Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
07-02-2023 13:31
Static task
static1
Behavioral task
behavioral1
Sample
448a19d4eaa753aca293afde7a8acc8024f1dbbb51649f5e85589bb72749c6d7.exe
Resource
win7-20220812-en
General
-
Target
448a19d4eaa753aca293afde7a8acc8024f1dbbb51649f5e85589bb72749c6d7.exe
-
Size
600KB
-
MD5
5f32b0f8f0d6d524969702481267cb16
-
SHA1
61619717f178232d276dd5cdd86290aac5ff3cdf
-
SHA256
448a19d4eaa753aca293afde7a8acc8024f1dbbb51649f5e85589bb72749c6d7
-
SHA512
139ac17118fc7bdf32fa0d41f410faecf113d070db70f5b286551374490ce3ba09b278a05317c7df210eece4eacd6ca6d892ff66c924d0bcecd02d084c8e34d5
-
SSDEEP
12288:W2Q+/YvU2uVApVQVraqhxJJB8Ly4bBBqoje8ze6k:WuzPYV9l
Malware Config
Extracted
darkcomet
IYKE LOGS
127.0.0.1:1604
DC_MUTEX-U2T3MAJ
-
gencode
vb23itbmycw8
-
install
false
-
offline_keylogger
true
-
password
raz@1234567890
-
persistence
false
Signatures
-
Processes:
resource yara_rule behavioral2/memory/2164-137-0x0000000000400000-0x00000000004BA000-memory.dmp upx behavioral2/memory/2164-138-0x0000000000400000-0x00000000004BA000-memory.dmp upx behavioral2/memory/2164-139-0x0000000000400000-0x00000000004BA000-memory.dmp upx behavioral2/memory/2164-140-0x0000000000400000-0x00000000004BA000-memory.dmp upx behavioral2/memory/2164-141-0x0000000000400000-0x00000000004BA000-memory.dmp upx behavioral2/memory/2164-142-0x0000000000400000-0x00000000004BA000-memory.dmp upx -
Suspicious use of SetThreadContext 1 IoCs
Processes:
448a19d4eaa753aca293afde7a8acc8024f1dbbb51649f5e85589bb72749c6d7.exedescription pid process target process PID 1980 set thread context of 2164 1980 448a19d4eaa753aca293afde7a8acc8024f1dbbb51649f5e85589bb72749c6d7.exe AppLaunch.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
448a19d4eaa753aca293afde7a8acc8024f1dbbb51649f5e85589bb72749c6d7.exepid process 1980 448a19d4eaa753aca293afde7a8acc8024f1dbbb51649f5e85589bb72749c6d7.exe 1980 448a19d4eaa753aca293afde7a8acc8024f1dbbb51649f5e85589bb72749c6d7.exe -
Suspicious use of AdjustPrivilegeToken 25 IoCs
Processes:
448a19d4eaa753aca293afde7a8acc8024f1dbbb51649f5e85589bb72749c6d7.exeAppLaunch.exedescription pid process Token: SeDebugPrivilege 1980 448a19d4eaa753aca293afde7a8acc8024f1dbbb51649f5e85589bb72749c6d7.exe Token: SeIncreaseQuotaPrivilege 2164 AppLaunch.exe Token: SeSecurityPrivilege 2164 AppLaunch.exe Token: SeTakeOwnershipPrivilege 2164 AppLaunch.exe Token: SeLoadDriverPrivilege 2164 AppLaunch.exe Token: SeSystemProfilePrivilege 2164 AppLaunch.exe Token: SeSystemtimePrivilege 2164 AppLaunch.exe Token: SeProfSingleProcessPrivilege 2164 AppLaunch.exe Token: SeIncBasePriorityPrivilege 2164 AppLaunch.exe Token: SeCreatePagefilePrivilege 2164 AppLaunch.exe Token: SeBackupPrivilege 2164 AppLaunch.exe Token: SeRestorePrivilege 2164 AppLaunch.exe Token: SeShutdownPrivilege 2164 AppLaunch.exe Token: SeDebugPrivilege 2164 AppLaunch.exe Token: SeSystemEnvironmentPrivilege 2164 AppLaunch.exe Token: SeChangeNotifyPrivilege 2164 AppLaunch.exe Token: SeRemoteShutdownPrivilege 2164 AppLaunch.exe Token: SeUndockPrivilege 2164 AppLaunch.exe Token: SeManageVolumePrivilege 2164 AppLaunch.exe Token: SeImpersonatePrivilege 2164 AppLaunch.exe Token: SeCreateGlobalPrivilege 2164 AppLaunch.exe Token: 33 2164 AppLaunch.exe Token: 34 2164 AppLaunch.exe Token: 35 2164 AppLaunch.exe Token: 36 2164 AppLaunch.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
AppLaunch.exepid process 2164 AppLaunch.exe -
Suspicious use of WriteProcessMemory 13 IoCs
Processes:
448a19d4eaa753aca293afde7a8acc8024f1dbbb51649f5e85589bb72749c6d7.exedescription pid process target process PID 1980 wrote to memory of 532 1980 448a19d4eaa753aca293afde7a8acc8024f1dbbb51649f5e85589bb72749c6d7.exe CMD.exe PID 1980 wrote to memory of 532 1980 448a19d4eaa753aca293afde7a8acc8024f1dbbb51649f5e85589bb72749c6d7.exe CMD.exe PID 1980 wrote to memory of 532 1980 448a19d4eaa753aca293afde7a8acc8024f1dbbb51649f5e85589bb72749c6d7.exe CMD.exe PID 1980 wrote to memory of 1948 1980 448a19d4eaa753aca293afde7a8acc8024f1dbbb51649f5e85589bb72749c6d7.exe CMD.exe PID 1980 wrote to memory of 1948 1980 448a19d4eaa753aca293afde7a8acc8024f1dbbb51649f5e85589bb72749c6d7.exe CMD.exe PID 1980 wrote to memory of 1948 1980 448a19d4eaa753aca293afde7a8acc8024f1dbbb51649f5e85589bb72749c6d7.exe CMD.exe PID 1980 wrote to memory of 2164 1980 448a19d4eaa753aca293afde7a8acc8024f1dbbb51649f5e85589bb72749c6d7.exe AppLaunch.exe PID 1980 wrote to memory of 2164 1980 448a19d4eaa753aca293afde7a8acc8024f1dbbb51649f5e85589bb72749c6d7.exe AppLaunch.exe PID 1980 wrote to memory of 2164 1980 448a19d4eaa753aca293afde7a8acc8024f1dbbb51649f5e85589bb72749c6d7.exe AppLaunch.exe PID 1980 wrote to memory of 2164 1980 448a19d4eaa753aca293afde7a8acc8024f1dbbb51649f5e85589bb72749c6d7.exe AppLaunch.exe PID 1980 wrote to memory of 2164 1980 448a19d4eaa753aca293afde7a8acc8024f1dbbb51649f5e85589bb72749c6d7.exe AppLaunch.exe PID 1980 wrote to memory of 2164 1980 448a19d4eaa753aca293afde7a8acc8024f1dbbb51649f5e85589bb72749c6d7.exe AppLaunch.exe PID 1980 wrote to memory of 2164 1980 448a19d4eaa753aca293afde7a8acc8024f1dbbb51649f5e85589bb72749c6d7.exe AppLaunch.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\448a19d4eaa753aca293afde7a8acc8024f1dbbb51649f5e85589bb72749c6d7.exe"C:\Users\Admin\AppData\Local\Temp\448a19d4eaa753aca293afde7a8acc8024f1dbbb51649f5e85589bb72749c6d7.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\CMD.exe"CMD"2⤵
-
C:\Windows\SysWOW64\CMD.exe"CMD"2⤵
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\\AppLaunch.exe"2⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/532-134-0x0000000000000000-mapping.dmp
-
memory/1948-135-0x0000000000000000-mapping.dmp
-
memory/1980-132-0x00000000751B0000-0x0000000075761000-memory.dmpFilesize
5.7MB
-
memory/1980-133-0x00000000751B0000-0x0000000075761000-memory.dmpFilesize
5.7MB
-
memory/2164-136-0x0000000000000000-mapping.dmp
-
memory/2164-137-0x0000000000400000-0x00000000004BA000-memory.dmpFilesize
744KB
-
memory/2164-138-0x0000000000400000-0x00000000004BA000-memory.dmpFilesize
744KB
-
memory/2164-139-0x0000000000400000-0x00000000004BA000-memory.dmpFilesize
744KB
-
memory/2164-140-0x0000000000400000-0x00000000004BA000-memory.dmpFilesize
744KB
-
memory/2164-141-0x0000000000400000-0x00000000004BA000-memory.dmpFilesize
744KB
-
memory/2164-142-0x0000000000400000-0x00000000004BA000-memory.dmpFilesize
744KB