Analysis
-
max time kernel
151s -
max time network
45s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
03-12-2022 04:58
Static task
static1
Behavioral task
behavioral1
Sample
ca73c1e272f0634901c4bd5f0ff8942f44739eca23b653d02bae3dd87819b162.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
ca73c1e272f0634901c4bd5f0ff8942f44739eca23b653d02bae3dd87819b162.exe
Resource
win10v2004-20221111-en
General
-
Target
ca73c1e272f0634901c4bd5f0ff8942f44739eca23b653d02bae3dd87819b162.exe
-
Size
2.2MB
-
MD5
2143e3f661a12e987a590a19c62e80e5
-
SHA1
178ac441bec96294ed7afcb6c11f6ba3e3143a75
-
SHA256
ca73c1e272f0634901c4bd5f0ff8942f44739eca23b653d02bae3dd87819b162
-
SHA512
b029cf8f8c146f4f4a29cb0204f60e659a200b4589cde0842fd4b456e364ea4bc6e4c555e74c92341fdb52f9529bfb54858f6104ede4796373d5883e5e1a8fb7
-
SSDEEP
49152:MHNRaJsiPfkOal/74cs4CAkVAh3KLHeNjEWuRxaa995XzIGbn:MmJsmCNvYf+NjER0a95XzLn
Malware Config
Extracted
darkcomet
HF
darthquigon.no-ip.org:1604
DC_MUTEX-4R4M43Q
-
InstallPath
MSDCSC\msdcsc.exe
-
gencode
gNEQEuffZJHa
-
install
true
-
offline_keylogger
true
-
persistence
true
-
reg_key
MicroUpdate
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
Processes:
ca73c1e272f0634901c4bd5f0ff8942f44739eca23b653d02bae3dd87819b162.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Users\\Admin\\Documents\\MSDCSC\\msdcsc.exe" ca73c1e272f0634901c4bd5f0ff8942f44739eca23b653d02bae3dd87819b162.exe -
Modifies firewall policy service 2 TTPs 3 IoCs
Processes:
msdcsc.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "0" msdcsc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile msdcsc.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" msdcsc.exe -
Disables RegEdit via registry modification 1 IoCs
Processes:
msdcsc.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" msdcsc.exe -
Executes dropped EXE 1 IoCs
Processes:
msdcsc.exepid process 1956 msdcsc.exe -
Sets file to hidden 1 TTPs 2 IoCs
Modifies file attributes to stop it showing in Explorer etc.
Processes:
attrib.exeattrib.exepid process 1396 attrib.exe 268 attrib.exe -
Loads dropped DLL 2 IoCs
Processes:
ca73c1e272f0634901c4bd5f0ff8942f44739eca23b653d02bae3dd87819b162.exepid process 1732 ca73c1e272f0634901c4bd5f0ff8942f44739eca23b653d02bae3dd87819b162.exe 1732 ca73c1e272f0634901c4bd5f0ff8942f44739eca23b653d02bae3dd87819b162.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
ca73c1e272f0634901c4bd5f0ff8942f44739eca23b653d02bae3dd87819b162.exemsdcsc.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Users\\Admin\\Documents\\MSDCSC\\msdcsc.exe" ca73c1e272f0634901c4bd5f0ff8942f44739eca23b653d02bae3dd87819b162.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Users\\Admin\\Documents\\MSDCSC\\msdcsc.exe" msdcsc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
msdcsc.exepid process 1956 msdcsc.exe -
Suspicious use of AdjustPrivilegeToken 46 IoCs
Processes:
ca73c1e272f0634901c4bd5f0ff8942f44739eca23b653d02bae3dd87819b162.exemsdcsc.exedescription pid process Token: SeIncreaseQuotaPrivilege 1732 ca73c1e272f0634901c4bd5f0ff8942f44739eca23b653d02bae3dd87819b162.exe Token: SeSecurityPrivilege 1732 ca73c1e272f0634901c4bd5f0ff8942f44739eca23b653d02bae3dd87819b162.exe Token: SeTakeOwnershipPrivilege 1732 ca73c1e272f0634901c4bd5f0ff8942f44739eca23b653d02bae3dd87819b162.exe Token: SeLoadDriverPrivilege 1732 ca73c1e272f0634901c4bd5f0ff8942f44739eca23b653d02bae3dd87819b162.exe Token: SeSystemProfilePrivilege 1732 ca73c1e272f0634901c4bd5f0ff8942f44739eca23b653d02bae3dd87819b162.exe Token: SeSystemtimePrivilege 1732 ca73c1e272f0634901c4bd5f0ff8942f44739eca23b653d02bae3dd87819b162.exe Token: SeProfSingleProcessPrivilege 1732 ca73c1e272f0634901c4bd5f0ff8942f44739eca23b653d02bae3dd87819b162.exe Token: SeIncBasePriorityPrivilege 1732 ca73c1e272f0634901c4bd5f0ff8942f44739eca23b653d02bae3dd87819b162.exe Token: SeCreatePagefilePrivilege 1732 ca73c1e272f0634901c4bd5f0ff8942f44739eca23b653d02bae3dd87819b162.exe Token: SeBackupPrivilege 1732 ca73c1e272f0634901c4bd5f0ff8942f44739eca23b653d02bae3dd87819b162.exe Token: SeRestorePrivilege 1732 ca73c1e272f0634901c4bd5f0ff8942f44739eca23b653d02bae3dd87819b162.exe Token: SeShutdownPrivilege 1732 ca73c1e272f0634901c4bd5f0ff8942f44739eca23b653d02bae3dd87819b162.exe Token: SeDebugPrivilege 1732 ca73c1e272f0634901c4bd5f0ff8942f44739eca23b653d02bae3dd87819b162.exe Token: SeSystemEnvironmentPrivilege 1732 ca73c1e272f0634901c4bd5f0ff8942f44739eca23b653d02bae3dd87819b162.exe Token: SeChangeNotifyPrivilege 1732 ca73c1e272f0634901c4bd5f0ff8942f44739eca23b653d02bae3dd87819b162.exe Token: SeRemoteShutdownPrivilege 1732 ca73c1e272f0634901c4bd5f0ff8942f44739eca23b653d02bae3dd87819b162.exe Token: SeUndockPrivilege 1732 ca73c1e272f0634901c4bd5f0ff8942f44739eca23b653d02bae3dd87819b162.exe Token: SeManageVolumePrivilege 1732 ca73c1e272f0634901c4bd5f0ff8942f44739eca23b653d02bae3dd87819b162.exe Token: SeImpersonatePrivilege 1732 ca73c1e272f0634901c4bd5f0ff8942f44739eca23b653d02bae3dd87819b162.exe Token: SeCreateGlobalPrivilege 1732 ca73c1e272f0634901c4bd5f0ff8942f44739eca23b653d02bae3dd87819b162.exe Token: 33 1732 ca73c1e272f0634901c4bd5f0ff8942f44739eca23b653d02bae3dd87819b162.exe Token: 34 1732 ca73c1e272f0634901c4bd5f0ff8942f44739eca23b653d02bae3dd87819b162.exe Token: 35 1732 ca73c1e272f0634901c4bd5f0ff8942f44739eca23b653d02bae3dd87819b162.exe Token: SeIncreaseQuotaPrivilege 1956 msdcsc.exe Token: SeSecurityPrivilege 1956 msdcsc.exe Token: SeTakeOwnershipPrivilege 1956 msdcsc.exe Token: SeLoadDriverPrivilege 1956 msdcsc.exe Token: SeSystemProfilePrivilege 1956 msdcsc.exe Token: SeSystemtimePrivilege 1956 msdcsc.exe Token: SeProfSingleProcessPrivilege 1956 msdcsc.exe Token: SeIncBasePriorityPrivilege 1956 msdcsc.exe Token: SeCreatePagefilePrivilege 1956 msdcsc.exe Token: SeBackupPrivilege 1956 msdcsc.exe Token: SeRestorePrivilege 1956 msdcsc.exe Token: SeShutdownPrivilege 1956 msdcsc.exe Token: SeDebugPrivilege 1956 msdcsc.exe Token: SeSystemEnvironmentPrivilege 1956 msdcsc.exe Token: SeChangeNotifyPrivilege 1956 msdcsc.exe Token: SeRemoteShutdownPrivilege 1956 msdcsc.exe Token: SeUndockPrivilege 1956 msdcsc.exe Token: SeManageVolumePrivilege 1956 msdcsc.exe Token: SeImpersonatePrivilege 1956 msdcsc.exe Token: SeCreateGlobalPrivilege 1956 msdcsc.exe Token: 33 1956 msdcsc.exe Token: 34 1956 msdcsc.exe Token: 35 1956 msdcsc.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
msdcsc.exepid process 1956 msdcsc.exe -
Suspicious use of WriteProcessMemory 43 IoCs
Processes:
ca73c1e272f0634901c4bd5f0ff8942f44739eca23b653d02bae3dd87819b162.execmd.execmd.exemsdcsc.exedescription pid process target process PID 1732 wrote to memory of 1424 1732 ca73c1e272f0634901c4bd5f0ff8942f44739eca23b653d02bae3dd87819b162.exe cmd.exe PID 1732 wrote to memory of 1424 1732 ca73c1e272f0634901c4bd5f0ff8942f44739eca23b653d02bae3dd87819b162.exe cmd.exe PID 1732 wrote to memory of 1424 1732 ca73c1e272f0634901c4bd5f0ff8942f44739eca23b653d02bae3dd87819b162.exe cmd.exe PID 1732 wrote to memory of 1424 1732 ca73c1e272f0634901c4bd5f0ff8942f44739eca23b653d02bae3dd87819b162.exe cmd.exe PID 1732 wrote to memory of 1372 1732 ca73c1e272f0634901c4bd5f0ff8942f44739eca23b653d02bae3dd87819b162.exe cmd.exe PID 1732 wrote to memory of 1372 1732 ca73c1e272f0634901c4bd5f0ff8942f44739eca23b653d02bae3dd87819b162.exe cmd.exe PID 1732 wrote to memory of 1372 1732 ca73c1e272f0634901c4bd5f0ff8942f44739eca23b653d02bae3dd87819b162.exe cmd.exe PID 1732 wrote to memory of 1372 1732 ca73c1e272f0634901c4bd5f0ff8942f44739eca23b653d02bae3dd87819b162.exe cmd.exe PID 1424 wrote to memory of 1396 1424 cmd.exe attrib.exe PID 1424 wrote to memory of 1396 1424 cmd.exe attrib.exe PID 1424 wrote to memory of 1396 1424 cmd.exe attrib.exe PID 1424 wrote to memory of 1396 1424 cmd.exe attrib.exe PID 1372 wrote to memory of 268 1372 cmd.exe attrib.exe PID 1372 wrote to memory of 268 1372 cmd.exe attrib.exe PID 1372 wrote to memory of 268 1372 cmd.exe attrib.exe PID 1372 wrote to memory of 268 1372 cmd.exe attrib.exe PID 1732 wrote to memory of 1956 1732 ca73c1e272f0634901c4bd5f0ff8942f44739eca23b653d02bae3dd87819b162.exe msdcsc.exe PID 1732 wrote to memory of 1956 1732 ca73c1e272f0634901c4bd5f0ff8942f44739eca23b653d02bae3dd87819b162.exe msdcsc.exe PID 1732 wrote to memory of 1956 1732 ca73c1e272f0634901c4bd5f0ff8942f44739eca23b653d02bae3dd87819b162.exe msdcsc.exe PID 1732 wrote to memory of 1956 1732 ca73c1e272f0634901c4bd5f0ff8942f44739eca23b653d02bae3dd87819b162.exe msdcsc.exe PID 1956 wrote to memory of 1944 1956 msdcsc.exe notepad.exe PID 1956 wrote to memory of 1944 1956 msdcsc.exe notepad.exe PID 1956 wrote to memory of 1944 1956 msdcsc.exe notepad.exe PID 1956 wrote to memory of 1944 1956 msdcsc.exe notepad.exe PID 1956 wrote to memory of 1944 1956 msdcsc.exe notepad.exe PID 1956 wrote to memory of 1944 1956 msdcsc.exe notepad.exe PID 1956 wrote to memory of 1944 1956 msdcsc.exe notepad.exe PID 1956 wrote to memory of 1944 1956 msdcsc.exe notepad.exe PID 1956 wrote to memory of 1944 1956 msdcsc.exe notepad.exe PID 1956 wrote to memory of 1944 1956 msdcsc.exe notepad.exe PID 1956 wrote to memory of 1944 1956 msdcsc.exe notepad.exe PID 1956 wrote to memory of 1944 1956 msdcsc.exe notepad.exe PID 1956 wrote to memory of 1944 1956 msdcsc.exe notepad.exe PID 1956 wrote to memory of 1944 1956 msdcsc.exe notepad.exe PID 1956 wrote to memory of 1944 1956 msdcsc.exe notepad.exe PID 1956 wrote to memory of 1944 1956 msdcsc.exe notepad.exe PID 1956 wrote to memory of 1944 1956 msdcsc.exe notepad.exe PID 1956 wrote to memory of 1944 1956 msdcsc.exe notepad.exe PID 1956 wrote to memory of 1944 1956 msdcsc.exe notepad.exe PID 1956 wrote to memory of 1944 1956 msdcsc.exe notepad.exe PID 1956 wrote to memory of 1944 1956 msdcsc.exe notepad.exe PID 1956 wrote to memory of 1944 1956 msdcsc.exe notepad.exe PID 1956 wrote to memory of 1944 1956 msdcsc.exe notepad.exe -
Views/modifies file attributes 1 TTPs 2 IoCs
Processes:
attrib.exeattrib.exepid process 1396 attrib.exe 268 attrib.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\ca73c1e272f0634901c4bd5f0ff8942f44739eca23b653d02bae3dd87819b162.exe"C:\Users\Admin\AppData\Local\Temp\ca73c1e272f0634901c4bd5f0ff8942f44739eca23b653d02bae3dd87819b162.exe"1⤵
- Modifies WinLogon for persistence
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp\ca73c1e272f0634901c4bd5f0ff8942f44739eca23b653d02bae3dd87819b162.exe" +s +h2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Users\Admin\AppData\Local\Temp\ca73c1e272f0634901c4bd5f0ff8942f44739eca23b653d02bae3dd87819b162.exe" +s +h3⤵
- Sets file to hidden
- Views/modifies file attributes
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp" +s +h2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Users\Admin\AppData\Local\Temp" +s +h3⤵
- Sets file to hidden
- Views/modifies file attributes
-
C:\Users\Admin\Documents\MSDCSC\msdcsc.exe"C:\Users\Admin\Documents\MSDCSC\msdcsc.exe"2⤵
- Modifies firewall policy service
- Disables RegEdit via registry modification
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\notepad.exenotepad3⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\Documents\MSDCSC\msdcsc.exeFilesize
2.2MB
MD52143e3f661a12e987a590a19c62e80e5
SHA1178ac441bec96294ed7afcb6c11f6ba3e3143a75
SHA256ca73c1e272f0634901c4bd5f0ff8942f44739eca23b653d02bae3dd87819b162
SHA512b029cf8f8c146f4f4a29cb0204f60e659a200b4589cde0842fd4b456e364ea4bc6e4c555e74c92341fdb52f9529bfb54858f6104ede4796373d5883e5e1a8fb7
-
C:\Users\Admin\Documents\MSDCSC\msdcsc.exeFilesize
2.2MB
MD52143e3f661a12e987a590a19c62e80e5
SHA1178ac441bec96294ed7afcb6c11f6ba3e3143a75
SHA256ca73c1e272f0634901c4bd5f0ff8942f44739eca23b653d02bae3dd87819b162
SHA512b029cf8f8c146f4f4a29cb0204f60e659a200b4589cde0842fd4b456e364ea4bc6e4c555e74c92341fdb52f9529bfb54858f6104ede4796373d5883e5e1a8fb7
-
\Users\Admin\Documents\MSDCSC\msdcsc.exeFilesize
2.2MB
MD52143e3f661a12e987a590a19c62e80e5
SHA1178ac441bec96294ed7afcb6c11f6ba3e3143a75
SHA256ca73c1e272f0634901c4bd5f0ff8942f44739eca23b653d02bae3dd87819b162
SHA512b029cf8f8c146f4f4a29cb0204f60e659a200b4589cde0842fd4b456e364ea4bc6e4c555e74c92341fdb52f9529bfb54858f6104ede4796373d5883e5e1a8fb7
-
\Users\Admin\Documents\MSDCSC\msdcsc.exeFilesize
2.2MB
MD52143e3f661a12e987a590a19c62e80e5
SHA1178ac441bec96294ed7afcb6c11f6ba3e3143a75
SHA256ca73c1e272f0634901c4bd5f0ff8942f44739eca23b653d02bae3dd87819b162
SHA512b029cf8f8c146f4f4a29cb0204f60e659a200b4589cde0842fd4b456e364ea4bc6e4c555e74c92341fdb52f9529bfb54858f6104ede4796373d5883e5e1a8fb7
-
memory/268-60-0x0000000000000000-mapping.dmp
-
memory/1372-56-0x0000000000000000-mapping.dmp
-
memory/1396-58-0x0000000000000000-mapping.dmp
-
memory/1424-55-0x0000000000000000-mapping.dmp
-
memory/1732-59-0x0000000000400000-0x0000000000636000-memory.dmpFilesize
2.2MB
-
memory/1732-54-0x0000000075771000-0x0000000075773000-memory.dmpFilesize
8KB
-
memory/1732-57-0x0000000000260000-0x0000000000345000-memory.dmpFilesize
916KB
-
memory/1732-70-0x0000000000400000-0x0000000000636000-memory.dmpFilesize
2.2MB
-
memory/1944-67-0x0000000000000000-mapping.dmp
-
memory/1956-63-0x0000000000000000-mapping.dmp
-
memory/1956-69-0x0000000000400000-0x0000000000636000-memory.dmpFilesize
2.2MB
-
memory/1956-71-0x0000000000400000-0x0000000000636000-memory.dmpFilesize
2.2MB