Analysis
-
max time kernel
149s -
max time network
153s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system -
submitted
23-02-2023 15:24
Behavioral task
behavioral1
Sample
tmp.exe
Resource
win7-20230220-en
windows7-x64
4 signatures
150 seconds
General
-
Target
tmp.exe
-
Size
658KB
-
MD5
5c0227204548c5a768c2e11da02ff774
-
SHA1
b6e0a2fe0dc36d55b89253cf0590434647fd96b4
-
SHA256
3e10c254d6536cc63d286b53abfebbf53785e6509ae9fb569920747d379936f6
-
SHA512
3fbc32d85363147d695d0e160d599544255ef63a27abbfa9d5636b936d531b69b493410d3a1f785b5870670a75094c08411707b48c264b21942601f7959a3f93
-
SSDEEP
12288:a9HFJ9rJxRX1uVVjoaWSoynxdO1FVBaOiRZTERfIhNkNCCLo9Ek5C/ho:WZ1xuVVjfFoynPaVBUR8f+kN10EBO
Malware Config
Extracted
Family
darkcomet
Botnet
Guest16
C2
80.85.154.180:1456
Mutex
DC_MUTEX-NFTBT53
Attributes
-
gencode
07w1VPGRR8fc
-
install
false
-
offline_keylogger
true
-
persistence
false
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of AdjustPrivilegeToken 23 IoCs
Processes:
tmp.exedescription pid process Token: SeIncreaseQuotaPrivilege 2012 tmp.exe Token: SeSecurityPrivilege 2012 tmp.exe Token: SeTakeOwnershipPrivilege 2012 tmp.exe Token: SeLoadDriverPrivilege 2012 tmp.exe Token: SeSystemProfilePrivilege 2012 tmp.exe Token: SeSystemtimePrivilege 2012 tmp.exe Token: SeProfSingleProcessPrivilege 2012 tmp.exe Token: SeIncBasePriorityPrivilege 2012 tmp.exe Token: SeCreatePagefilePrivilege 2012 tmp.exe Token: SeBackupPrivilege 2012 tmp.exe Token: SeRestorePrivilege 2012 tmp.exe Token: SeShutdownPrivilege 2012 tmp.exe Token: SeDebugPrivilege 2012 tmp.exe Token: SeSystemEnvironmentPrivilege 2012 tmp.exe Token: SeChangeNotifyPrivilege 2012 tmp.exe Token: SeRemoteShutdownPrivilege 2012 tmp.exe Token: SeUndockPrivilege 2012 tmp.exe Token: SeManageVolumePrivilege 2012 tmp.exe Token: SeImpersonatePrivilege 2012 tmp.exe Token: SeCreateGlobalPrivilege 2012 tmp.exe Token: 33 2012 tmp.exe Token: 34 2012 tmp.exe Token: 35 2012 tmp.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
tmp.exepid process 2012 tmp.exe
Processes
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2012-54-0x00000000003C0000-0x00000000003C1000-memory.dmpFilesize
4KB
-
memory/2012-55-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/2012-58-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/2012-62-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/2012-64-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/2012-68-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB