Analysis
-
max time kernel
150s -
max time network
148s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system -
submitted
28-03-2023 06:44
Behavioral task
behavioral1
Sample
3f0b1837b836c8f882db35bc5b0510b47e6c06a996148371a05b2d2b8b46ee0f.exe
Resource
win7-20230220-en
General
-
Target
3f0b1837b836c8f882db35bc5b0510b47e6c06a996148371a05b2d2b8b46ee0f.exe
-
Size
658KB
-
MD5
3c41b88825ed5288001a0840f638bb15
-
SHA1
f12e5059fa029c6eea893ab2e6745922d0d89570
-
SHA256
3f0b1837b836c8f882db35bc5b0510b47e6c06a996148371a05b2d2b8b46ee0f
-
SHA512
bc4b3a9088e0fa70731573c0ac4a8bb4cff8ea68ef737010bfdc6eb0fadaad2e78dda5ca67be4830137f4c3a174d2fec9989b5a638d71d83b4299ede540f4401
-
SSDEEP
12288:+9HFJ9rJxRX1uVVjoaWSoynxdO1FVBaOiRZTERfIhNkNCCLo9Ek5C/h5:KZ1xuVVjfFoynPaVBUR8f+kN10EBT
Malware Config
Extracted
darkcomet
Guest16
sussysdfffdfff343.duckdns.org:1604
DC_MUTEX-6F4SERN
-
InstallPath
MSDCSC\msdcsc.exe
-
gencode
mKaVRbcLZnA8
-
install
true
-
offline_keylogger
true
-
persistence
true
-
reg_key
Google Handler
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
Processes:
3f0b1837b836c8f882db35bc5b0510b47e6c06a996148371a05b2d2b8b46ee0f.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Users\\Admin\\Documents\\MSDCSC\\msdcsc.exe" 3f0b1837b836c8f882db35bc5b0510b47e6c06a996148371a05b2d2b8b46ee0f.exe -
Sets file to hidden 1 TTPs 2 IoCs
Modifies file attributes to stop it showing in Explorer etc.
Processes:
attrib.exeattrib.exepid process 688 attrib.exe 1792 attrib.exe -
Executes dropped EXE 1 IoCs
Processes:
msdcsc.exepid process 1544 msdcsc.exe -
Loads dropped DLL 2 IoCs
Processes:
3f0b1837b836c8f882db35bc5b0510b47e6c06a996148371a05b2d2b8b46ee0f.exepid process 1972 3f0b1837b836c8f882db35bc5b0510b47e6c06a996148371a05b2d2b8b46ee0f.exe 1972 3f0b1837b836c8f882db35bc5b0510b47e6c06a996148371a05b2d2b8b46ee0f.exe -
Adds Run key to start application 2 TTPs 3 IoCs
Processes:
3f0b1837b836c8f882db35bc5b0510b47e6c06a996148371a05b2d2b8b46ee0f.exemsdcsc.exeiexplore.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Windows\CurrentVersion\Run\Google Handler = "C:\\Users\\Admin\\Documents\\MSDCSC\\msdcsc.exe" 3f0b1837b836c8f882db35bc5b0510b47e6c06a996148371a05b2d2b8b46ee0f.exe Set value (str) \REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Windows\CurrentVersion\Run\Google Handler = "C:\\Users\\Admin\\Documents\\MSDCSC\\msdcsc.exe" msdcsc.exe Set value (str) \REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Windows\CurrentVersion\Run\Google Handler = "C:\\Users\\Admin\\Documents\\MSDCSC\\msdcsc.exe" iexplore.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
msdcsc.exedescription pid process target process PID 1544 set thread context of 1084 1544 msdcsc.exe iexplore.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
iexplore.exepid process 1084 iexplore.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
3f0b1837b836c8f882db35bc5b0510b47e6c06a996148371a05b2d2b8b46ee0f.exemsdcsc.exeiexplore.exedescription pid process Token: SeIncreaseQuotaPrivilege 1972 3f0b1837b836c8f882db35bc5b0510b47e6c06a996148371a05b2d2b8b46ee0f.exe Token: SeSecurityPrivilege 1972 3f0b1837b836c8f882db35bc5b0510b47e6c06a996148371a05b2d2b8b46ee0f.exe Token: SeTakeOwnershipPrivilege 1972 3f0b1837b836c8f882db35bc5b0510b47e6c06a996148371a05b2d2b8b46ee0f.exe Token: SeLoadDriverPrivilege 1972 3f0b1837b836c8f882db35bc5b0510b47e6c06a996148371a05b2d2b8b46ee0f.exe Token: SeSystemProfilePrivilege 1972 3f0b1837b836c8f882db35bc5b0510b47e6c06a996148371a05b2d2b8b46ee0f.exe Token: SeSystemtimePrivilege 1972 3f0b1837b836c8f882db35bc5b0510b47e6c06a996148371a05b2d2b8b46ee0f.exe Token: SeProfSingleProcessPrivilege 1972 3f0b1837b836c8f882db35bc5b0510b47e6c06a996148371a05b2d2b8b46ee0f.exe Token: SeIncBasePriorityPrivilege 1972 3f0b1837b836c8f882db35bc5b0510b47e6c06a996148371a05b2d2b8b46ee0f.exe Token: SeCreatePagefilePrivilege 1972 3f0b1837b836c8f882db35bc5b0510b47e6c06a996148371a05b2d2b8b46ee0f.exe Token: SeBackupPrivilege 1972 3f0b1837b836c8f882db35bc5b0510b47e6c06a996148371a05b2d2b8b46ee0f.exe Token: SeRestorePrivilege 1972 3f0b1837b836c8f882db35bc5b0510b47e6c06a996148371a05b2d2b8b46ee0f.exe Token: SeShutdownPrivilege 1972 3f0b1837b836c8f882db35bc5b0510b47e6c06a996148371a05b2d2b8b46ee0f.exe Token: SeDebugPrivilege 1972 3f0b1837b836c8f882db35bc5b0510b47e6c06a996148371a05b2d2b8b46ee0f.exe Token: SeSystemEnvironmentPrivilege 1972 3f0b1837b836c8f882db35bc5b0510b47e6c06a996148371a05b2d2b8b46ee0f.exe Token: SeChangeNotifyPrivilege 1972 3f0b1837b836c8f882db35bc5b0510b47e6c06a996148371a05b2d2b8b46ee0f.exe Token: SeRemoteShutdownPrivilege 1972 3f0b1837b836c8f882db35bc5b0510b47e6c06a996148371a05b2d2b8b46ee0f.exe Token: SeUndockPrivilege 1972 3f0b1837b836c8f882db35bc5b0510b47e6c06a996148371a05b2d2b8b46ee0f.exe Token: SeManageVolumePrivilege 1972 3f0b1837b836c8f882db35bc5b0510b47e6c06a996148371a05b2d2b8b46ee0f.exe Token: SeImpersonatePrivilege 1972 3f0b1837b836c8f882db35bc5b0510b47e6c06a996148371a05b2d2b8b46ee0f.exe Token: SeCreateGlobalPrivilege 1972 3f0b1837b836c8f882db35bc5b0510b47e6c06a996148371a05b2d2b8b46ee0f.exe Token: 33 1972 3f0b1837b836c8f882db35bc5b0510b47e6c06a996148371a05b2d2b8b46ee0f.exe Token: 34 1972 3f0b1837b836c8f882db35bc5b0510b47e6c06a996148371a05b2d2b8b46ee0f.exe Token: 35 1972 3f0b1837b836c8f882db35bc5b0510b47e6c06a996148371a05b2d2b8b46ee0f.exe Token: SeIncreaseQuotaPrivilege 1544 msdcsc.exe Token: SeSecurityPrivilege 1544 msdcsc.exe Token: SeTakeOwnershipPrivilege 1544 msdcsc.exe Token: SeLoadDriverPrivilege 1544 msdcsc.exe Token: SeSystemProfilePrivilege 1544 msdcsc.exe Token: SeSystemtimePrivilege 1544 msdcsc.exe Token: SeProfSingleProcessPrivilege 1544 msdcsc.exe Token: SeIncBasePriorityPrivilege 1544 msdcsc.exe Token: SeCreatePagefilePrivilege 1544 msdcsc.exe Token: SeBackupPrivilege 1544 msdcsc.exe Token: SeRestorePrivilege 1544 msdcsc.exe Token: SeShutdownPrivilege 1544 msdcsc.exe Token: SeDebugPrivilege 1544 msdcsc.exe Token: SeSystemEnvironmentPrivilege 1544 msdcsc.exe Token: SeChangeNotifyPrivilege 1544 msdcsc.exe Token: SeRemoteShutdownPrivilege 1544 msdcsc.exe Token: SeUndockPrivilege 1544 msdcsc.exe Token: SeManageVolumePrivilege 1544 msdcsc.exe Token: SeImpersonatePrivilege 1544 msdcsc.exe Token: SeCreateGlobalPrivilege 1544 msdcsc.exe Token: 33 1544 msdcsc.exe Token: 34 1544 msdcsc.exe Token: 35 1544 msdcsc.exe Token: SeIncreaseQuotaPrivilege 1084 iexplore.exe Token: SeSecurityPrivilege 1084 iexplore.exe Token: SeTakeOwnershipPrivilege 1084 iexplore.exe Token: SeLoadDriverPrivilege 1084 iexplore.exe Token: SeSystemProfilePrivilege 1084 iexplore.exe Token: SeSystemtimePrivilege 1084 iexplore.exe Token: SeProfSingleProcessPrivilege 1084 iexplore.exe Token: SeIncBasePriorityPrivilege 1084 iexplore.exe Token: SeCreatePagefilePrivilege 1084 iexplore.exe Token: SeBackupPrivilege 1084 iexplore.exe Token: SeRestorePrivilege 1084 iexplore.exe Token: SeShutdownPrivilege 1084 iexplore.exe Token: SeDebugPrivilege 1084 iexplore.exe Token: SeSystemEnvironmentPrivilege 1084 iexplore.exe Token: SeChangeNotifyPrivilege 1084 iexplore.exe Token: SeRemoteShutdownPrivilege 1084 iexplore.exe Token: SeUndockPrivilege 1084 iexplore.exe Token: SeManageVolumePrivilege 1084 iexplore.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
iexplore.exepid process 1084 iexplore.exe -
Suspicious use of WriteProcessMemory 49 IoCs
Processes:
3f0b1837b836c8f882db35bc5b0510b47e6c06a996148371a05b2d2b8b46ee0f.execmd.execmd.exemsdcsc.exeiexplore.exedescription pid process target process PID 1972 wrote to memory of 868 1972 3f0b1837b836c8f882db35bc5b0510b47e6c06a996148371a05b2d2b8b46ee0f.exe cmd.exe PID 1972 wrote to memory of 868 1972 3f0b1837b836c8f882db35bc5b0510b47e6c06a996148371a05b2d2b8b46ee0f.exe cmd.exe PID 1972 wrote to memory of 868 1972 3f0b1837b836c8f882db35bc5b0510b47e6c06a996148371a05b2d2b8b46ee0f.exe cmd.exe PID 1972 wrote to memory of 868 1972 3f0b1837b836c8f882db35bc5b0510b47e6c06a996148371a05b2d2b8b46ee0f.exe cmd.exe PID 1972 wrote to memory of 2020 1972 3f0b1837b836c8f882db35bc5b0510b47e6c06a996148371a05b2d2b8b46ee0f.exe cmd.exe PID 1972 wrote to memory of 2020 1972 3f0b1837b836c8f882db35bc5b0510b47e6c06a996148371a05b2d2b8b46ee0f.exe cmd.exe PID 1972 wrote to memory of 2020 1972 3f0b1837b836c8f882db35bc5b0510b47e6c06a996148371a05b2d2b8b46ee0f.exe cmd.exe PID 1972 wrote to memory of 2020 1972 3f0b1837b836c8f882db35bc5b0510b47e6c06a996148371a05b2d2b8b46ee0f.exe cmd.exe PID 2020 wrote to memory of 1792 2020 cmd.exe attrib.exe PID 2020 wrote to memory of 1792 2020 cmd.exe attrib.exe PID 2020 wrote to memory of 1792 2020 cmd.exe attrib.exe PID 2020 wrote to memory of 1792 2020 cmd.exe attrib.exe PID 868 wrote to memory of 688 868 cmd.exe attrib.exe PID 868 wrote to memory of 688 868 cmd.exe attrib.exe PID 868 wrote to memory of 688 868 cmd.exe attrib.exe PID 868 wrote to memory of 688 868 cmd.exe attrib.exe PID 1972 wrote to memory of 1544 1972 3f0b1837b836c8f882db35bc5b0510b47e6c06a996148371a05b2d2b8b46ee0f.exe msdcsc.exe PID 1972 wrote to memory of 1544 1972 3f0b1837b836c8f882db35bc5b0510b47e6c06a996148371a05b2d2b8b46ee0f.exe msdcsc.exe PID 1972 wrote to memory of 1544 1972 3f0b1837b836c8f882db35bc5b0510b47e6c06a996148371a05b2d2b8b46ee0f.exe msdcsc.exe PID 1972 wrote to memory of 1544 1972 3f0b1837b836c8f882db35bc5b0510b47e6c06a996148371a05b2d2b8b46ee0f.exe msdcsc.exe PID 1544 wrote to memory of 1084 1544 msdcsc.exe iexplore.exe PID 1544 wrote to memory of 1084 1544 msdcsc.exe iexplore.exe PID 1544 wrote to memory of 1084 1544 msdcsc.exe iexplore.exe PID 1544 wrote to memory of 1084 1544 msdcsc.exe iexplore.exe PID 1544 wrote to memory of 1084 1544 msdcsc.exe iexplore.exe PID 1544 wrote to memory of 1084 1544 msdcsc.exe iexplore.exe PID 1084 wrote to memory of 1288 1084 iexplore.exe notepad.exe PID 1084 wrote to memory of 1288 1084 iexplore.exe notepad.exe PID 1084 wrote to memory of 1288 1084 iexplore.exe notepad.exe PID 1084 wrote to memory of 1288 1084 iexplore.exe notepad.exe PID 1084 wrote to memory of 1288 1084 iexplore.exe notepad.exe PID 1084 wrote to memory of 1288 1084 iexplore.exe notepad.exe PID 1084 wrote to memory of 1288 1084 iexplore.exe notepad.exe PID 1084 wrote to memory of 1288 1084 iexplore.exe notepad.exe PID 1084 wrote to memory of 1288 1084 iexplore.exe notepad.exe PID 1084 wrote to memory of 1288 1084 iexplore.exe notepad.exe PID 1084 wrote to memory of 1288 1084 iexplore.exe notepad.exe PID 1084 wrote to memory of 1288 1084 iexplore.exe notepad.exe PID 1084 wrote to memory of 1288 1084 iexplore.exe notepad.exe PID 1084 wrote to memory of 1288 1084 iexplore.exe notepad.exe PID 1084 wrote to memory of 1288 1084 iexplore.exe notepad.exe PID 1084 wrote to memory of 1288 1084 iexplore.exe notepad.exe PID 1084 wrote to memory of 1288 1084 iexplore.exe notepad.exe PID 1084 wrote to memory of 1288 1084 iexplore.exe notepad.exe PID 1084 wrote to memory of 1288 1084 iexplore.exe notepad.exe PID 1084 wrote to memory of 1288 1084 iexplore.exe notepad.exe PID 1084 wrote to memory of 1288 1084 iexplore.exe notepad.exe PID 1084 wrote to memory of 1288 1084 iexplore.exe notepad.exe PID 1084 wrote to memory of 1288 1084 iexplore.exe notepad.exe -
Views/modifies file attributes 1 TTPs 2 IoCs
Processes:
attrib.exeattrib.exepid process 1792 attrib.exe 688 attrib.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\3f0b1837b836c8f882db35bc5b0510b47e6c06a996148371a05b2d2b8b46ee0f.exe"C:\Users\Admin\AppData\Local\Temp\3f0b1837b836c8f882db35bc5b0510b47e6c06a996148371a05b2d2b8b46ee0f.exe"1⤵
- Modifies WinLogon for persistence
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp\3f0b1837b836c8f882db35bc5b0510b47e6c06a996148371a05b2d2b8b46ee0f.exe" +s +h2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Users\Admin\AppData\Local\Temp\3f0b1837b836c8f882db35bc5b0510b47e6c06a996148371a05b2d2b8b46ee0f.exe" +s +h3⤵
- Sets file to hidden
- Views/modifies file attributes
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp" +s +h2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Users\Admin\AppData\Local\Temp" +s +h3⤵
- Sets file to hidden
- Views/modifies file attributes
-
C:\Users\Admin\Documents\MSDCSC\msdcsc.exe"C:\Users\Admin\Documents\MSDCSC\msdcsc.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\iexplore.exe"C:\Program Files (x86)\Internet Explorer\iexplore.exe"3⤵
- Adds Run key to start application
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\notepad.exenotepad4⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\Documents\MSDCSC\msdcsc.exeFilesize
658KB
MD53c41b88825ed5288001a0840f638bb15
SHA1f12e5059fa029c6eea893ab2e6745922d0d89570
SHA2563f0b1837b836c8f882db35bc5b0510b47e6c06a996148371a05b2d2b8b46ee0f
SHA512bc4b3a9088e0fa70731573c0ac4a8bb4cff8ea68ef737010bfdc6eb0fadaad2e78dda5ca67be4830137f4c3a174d2fec9989b5a638d71d83b4299ede540f4401
-
C:\Users\Admin\Documents\MSDCSC\msdcsc.exeFilesize
658KB
MD53c41b88825ed5288001a0840f638bb15
SHA1f12e5059fa029c6eea893ab2e6745922d0d89570
SHA2563f0b1837b836c8f882db35bc5b0510b47e6c06a996148371a05b2d2b8b46ee0f
SHA512bc4b3a9088e0fa70731573c0ac4a8bb4cff8ea68ef737010bfdc6eb0fadaad2e78dda5ca67be4830137f4c3a174d2fec9989b5a638d71d83b4299ede540f4401
-
C:\Users\Admin\Documents\MSDCSC\msdcsc.exeFilesize
658KB
MD53c41b88825ed5288001a0840f638bb15
SHA1f12e5059fa029c6eea893ab2e6745922d0d89570
SHA2563f0b1837b836c8f882db35bc5b0510b47e6c06a996148371a05b2d2b8b46ee0f
SHA512bc4b3a9088e0fa70731573c0ac4a8bb4cff8ea68ef737010bfdc6eb0fadaad2e78dda5ca67be4830137f4c3a174d2fec9989b5a638d71d83b4299ede540f4401
-
\Users\Admin\Documents\MSDCSC\msdcsc.exeFilesize
658KB
MD53c41b88825ed5288001a0840f638bb15
SHA1f12e5059fa029c6eea893ab2e6745922d0d89570
SHA2563f0b1837b836c8f882db35bc5b0510b47e6c06a996148371a05b2d2b8b46ee0f
SHA512bc4b3a9088e0fa70731573c0ac4a8bb4cff8ea68ef737010bfdc6eb0fadaad2e78dda5ca67be4830137f4c3a174d2fec9989b5a638d71d83b4299ede540f4401
-
\Users\Admin\Documents\MSDCSC\msdcsc.exeFilesize
658KB
MD53c41b88825ed5288001a0840f638bb15
SHA1f12e5059fa029c6eea893ab2e6745922d0d89570
SHA2563f0b1837b836c8f882db35bc5b0510b47e6c06a996148371a05b2d2b8b46ee0f
SHA512bc4b3a9088e0fa70731573c0ac4a8bb4cff8ea68ef737010bfdc6eb0fadaad2e78dda5ca67be4830137f4c3a174d2fec9989b5a638d71d83b4299ede540f4401
-
memory/1084-66-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/1288-68-0x00000000000C0000-0x00000000000C1000-memory.dmpFilesize
4KB
-
memory/1288-87-0x00000000003D0000-0x00000000003D1000-memory.dmpFilesize
4KB
-
memory/1544-67-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/1972-56-0x0000000000240000-0x0000000000241000-memory.dmpFilesize
4KB
-
memory/1972-88-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB