Analysis
-
max time kernel
150s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
03-12-2022 05:57
Static task
static1
Behavioral task
behavioral1
Sample
c043cab402c17c7e60da9d85d3178e78ac5c7345d817e636d9638feda0b6db74.exe
Resource
win7-20220901-en
General
-
Target
c043cab402c17c7e60da9d85d3178e78ac5c7345d817e636d9638feda0b6db74.exe
-
Size
410KB
-
MD5
09fecd98f5b83c5f57911faced1d1060
-
SHA1
907256dd13588d4ec8fe10270c68b8060dab2ba7
-
SHA256
c043cab402c17c7e60da9d85d3178e78ac5c7345d817e636d9638feda0b6db74
-
SHA512
d2096db62102392b7cbbe8fbc2938c28a9a6dc16309d01825f5b79498b9e24665548f1b0b30c63ad48c96da20afa0d975e0522ef16c7cd4705a56a9984a54488
-
SSDEEP
12288:YwkHRBLs/GjFiQGEO/Udn3t0AJzQc++X8:QHRBLPIQ7fk+M
Malware Config
Extracted
darkcomet
Guest16
127.0.0.1:1604
jamawaranti.no-ip.biz:1604
DC_MUTEX-E6AHY0A
-
gencode
3V7typXAyF8z
-
install
false
-
offline_keylogger
true
-
persistence
false
Signatures
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
c043cab402c17c7e60da9d85d3178e78ac5c7345d817e636d9638feda0b6db74.exedescription pid process target process PID 2620 set thread context of 2900 2620 c043cab402c17c7e60da9d85d3178e78ac5c7345d817e636d9638feda0b6db74.exe c043cab402c17c7e60da9d85d3178e78ac5c7345d817e636d9638feda0b6db74.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of AdjustPrivilegeToken 24 IoCs
Processes:
c043cab402c17c7e60da9d85d3178e78ac5c7345d817e636d9638feda0b6db74.exedescription pid process Token: SeIncreaseQuotaPrivilege 2900 c043cab402c17c7e60da9d85d3178e78ac5c7345d817e636d9638feda0b6db74.exe Token: SeSecurityPrivilege 2900 c043cab402c17c7e60da9d85d3178e78ac5c7345d817e636d9638feda0b6db74.exe Token: SeTakeOwnershipPrivilege 2900 c043cab402c17c7e60da9d85d3178e78ac5c7345d817e636d9638feda0b6db74.exe Token: SeLoadDriverPrivilege 2900 c043cab402c17c7e60da9d85d3178e78ac5c7345d817e636d9638feda0b6db74.exe Token: SeSystemProfilePrivilege 2900 c043cab402c17c7e60da9d85d3178e78ac5c7345d817e636d9638feda0b6db74.exe Token: SeSystemtimePrivilege 2900 c043cab402c17c7e60da9d85d3178e78ac5c7345d817e636d9638feda0b6db74.exe Token: SeProfSingleProcessPrivilege 2900 c043cab402c17c7e60da9d85d3178e78ac5c7345d817e636d9638feda0b6db74.exe Token: SeIncBasePriorityPrivilege 2900 c043cab402c17c7e60da9d85d3178e78ac5c7345d817e636d9638feda0b6db74.exe Token: SeCreatePagefilePrivilege 2900 c043cab402c17c7e60da9d85d3178e78ac5c7345d817e636d9638feda0b6db74.exe Token: SeBackupPrivilege 2900 c043cab402c17c7e60da9d85d3178e78ac5c7345d817e636d9638feda0b6db74.exe Token: SeRestorePrivilege 2900 c043cab402c17c7e60da9d85d3178e78ac5c7345d817e636d9638feda0b6db74.exe Token: SeShutdownPrivilege 2900 c043cab402c17c7e60da9d85d3178e78ac5c7345d817e636d9638feda0b6db74.exe Token: SeDebugPrivilege 2900 c043cab402c17c7e60da9d85d3178e78ac5c7345d817e636d9638feda0b6db74.exe Token: SeSystemEnvironmentPrivilege 2900 c043cab402c17c7e60da9d85d3178e78ac5c7345d817e636d9638feda0b6db74.exe Token: SeChangeNotifyPrivilege 2900 c043cab402c17c7e60da9d85d3178e78ac5c7345d817e636d9638feda0b6db74.exe Token: SeRemoteShutdownPrivilege 2900 c043cab402c17c7e60da9d85d3178e78ac5c7345d817e636d9638feda0b6db74.exe Token: SeUndockPrivilege 2900 c043cab402c17c7e60da9d85d3178e78ac5c7345d817e636d9638feda0b6db74.exe Token: SeManageVolumePrivilege 2900 c043cab402c17c7e60da9d85d3178e78ac5c7345d817e636d9638feda0b6db74.exe Token: SeImpersonatePrivilege 2900 c043cab402c17c7e60da9d85d3178e78ac5c7345d817e636d9638feda0b6db74.exe Token: SeCreateGlobalPrivilege 2900 c043cab402c17c7e60da9d85d3178e78ac5c7345d817e636d9638feda0b6db74.exe Token: 33 2900 c043cab402c17c7e60da9d85d3178e78ac5c7345d817e636d9638feda0b6db74.exe Token: 34 2900 c043cab402c17c7e60da9d85d3178e78ac5c7345d817e636d9638feda0b6db74.exe Token: 35 2900 c043cab402c17c7e60da9d85d3178e78ac5c7345d817e636d9638feda0b6db74.exe Token: 36 2900 c043cab402c17c7e60da9d85d3178e78ac5c7345d817e636d9638feda0b6db74.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
c043cab402c17c7e60da9d85d3178e78ac5c7345d817e636d9638feda0b6db74.exepid process 2900 c043cab402c17c7e60da9d85d3178e78ac5c7345d817e636d9638feda0b6db74.exe -
Suspicious use of WriteProcessMemory 5 IoCs
Processes:
c043cab402c17c7e60da9d85d3178e78ac5c7345d817e636d9638feda0b6db74.exedescription pid process target process PID 2620 wrote to memory of 2900 2620 c043cab402c17c7e60da9d85d3178e78ac5c7345d817e636d9638feda0b6db74.exe c043cab402c17c7e60da9d85d3178e78ac5c7345d817e636d9638feda0b6db74.exe PID 2620 wrote to memory of 2900 2620 c043cab402c17c7e60da9d85d3178e78ac5c7345d817e636d9638feda0b6db74.exe c043cab402c17c7e60da9d85d3178e78ac5c7345d817e636d9638feda0b6db74.exe PID 2620 wrote to memory of 2900 2620 c043cab402c17c7e60da9d85d3178e78ac5c7345d817e636d9638feda0b6db74.exe c043cab402c17c7e60da9d85d3178e78ac5c7345d817e636d9638feda0b6db74.exe PID 2620 wrote to memory of 2900 2620 c043cab402c17c7e60da9d85d3178e78ac5c7345d817e636d9638feda0b6db74.exe c043cab402c17c7e60da9d85d3178e78ac5c7345d817e636d9638feda0b6db74.exe PID 2620 wrote to memory of 2900 2620 c043cab402c17c7e60da9d85d3178e78ac5c7345d817e636d9638feda0b6db74.exe c043cab402c17c7e60da9d85d3178e78ac5c7345d817e636d9638feda0b6db74.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\c043cab402c17c7e60da9d85d3178e78ac5c7345d817e636d9638feda0b6db74.exe"C:\Users\Admin\AppData\Local\Temp\c043cab402c17c7e60da9d85d3178e78ac5c7345d817e636d9638feda0b6db74.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\c043cab402c17c7e60da9d85d3178e78ac5c7345d817e636d9638feda0b6db74.exe"C:\Users\Admin\AppData\Local\Temp\c043cab402c17c7e60da9d85d3178e78ac5c7345d817e636d9638feda0b6db74.exe"2⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2900-132-0x0000000000000000-mapping.dmp
-
memory/2900-133-0x0000000000400000-0x00000000004B8000-memory.dmpFilesize
736KB
-
memory/2900-134-0x0000000000400000-0x00000000004B8000-memory.dmpFilesize
736KB
-
memory/2900-135-0x0000000000400000-0x00000000004B8000-memory.dmpFilesize
736KB
-
memory/2900-136-0x0000000000400000-0x00000000004B8000-memory.dmpFilesize
736KB
-
memory/2900-137-0x0000000000400000-0x00000000004B8000-memory.dmpFilesize
736KB