
127.0.0.1:1604
DC_MUTEX-94LKTR2
-
gencode
PUyr7vQgVqSS
-
install
false
-
offline_keylogger
true
-
persistence
false
Signatures
-
Processes:
cvtres.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" cvtres.exe -
Executes dropped EXE 1 IoCs
Processes:
explorer.exepid process 4532 explorer.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
f33357da6977b1dad53c52c18710f84b58d48a1225848bcba3148e4a4f67b569.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Control Panel\International\Geo\Nation f33357da6977b1dad53c52c18710f84b58d48a1225848bcba3148e4a4f67b569.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
explorer.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\18.exe = "C:\\Users\\Admin\\AppData\\RoamingMicrosoft\\System\\Services\\18.exe" explorer.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
explorer.exedescription pid process target process PID 4532 set thread context of 1032 4532 explorer.exe cvtres.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of AdjustPrivilegeToken 24 IoCs
Processes:
cvtres.exedescription pid process Token: SeIncreaseQuotaPrivilege 1032 cvtres.exe Token: SeSecurityPrivilege 1032 cvtres.exe Token: SeTakeOwnershipPrivilege 1032 cvtres.exe Token: SeLoadDriverPrivilege 1032 cvtres.exe Token: SeSystemProfilePrivilege 1032 cvtres.exe Token: SeSystemtimePrivilege 1032 cvtres.exe Token: SeProfSingleProcessPrivilege 1032 cvtres.exe Token: SeIncBasePriorityPrivilege 1032 cvtres.exe Token: SeCreatePagefilePrivilege 1032 cvtres.exe Token: SeBackupPrivilege 1032 cvtres.exe Token: SeRestorePrivilege 1032 cvtres.exe Token: SeShutdownPrivilege 1032 cvtres.exe Token: SeDebugPrivilege 1032 cvtres.exe Token: SeSystemEnvironmentPrivilege 1032 cvtres.exe Token: SeChangeNotifyPrivilege 1032 cvtres.exe Token: SeRemoteShutdownPrivilege 1032 cvtres.exe Token: SeUndockPrivilege 1032 cvtres.exe Token: SeManageVolumePrivilege 1032 cvtres.exe Token: SeImpersonatePrivilege 1032 cvtres.exe Token: SeCreateGlobalPrivilege 1032 cvtres.exe Token: 33 1032 cvtres.exe Token: 34 1032 cvtres.exe Token: 35 1032 cvtres.exe Token: 36 1032 cvtres.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
cvtres.exepid process 1032 cvtres.exe -
Suspicious use of WriteProcessMemory 17 IoCs
Processes:
f33357da6977b1dad53c52c18710f84b58d48a1225848bcba3148e4a4f67b569.exeexplorer.exedescription pid process target process PID 4360 wrote to memory of 4532 4360 f33357da6977b1dad53c52c18710f84b58d48a1225848bcba3148e4a4f67b569.exe explorer.exe PID 4360 wrote to memory of 4532 4360 f33357da6977b1dad53c52c18710f84b58d48a1225848bcba3148e4a4f67b569.exe explorer.exe PID 4360 wrote to memory of 4532 4360 f33357da6977b1dad53c52c18710f84b58d48a1225848bcba3148e4a4f67b569.exe explorer.exe PID 4532 wrote to memory of 1032 4532 explorer.exe cvtres.exe PID 4532 wrote to memory of 1032 4532 explorer.exe cvtres.exe PID 4532 wrote to memory of 1032 4532 explorer.exe cvtres.exe PID 4532 wrote to memory of 1032 4532 explorer.exe cvtres.exe PID 4532 wrote to memory of 1032 4532 explorer.exe cvtres.exe PID 4532 wrote to memory of 1032 4532 explorer.exe cvtres.exe PID 4532 wrote to memory of 1032 4532 explorer.exe cvtres.exe PID 4532 wrote to memory of 1032 4532 explorer.exe cvtres.exe PID 4532 wrote to memory of 1032 4532 explorer.exe cvtres.exe PID 4532 wrote to memory of 1032 4532 explorer.exe cvtres.exe PID 4532 wrote to memory of 1032 4532 explorer.exe cvtres.exe PID 4532 wrote to memory of 1032 4532 explorer.exe cvtres.exe PID 4532 wrote to memory of 1032 4532 explorer.exe cvtres.exe PID 4532 wrote to memory of 1032 4532 explorer.exe cvtres.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\f33357da6977b1dad53c52c18710f84b58d48a1225848bcba3148e4a4f67b569.exe"C:\Users\Admin\AppData\Local\Temp\f33357da6977b1dad53c52c18710f84b58d48a1225848bcba3148e4a4f67b569.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\explorer.exe"C:\Users\Admin\AppData\Roaming\explorer.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exeC:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe3⤵
- Windows security bypass
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\explorer.exeFilesize
724KB
MD5f517871829e8cbab778a5015d7b14afe
SHA1056164b8b5ca5c2eaaca8fdbaccc13216232682e
SHA256f33357da6977b1dad53c52c18710f84b58d48a1225848bcba3148e4a4f67b569
SHA512b8502bb184b61ed098d3da5806f54405e9e542ccf8317bdef477ba538371f6acb58df03d155c282be5c417d0dd977614ad1befad3813505a82464fb71628c608
-
C:\Users\Admin\AppData\Roaming\explorer.exeFilesize
724KB
MD5f517871829e8cbab778a5015d7b14afe
SHA1056164b8b5ca5c2eaaca8fdbaccc13216232682e
SHA256f33357da6977b1dad53c52c18710f84b58d48a1225848bcba3148e4a4f67b569
SHA512b8502bb184b61ed098d3da5806f54405e9e542ccf8317bdef477ba538371f6acb58df03d155c282be5c417d0dd977614ad1befad3813505a82464fb71628c608
-
memory/1032-137-0x0000000000000000-mapping.dmp
-
memory/1032-138-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/1032-139-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/1032-141-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/1032-142-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/1032-143-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/4360-132-0x00000000751A0000-0x0000000075751000-memory.dmpFilesize
5.7MB
-
memory/4360-136-0x00000000751A0000-0x0000000075751000-memory.dmpFilesize
5.7MB
-
memory/4532-133-0x0000000000000000-mapping.dmp
-
memory/4532-140-0x00000000751A0000-0x0000000075751000-memory.dmpFilesize
5.7MB