Analysis
-
max time kernel
149s -
max time network
51s -
platform
windows7_x64 -
resource
win7-20220901-en -
resource tags
arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system -
submitted
03-12-2022 05:57
Static task
static1
Behavioral task
behavioral1
Sample
c043cab402c17c7e60da9d85d3178e78ac5c7345d817e636d9638feda0b6db74.exe
Resource
win7-20220901-en
General
-
Target
c043cab402c17c7e60da9d85d3178e78ac5c7345d817e636d9638feda0b6db74.exe
-
Size
410KB
-
MD5
09fecd98f5b83c5f57911faced1d1060
-
SHA1
907256dd13588d4ec8fe10270c68b8060dab2ba7
-
SHA256
c043cab402c17c7e60da9d85d3178e78ac5c7345d817e636d9638feda0b6db74
-
SHA512
d2096db62102392b7cbbe8fbc2938c28a9a6dc16309d01825f5b79498b9e24665548f1b0b30c63ad48c96da20afa0d975e0522ef16c7cd4705a56a9984a54488
-
SSDEEP
12288:YwkHRBLs/GjFiQGEO/Udn3t0AJzQc++X8:QHRBLPIQ7fk+M
Malware Config
Extracted
darkcomet
Guest16
127.0.0.1:1604
jamawaranti.no-ip.biz:1604
DC_MUTEX-E6AHY0A
-
gencode
3V7typXAyF8z
-
install
false
-
offline_keylogger
true
-
persistence
false
Signatures
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
c043cab402c17c7e60da9d85d3178e78ac5c7345d817e636d9638feda0b6db74.exedescription pid process target process PID 1204 set thread context of 1776 1204 c043cab402c17c7e60da9d85d3178e78ac5c7345d817e636d9638feda0b6db74.exe c043cab402c17c7e60da9d85d3178e78ac5c7345d817e636d9638feda0b6db74.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of AdjustPrivilegeToken 23 IoCs
Processes:
c043cab402c17c7e60da9d85d3178e78ac5c7345d817e636d9638feda0b6db74.exedescription pid process Token: SeIncreaseQuotaPrivilege 1776 c043cab402c17c7e60da9d85d3178e78ac5c7345d817e636d9638feda0b6db74.exe Token: SeSecurityPrivilege 1776 c043cab402c17c7e60da9d85d3178e78ac5c7345d817e636d9638feda0b6db74.exe Token: SeTakeOwnershipPrivilege 1776 c043cab402c17c7e60da9d85d3178e78ac5c7345d817e636d9638feda0b6db74.exe Token: SeLoadDriverPrivilege 1776 c043cab402c17c7e60da9d85d3178e78ac5c7345d817e636d9638feda0b6db74.exe Token: SeSystemProfilePrivilege 1776 c043cab402c17c7e60da9d85d3178e78ac5c7345d817e636d9638feda0b6db74.exe Token: SeSystemtimePrivilege 1776 c043cab402c17c7e60da9d85d3178e78ac5c7345d817e636d9638feda0b6db74.exe Token: SeProfSingleProcessPrivilege 1776 c043cab402c17c7e60da9d85d3178e78ac5c7345d817e636d9638feda0b6db74.exe Token: SeIncBasePriorityPrivilege 1776 c043cab402c17c7e60da9d85d3178e78ac5c7345d817e636d9638feda0b6db74.exe Token: SeCreatePagefilePrivilege 1776 c043cab402c17c7e60da9d85d3178e78ac5c7345d817e636d9638feda0b6db74.exe Token: SeBackupPrivilege 1776 c043cab402c17c7e60da9d85d3178e78ac5c7345d817e636d9638feda0b6db74.exe Token: SeRestorePrivilege 1776 c043cab402c17c7e60da9d85d3178e78ac5c7345d817e636d9638feda0b6db74.exe Token: SeShutdownPrivilege 1776 c043cab402c17c7e60da9d85d3178e78ac5c7345d817e636d9638feda0b6db74.exe Token: SeDebugPrivilege 1776 c043cab402c17c7e60da9d85d3178e78ac5c7345d817e636d9638feda0b6db74.exe Token: SeSystemEnvironmentPrivilege 1776 c043cab402c17c7e60da9d85d3178e78ac5c7345d817e636d9638feda0b6db74.exe Token: SeChangeNotifyPrivilege 1776 c043cab402c17c7e60da9d85d3178e78ac5c7345d817e636d9638feda0b6db74.exe Token: SeRemoteShutdownPrivilege 1776 c043cab402c17c7e60da9d85d3178e78ac5c7345d817e636d9638feda0b6db74.exe Token: SeUndockPrivilege 1776 c043cab402c17c7e60da9d85d3178e78ac5c7345d817e636d9638feda0b6db74.exe Token: SeManageVolumePrivilege 1776 c043cab402c17c7e60da9d85d3178e78ac5c7345d817e636d9638feda0b6db74.exe Token: SeImpersonatePrivilege 1776 c043cab402c17c7e60da9d85d3178e78ac5c7345d817e636d9638feda0b6db74.exe Token: SeCreateGlobalPrivilege 1776 c043cab402c17c7e60da9d85d3178e78ac5c7345d817e636d9638feda0b6db74.exe Token: 33 1776 c043cab402c17c7e60da9d85d3178e78ac5c7345d817e636d9638feda0b6db74.exe Token: 34 1776 c043cab402c17c7e60da9d85d3178e78ac5c7345d817e636d9638feda0b6db74.exe Token: 35 1776 c043cab402c17c7e60da9d85d3178e78ac5c7345d817e636d9638feda0b6db74.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
c043cab402c17c7e60da9d85d3178e78ac5c7345d817e636d9638feda0b6db74.exepid process 1776 c043cab402c17c7e60da9d85d3178e78ac5c7345d817e636d9638feda0b6db74.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
c043cab402c17c7e60da9d85d3178e78ac5c7345d817e636d9638feda0b6db74.exedescription pid process target process PID 1204 wrote to memory of 1776 1204 c043cab402c17c7e60da9d85d3178e78ac5c7345d817e636d9638feda0b6db74.exe c043cab402c17c7e60da9d85d3178e78ac5c7345d817e636d9638feda0b6db74.exe PID 1204 wrote to memory of 1776 1204 c043cab402c17c7e60da9d85d3178e78ac5c7345d817e636d9638feda0b6db74.exe c043cab402c17c7e60da9d85d3178e78ac5c7345d817e636d9638feda0b6db74.exe PID 1204 wrote to memory of 1776 1204 c043cab402c17c7e60da9d85d3178e78ac5c7345d817e636d9638feda0b6db74.exe c043cab402c17c7e60da9d85d3178e78ac5c7345d817e636d9638feda0b6db74.exe PID 1204 wrote to memory of 1776 1204 c043cab402c17c7e60da9d85d3178e78ac5c7345d817e636d9638feda0b6db74.exe c043cab402c17c7e60da9d85d3178e78ac5c7345d817e636d9638feda0b6db74.exe PID 1204 wrote to memory of 1776 1204 c043cab402c17c7e60da9d85d3178e78ac5c7345d817e636d9638feda0b6db74.exe c043cab402c17c7e60da9d85d3178e78ac5c7345d817e636d9638feda0b6db74.exe PID 1204 wrote to memory of 1776 1204 c043cab402c17c7e60da9d85d3178e78ac5c7345d817e636d9638feda0b6db74.exe c043cab402c17c7e60da9d85d3178e78ac5c7345d817e636d9638feda0b6db74.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\c043cab402c17c7e60da9d85d3178e78ac5c7345d817e636d9638feda0b6db74.exe"C:\Users\Admin\AppData\Local\Temp\c043cab402c17c7e60da9d85d3178e78ac5c7345d817e636d9638feda0b6db74.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\c043cab402c17c7e60da9d85d3178e78ac5c7345d817e636d9638feda0b6db74.exe"C:\Users\Admin\AppData\Local\Temp\c043cab402c17c7e60da9d85d3178e78ac5c7345d817e636d9638feda0b6db74.exe"2⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1204-54-0x0000000074DE1000-0x0000000074DE3000-memory.dmpFilesize
8KB
-
memory/1776-55-0x0000000000400000-0x00000000004B8000-memory.dmpFilesize
736KB
-
memory/1776-57-0x0000000000400000-0x00000000004B8000-memory.dmpFilesize
736KB
-
memory/1776-58-0x0000000000490888-mapping.dmp
-
memory/1776-59-0x0000000000400000-0x00000000004B8000-memory.dmpFilesize
736KB
-
memory/1776-61-0x0000000000400000-0x00000000004B8000-memory.dmpFilesize
736KB
-
memory/1776-62-0x0000000000400000-0x00000000004B8000-memory.dmpFilesize
736KB
-
memory/1776-63-0x0000000000400000-0x00000000004B8000-memory.dmpFilesize
736KB