Analysis
-
max time kernel
154s -
max time network
77s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
05/12/2022, 06:36
Behavioral task
behavioral1
Sample
8970ab5f181d4d7796dae8adc4326d6da14eda07741086cc551ab7dddf933e19.exe
Resource
win7-20221111-en
General
-
Target
8970ab5f181d4d7796dae8adc4326d6da14eda07741086cc551ab7dddf933e19.exe
-
Size
690KB
-
MD5
81ed6dcb795201a907f16ce79baa0a56
-
SHA1
eb021f72c8b0cc17c36e8eab5dabc45e7e47aa5e
-
SHA256
8970ab5f181d4d7796dae8adc4326d6da14eda07741086cc551ab7dddf933e19
-
SHA512
b9bd7cf934d7427772162e13753e2961d80117cc3f3fe87b488450f8991412510f138eb60a0438eec7b89e46f15de2c5cbe801b8e9092ae2df503cc87cb3b91c
-
SSDEEP
12288:Z9HFJ9rJxRX1uVVjoaWSoynxdO1FVBaOiRZTERfIhNkNCCLo9Ek5C/hA4:jZ1xuVVjfFoynPaVBUR8f+kN10EB3
Malware Config
Extracted
darkcomet
Guest16
abdulla-omer.no-ip.org:1604
DC_MUTEX-TWQ3SUY
-
InstallPath
System32\SysConf.exe
-
gencode
ea0LncChfRvj
-
install
true
-
offline_keylogger
true
-
persistence
true
-
reg_key
SystemConf
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\System32\\SysConf.exe" 8970ab5f181d4d7796dae8adc4326d6da14eda07741086cc551ab7dddf933e19.exe -
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" SysConf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" SysConf.exe -
Disables RegEdit via registry modification 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" SysConf.exe -
Executes dropped EXE 1 IoCs
pid Process 1408 SysConf.exe -
Sets file to hidden 1 TTPs 2 IoCs
Modifies file attributes to stop it showing in Explorer etc.
pid Process 1112 attrib.exe 1048 attrib.exe -
Deletes itself 1 IoCs
pid Process 468 notepad.exe -
Loads dropped DLL 2 IoCs
pid Process 2032 8970ab5f181d4d7796dae8adc4326d6da14eda07741086cc551ab7dddf933e19.exe 2032 8970ab5f181d4d7796dae8adc4326d6da14eda07741086cc551ab7dddf933e19.exe -
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" SysConf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" SysConf.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run\SystemConf = "C:\\Windows\\system32\\System32\\SysConf.exe" 8970ab5f181d4d7796dae8adc4326d6da14eda07741086cc551ab7dddf933e19.exe Set value (str) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run\SystemConf = "C:\\Windows\\system32\\System32\\SysConf.exe" SysConf.exe -
Drops file in System32 directory 3 IoCs
description ioc Process File created C:\Windows\SysWOW64\System32\SysConf.exe 8970ab5f181d4d7796dae8adc4326d6da14eda07741086cc551ab7dddf933e19.exe File opened for modification C:\Windows\SysWOW64\System32\SysConf.exe 8970ab5f181d4d7796dae8adc4326d6da14eda07741086cc551ab7dddf933e19.exe File opened for modification C:\Windows\SysWOW64\System32\ 8970ab5f181d4d7796dae8adc4326d6da14eda07741086cc551ab7dddf933e19.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1408 SysConf.exe -
Suspicious use of AdjustPrivilegeToken 46 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 2032 8970ab5f181d4d7796dae8adc4326d6da14eda07741086cc551ab7dddf933e19.exe Token: SeSecurityPrivilege 2032 8970ab5f181d4d7796dae8adc4326d6da14eda07741086cc551ab7dddf933e19.exe Token: SeTakeOwnershipPrivilege 2032 8970ab5f181d4d7796dae8adc4326d6da14eda07741086cc551ab7dddf933e19.exe Token: SeLoadDriverPrivilege 2032 8970ab5f181d4d7796dae8adc4326d6da14eda07741086cc551ab7dddf933e19.exe Token: SeSystemProfilePrivilege 2032 8970ab5f181d4d7796dae8adc4326d6da14eda07741086cc551ab7dddf933e19.exe Token: SeSystemtimePrivilege 2032 8970ab5f181d4d7796dae8adc4326d6da14eda07741086cc551ab7dddf933e19.exe Token: SeProfSingleProcessPrivilege 2032 8970ab5f181d4d7796dae8adc4326d6da14eda07741086cc551ab7dddf933e19.exe Token: SeIncBasePriorityPrivilege 2032 8970ab5f181d4d7796dae8adc4326d6da14eda07741086cc551ab7dddf933e19.exe Token: SeCreatePagefilePrivilege 2032 8970ab5f181d4d7796dae8adc4326d6da14eda07741086cc551ab7dddf933e19.exe Token: SeBackupPrivilege 2032 8970ab5f181d4d7796dae8adc4326d6da14eda07741086cc551ab7dddf933e19.exe Token: SeRestorePrivilege 2032 8970ab5f181d4d7796dae8adc4326d6da14eda07741086cc551ab7dddf933e19.exe Token: SeShutdownPrivilege 2032 8970ab5f181d4d7796dae8adc4326d6da14eda07741086cc551ab7dddf933e19.exe Token: SeDebugPrivilege 2032 8970ab5f181d4d7796dae8adc4326d6da14eda07741086cc551ab7dddf933e19.exe Token: SeSystemEnvironmentPrivilege 2032 8970ab5f181d4d7796dae8adc4326d6da14eda07741086cc551ab7dddf933e19.exe Token: SeChangeNotifyPrivilege 2032 8970ab5f181d4d7796dae8adc4326d6da14eda07741086cc551ab7dddf933e19.exe Token: SeRemoteShutdownPrivilege 2032 8970ab5f181d4d7796dae8adc4326d6da14eda07741086cc551ab7dddf933e19.exe Token: SeUndockPrivilege 2032 8970ab5f181d4d7796dae8adc4326d6da14eda07741086cc551ab7dddf933e19.exe Token: SeManageVolumePrivilege 2032 8970ab5f181d4d7796dae8adc4326d6da14eda07741086cc551ab7dddf933e19.exe Token: SeImpersonatePrivilege 2032 8970ab5f181d4d7796dae8adc4326d6da14eda07741086cc551ab7dddf933e19.exe Token: SeCreateGlobalPrivilege 2032 8970ab5f181d4d7796dae8adc4326d6da14eda07741086cc551ab7dddf933e19.exe Token: 33 2032 8970ab5f181d4d7796dae8adc4326d6da14eda07741086cc551ab7dddf933e19.exe Token: 34 2032 8970ab5f181d4d7796dae8adc4326d6da14eda07741086cc551ab7dddf933e19.exe Token: 35 2032 8970ab5f181d4d7796dae8adc4326d6da14eda07741086cc551ab7dddf933e19.exe Token: SeIncreaseQuotaPrivilege 1408 SysConf.exe Token: SeSecurityPrivilege 1408 SysConf.exe Token: SeTakeOwnershipPrivilege 1408 SysConf.exe Token: SeLoadDriverPrivilege 1408 SysConf.exe Token: SeSystemProfilePrivilege 1408 SysConf.exe Token: SeSystemtimePrivilege 1408 SysConf.exe Token: SeProfSingleProcessPrivilege 1408 SysConf.exe Token: SeIncBasePriorityPrivilege 1408 SysConf.exe Token: SeCreatePagefilePrivilege 1408 SysConf.exe Token: SeBackupPrivilege 1408 SysConf.exe Token: SeRestorePrivilege 1408 SysConf.exe Token: SeShutdownPrivilege 1408 SysConf.exe Token: SeDebugPrivilege 1408 SysConf.exe Token: SeSystemEnvironmentPrivilege 1408 SysConf.exe Token: SeChangeNotifyPrivilege 1408 SysConf.exe Token: SeRemoteShutdownPrivilege 1408 SysConf.exe Token: SeUndockPrivilege 1408 SysConf.exe Token: SeManageVolumePrivilege 1408 SysConf.exe Token: SeImpersonatePrivilege 1408 SysConf.exe Token: SeCreateGlobalPrivilege 1408 SysConf.exe Token: 33 1408 SysConf.exe Token: 34 1408 SysConf.exe Token: 35 1408 SysConf.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 1408 SysConf.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2032 wrote to memory of 908 2032 8970ab5f181d4d7796dae8adc4326d6da14eda07741086cc551ab7dddf933e19.exe 28 PID 2032 wrote to memory of 908 2032 8970ab5f181d4d7796dae8adc4326d6da14eda07741086cc551ab7dddf933e19.exe 28 PID 2032 wrote to memory of 908 2032 8970ab5f181d4d7796dae8adc4326d6da14eda07741086cc551ab7dddf933e19.exe 28 PID 2032 wrote to memory of 908 2032 8970ab5f181d4d7796dae8adc4326d6da14eda07741086cc551ab7dddf933e19.exe 28 PID 2032 wrote to memory of 556 2032 8970ab5f181d4d7796dae8adc4326d6da14eda07741086cc551ab7dddf933e19.exe 29 PID 2032 wrote to memory of 556 2032 8970ab5f181d4d7796dae8adc4326d6da14eda07741086cc551ab7dddf933e19.exe 29 PID 2032 wrote to memory of 556 2032 8970ab5f181d4d7796dae8adc4326d6da14eda07741086cc551ab7dddf933e19.exe 29 PID 2032 wrote to memory of 556 2032 8970ab5f181d4d7796dae8adc4326d6da14eda07741086cc551ab7dddf933e19.exe 29 PID 2032 wrote to memory of 468 2032 8970ab5f181d4d7796dae8adc4326d6da14eda07741086cc551ab7dddf933e19.exe 31 PID 2032 wrote to memory of 468 2032 8970ab5f181d4d7796dae8adc4326d6da14eda07741086cc551ab7dddf933e19.exe 31 PID 2032 wrote to memory of 468 2032 8970ab5f181d4d7796dae8adc4326d6da14eda07741086cc551ab7dddf933e19.exe 31 PID 2032 wrote to memory of 468 2032 8970ab5f181d4d7796dae8adc4326d6da14eda07741086cc551ab7dddf933e19.exe 31 PID 2032 wrote to memory of 468 2032 8970ab5f181d4d7796dae8adc4326d6da14eda07741086cc551ab7dddf933e19.exe 31 PID 2032 wrote to memory of 468 2032 8970ab5f181d4d7796dae8adc4326d6da14eda07741086cc551ab7dddf933e19.exe 31 PID 2032 wrote to memory of 468 2032 8970ab5f181d4d7796dae8adc4326d6da14eda07741086cc551ab7dddf933e19.exe 31 PID 2032 wrote to memory of 468 2032 8970ab5f181d4d7796dae8adc4326d6da14eda07741086cc551ab7dddf933e19.exe 31 PID 2032 wrote to memory of 468 2032 8970ab5f181d4d7796dae8adc4326d6da14eda07741086cc551ab7dddf933e19.exe 31 PID 2032 wrote to memory of 468 2032 8970ab5f181d4d7796dae8adc4326d6da14eda07741086cc551ab7dddf933e19.exe 31 PID 2032 wrote to memory of 468 2032 8970ab5f181d4d7796dae8adc4326d6da14eda07741086cc551ab7dddf933e19.exe 31 PID 2032 wrote to memory of 468 2032 8970ab5f181d4d7796dae8adc4326d6da14eda07741086cc551ab7dddf933e19.exe 31 PID 2032 wrote to memory of 468 2032 8970ab5f181d4d7796dae8adc4326d6da14eda07741086cc551ab7dddf933e19.exe 31 PID 2032 wrote to memory of 468 2032 8970ab5f181d4d7796dae8adc4326d6da14eda07741086cc551ab7dddf933e19.exe 31 PID 2032 wrote to memory of 468 2032 8970ab5f181d4d7796dae8adc4326d6da14eda07741086cc551ab7dddf933e19.exe 31 PID 2032 wrote to memory of 468 2032 8970ab5f181d4d7796dae8adc4326d6da14eda07741086cc551ab7dddf933e19.exe 31 PID 2032 wrote to memory of 468 2032 8970ab5f181d4d7796dae8adc4326d6da14eda07741086cc551ab7dddf933e19.exe 31 PID 2032 wrote to memory of 468 2032 8970ab5f181d4d7796dae8adc4326d6da14eda07741086cc551ab7dddf933e19.exe 31 PID 556 wrote to memory of 1048 556 cmd.exe 34 PID 556 wrote to memory of 1048 556 cmd.exe 34 PID 556 wrote to memory of 1048 556 cmd.exe 34 PID 556 wrote to memory of 1048 556 cmd.exe 34 PID 908 wrote to memory of 1112 908 cmd.exe 33 PID 908 wrote to memory of 1112 908 cmd.exe 33 PID 908 wrote to memory of 1112 908 cmd.exe 33 PID 908 wrote to memory of 1112 908 cmd.exe 33 PID 2032 wrote to memory of 1408 2032 8970ab5f181d4d7796dae8adc4326d6da14eda07741086cc551ab7dddf933e19.exe 35 PID 2032 wrote to memory of 1408 2032 8970ab5f181d4d7796dae8adc4326d6da14eda07741086cc551ab7dddf933e19.exe 35 PID 2032 wrote to memory of 1408 2032 8970ab5f181d4d7796dae8adc4326d6da14eda07741086cc551ab7dddf933e19.exe 35 PID 2032 wrote to memory of 1408 2032 8970ab5f181d4d7796dae8adc4326d6da14eda07741086cc551ab7dddf933e19.exe 35 PID 1408 wrote to memory of 820 1408 SysConf.exe 36 PID 1408 wrote to memory of 820 1408 SysConf.exe 36 PID 1408 wrote to memory of 820 1408 SysConf.exe 36 PID 1408 wrote to memory of 820 1408 SysConf.exe 36 PID 1408 wrote to memory of 992 1408 SysConf.exe 37 PID 1408 wrote to memory of 992 1408 SysConf.exe 37 PID 1408 wrote to memory of 992 1408 SysConf.exe 37 PID 1408 wrote to memory of 992 1408 SysConf.exe 37 PID 1408 wrote to memory of 364 1408 SysConf.exe 38 PID 1408 wrote to memory of 364 1408 SysConf.exe 38 PID 1408 wrote to memory of 364 1408 SysConf.exe 38 PID 1408 wrote to memory of 364 1408 SysConf.exe 38 PID 1408 wrote to memory of 364 1408 SysConf.exe 38 PID 1408 wrote to memory of 364 1408 SysConf.exe 38 PID 1408 wrote to memory of 364 1408 SysConf.exe 38 PID 1408 wrote to memory of 364 1408 SysConf.exe 38 PID 1408 wrote to memory of 364 1408 SysConf.exe 38 PID 1408 wrote to memory of 364 1408 SysConf.exe 38 PID 1408 wrote to memory of 364 1408 SysConf.exe 38 PID 1408 wrote to memory of 364 1408 SysConf.exe 38 PID 1408 wrote to memory of 364 1408 SysConf.exe 38 PID 1408 wrote to memory of 364 1408 SysConf.exe 38 PID 1408 wrote to memory of 364 1408 SysConf.exe 38 PID 1408 wrote to memory of 364 1408 SysConf.exe 38 PID 1408 wrote to memory of 364 1408 SysConf.exe 38 PID 1408 wrote to memory of 364 1408 SysConf.exe 38 -
Views/modifies file attributes 1 TTPs 2 IoCs
pid Process 1112 attrib.exe 1048 attrib.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\8970ab5f181d4d7796dae8adc4326d6da14eda07741086cc551ab7dddf933e19.exe"C:\Users\Admin\AppData\Local\Temp\8970ab5f181d4d7796dae8adc4326d6da14eda07741086cc551ab7dddf933e19.exe"1⤵
- Modifies WinLogon for persistence
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2032 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp\8970ab5f181d4d7796dae8adc4326d6da14eda07741086cc551ab7dddf933e19.exe" +s +h2⤵
- Suspicious use of WriteProcessMemory
PID:908 -
C:\Windows\SysWOW64\attrib.exeattrib "C:\Users\Admin\AppData\Local\Temp\8970ab5f181d4d7796dae8adc4326d6da14eda07741086cc551ab7dddf933e19.exe" +s +h3⤵
- Sets file to hidden
- Views/modifies file attributes
PID:1112
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp" +s +h2⤵
- Suspicious use of WriteProcessMemory
PID:556 -
C:\Windows\SysWOW64\attrib.exeattrib "C:\Users\Admin\AppData\Local\Temp" +s +h3⤵
- Sets file to hidden
- Views/modifies file attributes
PID:1048
-
-
-
C:\Windows\SysWOW64\notepad.exenotepad2⤵
- Deletes itself
PID:468
-
-
C:\Windows\SysWOW64\System32\SysConf.exe"C:\Windows\system32\System32\SysConf.exe"2⤵
- Windows security bypass
- Disables RegEdit via registry modification
- Executes dropped EXE
- Windows security modification
- Adds Run key to start application
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1408 -
C:\Program Files (x86)\Internet Explorer\iexplore.exe"C:\Program Files (x86)\Internet Explorer\iexplore.exe"3⤵PID:820
-
-
C:\Windows\explorer.exe"C:\Windows\explorer.exe"3⤵PID:992
-
-
C:\Windows\SysWOW64\notepad.exenotepad3⤵PID:364
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
690KB
MD581ed6dcb795201a907f16ce79baa0a56
SHA1eb021f72c8b0cc17c36e8eab5dabc45e7e47aa5e
SHA2568970ab5f181d4d7796dae8adc4326d6da14eda07741086cc551ab7dddf933e19
SHA512b9bd7cf934d7427772162e13753e2961d80117cc3f3fe87b488450f8991412510f138eb60a0438eec7b89e46f15de2c5cbe801b8e9092ae2df503cc87cb3b91c
-
Filesize
690KB
MD581ed6dcb795201a907f16ce79baa0a56
SHA1eb021f72c8b0cc17c36e8eab5dabc45e7e47aa5e
SHA2568970ab5f181d4d7796dae8adc4326d6da14eda07741086cc551ab7dddf933e19
SHA512b9bd7cf934d7427772162e13753e2961d80117cc3f3fe87b488450f8991412510f138eb60a0438eec7b89e46f15de2c5cbe801b8e9092ae2df503cc87cb3b91c
-
Filesize
690KB
MD581ed6dcb795201a907f16ce79baa0a56
SHA1eb021f72c8b0cc17c36e8eab5dabc45e7e47aa5e
SHA2568970ab5f181d4d7796dae8adc4326d6da14eda07741086cc551ab7dddf933e19
SHA512b9bd7cf934d7427772162e13753e2961d80117cc3f3fe87b488450f8991412510f138eb60a0438eec7b89e46f15de2c5cbe801b8e9092ae2df503cc87cb3b91c
-
Filesize
690KB
MD581ed6dcb795201a907f16ce79baa0a56
SHA1eb021f72c8b0cc17c36e8eab5dabc45e7e47aa5e
SHA2568970ab5f181d4d7796dae8adc4326d6da14eda07741086cc551ab7dddf933e19
SHA512b9bd7cf934d7427772162e13753e2961d80117cc3f3fe87b488450f8991412510f138eb60a0438eec7b89e46f15de2c5cbe801b8e9092ae2df503cc87cb3b91c