Analysis
-
max time kernel
144s -
max time network
146s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
23-02-2023 15:24
Behavioral task
behavioral1
Sample
tmp.exe
Resource
win7-20230220-en
windows7-x64
4 signatures
150 seconds
General
-
Target
tmp.exe
-
Size
658KB
-
MD5
5c0227204548c5a768c2e11da02ff774
-
SHA1
b6e0a2fe0dc36d55b89253cf0590434647fd96b4
-
SHA256
3e10c254d6536cc63d286b53abfebbf53785e6509ae9fb569920747d379936f6
-
SHA512
3fbc32d85363147d695d0e160d599544255ef63a27abbfa9d5636b936d531b69b493410d3a1f785b5870670a75094c08411707b48c264b21942601f7959a3f93
-
SSDEEP
12288:a9HFJ9rJxRX1uVVjoaWSoynxdO1FVBaOiRZTERfIhNkNCCLo9Ek5C/ho:WZ1xuVVjfFoynPaVBUR8f+kN10EBO
Malware Config
Extracted
Family
darkcomet
Botnet
Guest16
C2
80.85.154.180:1456
Mutex
DC_MUTEX-NFTBT53
Attributes
-
gencode
07w1VPGRR8fc
-
install
false
-
offline_keylogger
true
-
persistence
false
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of AdjustPrivilegeToken 24 IoCs
Processes:
tmp.exedescription pid process Token: SeIncreaseQuotaPrivilege 1268 tmp.exe Token: SeSecurityPrivilege 1268 tmp.exe Token: SeTakeOwnershipPrivilege 1268 tmp.exe Token: SeLoadDriverPrivilege 1268 tmp.exe Token: SeSystemProfilePrivilege 1268 tmp.exe Token: SeSystemtimePrivilege 1268 tmp.exe Token: SeProfSingleProcessPrivilege 1268 tmp.exe Token: SeIncBasePriorityPrivilege 1268 tmp.exe Token: SeCreatePagefilePrivilege 1268 tmp.exe Token: SeBackupPrivilege 1268 tmp.exe Token: SeRestorePrivilege 1268 tmp.exe Token: SeShutdownPrivilege 1268 tmp.exe Token: SeDebugPrivilege 1268 tmp.exe Token: SeSystemEnvironmentPrivilege 1268 tmp.exe Token: SeChangeNotifyPrivilege 1268 tmp.exe Token: SeRemoteShutdownPrivilege 1268 tmp.exe Token: SeUndockPrivilege 1268 tmp.exe Token: SeManageVolumePrivilege 1268 tmp.exe Token: SeImpersonatePrivilege 1268 tmp.exe Token: SeCreateGlobalPrivilege 1268 tmp.exe Token: 33 1268 tmp.exe Token: 34 1268 tmp.exe Token: 35 1268 tmp.exe Token: 36 1268 tmp.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
tmp.exepid process 1268 tmp.exe