Analysis
-
max time kernel
170s -
max time network
45s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
03-12-2022 13:38
Static task
static1
Behavioral task
behavioral1
Sample
c4648dcf38c8be2bd5014fb81c55fb5c29da969ebdea8bee8831c273a966657d.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
c4648dcf38c8be2bd5014fb81c55fb5c29da969ebdea8bee8831c273a966657d.exe
Resource
win10v2004-20220812-en
General
-
Target
c4648dcf38c8be2bd5014fb81c55fb5c29da969ebdea8bee8831c273a966657d.exe
-
Size
955KB
-
MD5
3aba0561bac692088a8124497b10bcc7
-
SHA1
d4bd0472181a1fd571b4524208bc10da22901b80
-
SHA256
c4648dcf38c8be2bd5014fb81c55fb5c29da969ebdea8bee8831c273a966657d
-
SHA512
844d49380b6c47f0295f33d2282aa9b0d877b5bea990a45c05530ef314bf0d7d060d4587895db944e4ca2688ea492d9863d96cf9bb19cb07a511fa88d7731a86
-
SSDEEP
24576:rdUvg0chwTjvBIvwaZQJniuL9W0pesrdc4jvU:rpKGoayZtd5nD
Malware Config
Extracted
darkcomet
Guest16
darkcomet-reborn.no-ip.org:80
DC_MUTEX-F54S21D
-
gencode
V7o8b6zx0d0d
-
install
false
-
offline_keylogger
true
-
persistence
false
Signatures
-
Uses the VBS compiler for execution 1 TTPs
-
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
c4648dcf38c8be2bd5014fb81c55fb5c29da969ebdea8bee8831c273a966657d.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\test = "C:\\Users\\Admin\\AppData\\Local\\Temp\\win.exe" c4648dcf38c8be2bd5014fb81c55fb5c29da969ebdea8bee8831c273a966657d.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
c4648dcf38c8be2bd5014fb81c55fb5c29da969ebdea8bee8831c273a966657d.exedescription pid process target process PID 1112 set thread context of 1828 1112 c4648dcf38c8be2bd5014fb81c55fb5c29da969ebdea8bee8831c273a966657d.exe vbc.exe -
Suspicious use of AdjustPrivilegeToken 23 IoCs
Processes:
vbc.exedescription pid process Token: SeIncreaseQuotaPrivilege 1828 vbc.exe Token: SeSecurityPrivilege 1828 vbc.exe Token: SeTakeOwnershipPrivilege 1828 vbc.exe Token: SeLoadDriverPrivilege 1828 vbc.exe Token: SeSystemProfilePrivilege 1828 vbc.exe Token: SeSystemtimePrivilege 1828 vbc.exe Token: SeProfSingleProcessPrivilege 1828 vbc.exe Token: SeIncBasePriorityPrivilege 1828 vbc.exe Token: SeCreatePagefilePrivilege 1828 vbc.exe Token: SeBackupPrivilege 1828 vbc.exe Token: SeRestorePrivilege 1828 vbc.exe Token: SeShutdownPrivilege 1828 vbc.exe Token: SeDebugPrivilege 1828 vbc.exe Token: SeSystemEnvironmentPrivilege 1828 vbc.exe Token: SeChangeNotifyPrivilege 1828 vbc.exe Token: SeRemoteShutdownPrivilege 1828 vbc.exe Token: SeUndockPrivilege 1828 vbc.exe Token: SeManageVolumePrivilege 1828 vbc.exe Token: SeImpersonatePrivilege 1828 vbc.exe Token: SeCreateGlobalPrivilege 1828 vbc.exe Token: 33 1828 vbc.exe Token: 34 1828 vbc.exe Token: 35 1828 vbc.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
vbc.exepid process 1828 vbc.exe -
Suspicious use of WriteProcessMemory 21 IoCs
Processes:
c4648dcf38c8be2bd5014fb81c55fb5c29da969ebdea8bee8831c273a966657d.exevbc.exedescription pid process target process PID 1112 wrote to memory of 1828 1112 c4648dcf38c8be2bd5014fb81c55fb5c29da969ebdea8bee8831c273a966657d.exe vbc.exe PID 1112 wrote to memory of 1828 1112 c4648dcf38c8be2bd5014fb81c55fb5c29da969ebdea8bee8831c273a966657d.exe vbc.exe PID 1112 wrote to memory of 1828 1112 c4648dcf38c8be2bd5014fb81c55fb5c29da969ebdea8bee8831c273a966657d.exe vbc.exe PID 1112 wrote to memory of 1828 1112 c4648dcf38c8be2bd5014fb81c55fb5c29da969ebdea8bee8831c273a966657d.exe vbc.exe PID 1112 wrote to memory of 1828 1112 c4648dcf38c8be2bd5014fb81c55fb5c29da969ebdea8bee8831c273a966657d.exe vbc.exe PID 1112 wrote to memory of 1828 1112 c4648dcf38c8be2bd5014fb81c55fb5c29da969ebdea8bee8831c273a966657d.exe vbc.exe PID 1112 wrote to memory of 1828 1112 c4648dcf38c8be2bd5014fb81c55fb5c29da969ebdea8bee8831c273a966657d.exe vbc.exe PID 1112 wrote to memory of 1828 1112 c4648dcf38c8be2bd5014fb81c55fb5c29da969ebdea8bee8831c273a966657d.exe vbc.exe PID 1112 wrote to memory of 1828 1112 c4648dcf38c8be2bd5014fb81c55fb5c29da969ebdea8bee8831c273a966657d.exe vbc.exe PID 1112 wrote to memory of 1828 1112 c4648dcf38c8be2bd5014fb81c55fb5c29da969ebdea8bee8831c273a966657d.exe vbc.exe PID 1112 wrote to memory of 1828 1112 c4648dcf38c8be2bd5014fb81c55fb5c29da969ebdea8bee8831c273a966657d.exe vbc.exe PID 1112 wrote to memory of 1828 1112 c4648dcf38c8be2bd5014fb81c55fb5c29da969ebdea8bee8831c273a966657d.exe vbc.exe PID 1112 wrote to memory of 1828 1112 c4648dcf38c8be2bd5014fb81c55fb5c29da969ebdea8bee8831c273a966657d.exe vbc.exe PID 1828 wrote to memory of 1972 1828 vbc.exe iexplore.exe PID 1828 wrote to memory of 1972 1828 vbc.exe iexplore.exe PID 1828 wrote to memory of 1972 1828 vbc.exe iexplore.exe PID 1828 wrote to memory of 1972 1828 vbc.exe iexplore.exe PID 1828 wrote to memory of 916 1828 vbc.exe explorer.exe PID 1828 wrote to memory of 916 1828 vbc.exe explorer.exe PID 1828 wrote to memory of 916 1828 vbc.exe explorer.exe PID 1828 wrote to memory of 916 1828 vbc.exe explorer.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\c4648dcf38c8be2bd5014fb81c55fb5c29da969ebdea8bee8831c273a966657d.exe"C:\Users\Admin\AppData\Local\Temp\c4648dcf38c8be2bd5014fb81c55fb5c29da969ebdea8bee8831c273a966657d.exe"1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeC:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe2⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\iexplore.exe"C:\Program Files (x86)\Internet Explorer\iexplore.exe"3⤵
-
C:\Windows\explorer.exe"C:\Windows\explorer.exe"3⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1112-54-0x0000000075F51000-0x0000000075F53000-memory.dmpFilesize
8KB
-
memory/1112-72-0x0000000073FC0000-0x000000007456B000-memory.dmpFilesize
5.7MB
-
memory/1828-60-0x0000000000400000-0x00000000004B5000-memory.dmpFilesize
724KB
-
memory/1828-70-0x0000000000490888-mapping.dmp
-
memory/1828-56-0x0000000000400000-0x00000000004B5000-memory.dmpFilesize
724KB
-
memory/1828-62-0x0000000000400000-0x00000000004B5000-memory.dmpFilesize
724KB
-
memory/1828-64-0x0000000000400000-0x00000000004B5000-memory.dmpFilesize
724KB
-
memory/1828-65-0x0000000000400000-0x00000000004B5000-memory.dmpFilesize
724KB
-
memory/1828-67-0x0000000000400000-0x00000000004B5000-memory.dmpFilesize
724KB
-
memory/1828-58-0x0000000000400000-0x00000000004B5000-memory.dmpFilesize
724KB
-
memory/1828-69-0x0000000000400000-0x00000000004B5000-memory.dmpFilesize
724KB
-
memory/1828-71-0x0000000000400000-0x00000000004B5000-memory.dmpFilesize
724KB
-
memory/1828-55-0x0000000000400000-0x00000000004B5000-memory.dmpFilesize
724KB
-
memory/1828-74-0x0000000000400000-0x00000000004B5000-memory.dmpFilesize
724KB
-
memory/1828-75-0x0000000000400000-0x00000000004B5000-memory.dmpFilesize
724KB
-
memory/1828-76-0x0000000000400000-0x00000000004B5000-memory.dmpFilesize
724KB