Analysis
-
max time kernel
188s -
max time network
160s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
25-12-2023 23:26
Behavioral task
behavioral1
Sample
432239af3b4ba67d938ffc6bfb22956e.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
432239af3b4ba67d938ffc6bfb22956e.exe
Resource
win10v2004-20231215-en
General
-
Target
432239af3b4ba67d938ffc6bfb22956e.exe
-
Size
658KB
-
MD5
432239af3b4ba67d938ffc6bfb22956e
-
SHA1
a46d496a95e639d8161dd2512809163f55ed9445
-
SHA256
35df31a35807ceb59bbcc4808292565d64b37c60fee9c98fc3406e40ce6889d5
-
SHA512
549967e66367f0a288850dabb5732382e5c01f0542d193d4006215d4f65f819c5492e1c88f143cfb628fe8c2252b458c5fc12da9f3aedff8ebf1fb37986ac0ac
-
SSDEEP
12288:S9HFJ9rJxRX1uVVjoaWSoynxdO1FVBaOiRZTERfIhNkNCCLo9Ek5C/hm:+Z1xuVVjfFoynPaVBUR8f+kN10EBg
Malware Config
Extracted
darkcomet
Guest16_min
xerxesrox.no-ip.biz:83
DCMIN_MUTEX-EHQMHJU
-
InstallPath
DCSCMIN\IMDCSC.exe
-
gencode
PcrJ6QRL7ZlH
-
install
true
-
offline_keylogger
true
-
persistence
false
-
reg_key
DarkComet RAT
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
Processes:
432239af3b4ba67d938ffc6bfb22956e.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Users\\Admin\\AppData\\Local\\Temp\\DCSCMIN\\IMDCSC.exe" 432239af3b4ba67d938ffc6bfb22956e.exe -
Executes dropped EXE 1 IoCs
Processes:
IMDCSC.exepid process 2668 IMDCSC.exe -
Loads dropped DLL 2 IoCs
Processes:
432239af3b4ba67d938ffc6bfb22956e.exepid process 2576 432239af3b4ba67d938ffc6bfb22956e.exe 2576 432239af3b4ba67d938ffc6bfb22956e.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
432239af3b4ba67d938ffc6bfb22956e.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Windows\CurrentVersion\Run\DarkComet RAT = "C:\\Users\\Admin\\AppData\\Local\\Temp\\DCSCMIN\\IMDCSC.exe" 432239af3b4ba67d938ffc6bfb22956e.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of AdjustPrivilegeToken 46 IoCs
Processes:
432239af3b4ba67d938ffc6bfb22956e.exeIMDCSC.exedescription pid process Token: SeIncreaseQuotaPrivilege 2576 432239af3b4ba67d938ffc6bfb22956e.exe Token: SeSecurityPrivilege 2576 432239af3b4ba67d938ffc6bfb22956e.exe Token: SeTakeOwnershipPrivilege 2576 432239af3b4ba67d938ffc6bfb22956e.exe Token: SeLoadDriverPrivilege 2576 432239af3b4ba67d938ffc6bfb22956e.exe Token: SeSystemProfilePrivilege 2576 432239af3b4ba67d938ffc6bfb22956e.exe Token: SeSystemtimePrivilege 2576 432239af3b4ba67d938ffc6bfb22956e.exe Token: SeProfSingleProcessPrivilege 2576 432239af3b4ba67d938ffc6bfb22956e.exe Token: SeIncBasePriorityPrivilege 2576 432239af3b4ba67d938ffc6bfb22956e.exe Token: SeCreatePagefilePrivilege 2576 432239af3b4ba67d938ffc6bfb22956e.exe Token: SeBackupPrivilege 2576 432239af3b4ba67d938ffc6bfb22956e.exe Token: SeRestorePrivilege 2576 432239af3b4ba67d938ffc6bfb22956e.exe Token: SeShutdownPrivilege 2576 432239af3b4ba67d938ffc6bfb22956e.exe Token: SeDebugPrivilege 2576 432239af3b4ba67d938ffc6bfb22956e.exe Token: SeSystemEnvironmentPrivilege 2576 432239af3b4ba67d938ffc6bfb22956e.exe Token: SeChangeNotifyPrivilege 2576 432239af3b4ba67d938ffc6bfb22956e.exe Token: SeRemoteShutdownPrivilege 2576 432239af3b4ba67d938ffc6bfb22956e.exe Token: SeUndockPrivilege 2576 432239af3b4ba67d938ffc6bfb22956e.exe Token: SeManageVolumePrivilege 2576 432239af3b4ba67d938ffc6bfb22956e.exe Token: SeImpersonatePrivilege 2576 432239af3b4ba67d938ffc6bfb22956e.exe Token: SeCreateGlobalPrivilege 2576 432239af3b4ba67d938ffc6bfb22956e.exe Token: 33 2576 432239af3b4ba67d938ffc6bfb22956e.exe Token: 34 2576 432239af3b4ba67d938ffc6bfb22956e.exe Token: 35 2576 432239af3b4ba67d938ffc6bfb22956e.exe Token: SeIncreaseQuotaPrivilege 2668 IMDCSC.exe Token: SeSecurityPrivilege 2668 IMDCSC.exe Token: SeTakeOwnershipPrivilege 2668 IMDCSC.exe Token: SeLoadDriverPrivilege 2668 IMDCSC.exe Token: SeSystemProfilePrivilege 2668 IMDCSC.exe Token: SeSystemtimePrivilege 2668 IMDCSC.exe Token: SeProfSingleProcessPrivilege 2668 IMDCSC.exe Token: SeIncBasePriorityPrivilege 2668 IMDCSC.exe Token: SeCreatePagefilePrivilege 2668 IMDCSC.exe Token: SeBackupPrivilege 2668 IMDCSC.exe Token: SeRestorePrivilege 2668 IMDCSC.exe Token: SeShutdownPrivilege 2668 IMDCSC.exe Token: SeDebugPrivilege 2668 IMDCSC.exe Token: SeSystemEnvironmentPrivilege 2668 IMDCSC.exe Token: SeChangeNotifyPrivilege 2668 IMDCSC.exe Token: SeRemoteShutdownPrivilege 2668 IMDCSC.exe Token: SeUndockPrivilege 2668 IMDCSC.exe Token: SeManageVolumePrivilege 2668 IMDCSC.exe Token: SeImpersonatePrivilege 2668 IMDCSC.exe Token: SeCreateGlobalPrivilege 2668 IMDCSC.exe Token: 33 2668 IMDCSC.exe Token: 34 2668 IMDCSC.exe Token: 35 2668 IMDCSC.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
IMDCSC.exepid process 2668 IMDCSC.exe -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
432239af3b4ba67d938ffc6bfb22956e.exedescription pid process target process PID 2576 wrote to memory of 2668 2576 432239af3b4ba67d938ffc6bfb22956e.exe IMDCSC.exe PID 2576 wrote to memory of 2668 2576 432239af3b4ba67d938ffc6bfb22956e.exe IMDCSC.exe PID 2576 wrote to memory of 2668 2576 432239af3b4ba67d938ffc6bfb22956e.exe IMDCSC.exe PID 2576 wrote to memory of 2668 2576 432239af3b4ba67d938ffc6bfb22956e.exe IMDCSC.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\432239af3b4ba67d938ffc6bfb22956e.exe"C:\Users\Admin\AppData\Local\Temp\432239af3b4ba67d938ffc6bfb22956e.exe"1⤵
- Modifies WinLogon for persistence
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\DCSCMIN\IMDCSC.exe"C:\Users\Admin\AppData\Local\Temp\DCSCMIN\IMDCSC.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
\Users\Admin\AppData\Local\Temp\DCSCMIN\IMDCSC.exeFilesize
658KB
MD5432239af3b4ba67d938ffc6bfb22956e
SHA1a46d496a95e639d8161dd2512809163f55ed9445
SHA25635df31a35807ceb59bbcc4808292565d64b37c60fee9c98fc3406e40ce6889d5
SHA512549967e66367f0a288850dabb5732382e5c01f0542d193d4006215d4f65f819c5492e1c88f143cfb628fe8c2252b458c5fc12da9f3aedff8ebf1fb37986ac0ac
-
memory/2576-13-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/2576-1-0x0000000000240000-0x0000000000241000-memory.dmpFilesize
4KB
-
memory/2576-0-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/2668-17-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/2668-20-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/2668-15-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/2668-16-0x0000000000250000-0x0000000000251000-memory.dmpFilesize
4KB
-
memory/2668-11-0x0000000000250000-0x0000000000251000-memory.dmpFilesize
4KB
-
memory/2668-18-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/2668-19-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/2668-14-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/2668-21-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/2668-22-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/2668-23-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/2668-24-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/2668-25-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/2668-26-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/2668-27-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB