Analysis
-
max time kernel
163s -
max time network
181s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
31-12-2023 00:38
Behavioral task
behavioral1
Sample
21fb8f40424a8f2356dc51ce43d1af22.exe
Resource
win7-20231215-en
General
-
Target
21fb8f40424a8f2356dc51ce43d1af22.exe
-
Size
347KB
-
MD5
21fb8f40424a8f2356dc51ce43d1af22
-
SHA1
940c797a0201f182e451ac5e28df4526a0fb6d39
-
SHA256
3d3c0207409076d6c9f7800a4557000aabeec2a6f81462b59f5fc76f1b215839
-
SHA512
9d1126b6487788848cc2b79211bf730d7c655794fd7d33e060aaf067e9bda04d8d9ad9ec1d55070497f618e25f2c61b918998159ccaacbdaf5f2eaa609803b39
-
SSDEEP
6144:8wT5O7pJmNB6dLY6dCnnsyZLHoaIyv6ocU/qxDS2xDWb3cCkdRPlbL:8P+NULZdCn3TbncU2D7Ab3
Malware Config
Extracted
darkcomet
down
epicrypt.no-ip.org:1604
DC_MUTEX-V6F2W9Y
-
InstallPath
MSDCSC\msdcsc.exe
-
gencode
SLDYxgws5n00
-
install
true
-
offline_keylogger
true
-
persistence
false
-
reg_key
MicroUpdate
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
Processes:
21fb8f40424a8f2356dc51ce43d1af22.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe" 21fb8f40424a8f2356dc51ce43d1af22.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
21fb8f40424a8f2356dc51ce43d1af22.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\Control Panel\International\Geo\Nation 21fb8f40424a8f2356dc51ce43d1af22.exe -
Processes:
resource yara_rule behavioral2/memory/1652-0-0x0000000000400000-0x00000000004E7000-memory.dmp upx behavioral2/memory/1652-1-0x0000000000400000-0x00000000004E7000-memory.dmp upx behavioral2/memory/1652-4-0x0000000000400000-0x00000000004E7000-memory.dmp upx behavioral2/memory/1652-7-0x0000000000400000-0x00000000004E7000-memory.dmp upx behavioral2/memory/1652-11-0x0000000000400000-0x00000000004E7000-memory.dmp upx C:\Windows\SysWOW64\MSDCSC\msdcsc.exe upx -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
21fb8f40424a8f2356dc51ce43d1af22.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Windows\\system32\\MSDCSC\\msdcsc.exe" 21fb8f40424a8f2356dc51ce43d1af22.exe -
Drops file in System32 directory 3 IoCs
Processes:
21fb8f40424a8f2356dc51ce43d1af22.exedescription ioc process File created C:\Windows\SysWOW64\MSDCSC\msdcsc.exe 21fb8f40424a8f2356dc51ce43d1af22.exe File opened for modification C:\Windows\SysWOW64\MSDCSC\msdcsc.exe 21fb8f40424a8f2356dc51ce43d1af22.exe File opened for modification C:\Windows\SysWOW64\MSDCSC\ 21fb8f40424a8f2356dc51ce43d1af22.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 1 IoCs
Processes:
21fb8f40424a8f2356dc51ce43d1af22.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ 21fb8f40424a8f2356dc51ce43d1af22.exe -
Suspicious use of AdjustPrivilegeToken 24 IoCs
Processes:
21fb8f40424a8f2356dc51ce43d1af22.exedescription pid process Token: SeIncreaseQuotaPrivilege 1652 21fb8f40424a8f2356dc51ce43d1af22.exe Token: SeSecurityPrivilege 1652 21fb8f40424a8f2356dc51ce43d1af22.exe Token: SeTakeOwnershipPrivilege 1652 21fb8f40424a8f2356dc51ce43d1af22.exe Token: SeLoadDriverPrivilege 1652 21fb8f40424a8f2356dc51ce43d1af22.exe Token: SeSystemProfilePrivilege 1652 21fb8f40424a8f2356dc51ce43d1af22.exe Token: SeSystemtimePrivilege 1652 21fb8f40424a8f2356dc51ce43d1af22.exe Token: SeProfSingleProcessPrivilege 1652 21fb8f40424a8f2356dc51ce43d1af22.exe Token: SeIncBasePriorityPrivilege 1652 21fb8f40424a8f2356dc51ce43d1af22.exe Token: SeCreatePagefilePrivilege 1652 21fb8f40424a8f2356dc51ce43d1af22.exe Token: SeBackupPrivilege 1652 21fb8f40424a8f2356dc51ce43d1af22.exe Token: SeRestorePrivilege 1652 21fb8f40424a8f2356dc51ce43d1af22.exe Token: SeShutdownPrivilege 1652 21fb8f40424a8f2356dc51ce43d1af22.exe Token: SeDebugPrivilege 1652 21fb8f40424a8f2356dc51ce43d1af22.exe Token: SeSystemEnvironmentPrivilege 1652 21fb8f40424a8f2356dc51ce43d1af22.exe Token: SeChangeNotifyPrivilege 1652 21fb8f40424a8f2356dc51ce43d1af22.exe Token: SeRemoteShutdownPrivilege 1652 21fb8f40424a8f2356dc51ce43d1af22.exe Token: SeUndockPrivilege 1652 21fb8f40424a8f2356dc51ce43d1af22.exe Token: SeManageVolumePrivilege 1652 21fb8f40424a8f2356dc51ce43d1af22.exe Token: SeImpersonatePrivilege 1652 21fb8f40424a8f2356dc51ce43d1af22.exe Token: SeCreateGlobalPrivilege 1652 21fb8f40424a8f2356dc51ce43d1af22.exe Token: 33 1652 21fb8f40424a8f2356dc51ce43d1af22.exe Token: 34 1652 21fb8f40424a8f2356dc51ce43d1af22.exe Token: 35 1652 21fb8f40424a8f2356dc51ce43d1af22.exe Token: 36 1652 21fb8f40424a8f2356dc51ce43d1af22.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\21fb8f40424a8f2356dc51ce43d1af22.exe"C:\Users\Admin\AppData\Local\Temp\21fb8f40424a8f2356dc51ce43d1af22.exe"1⤵
- Modifies WinLogon for persistence
- Checks computer location settings
- Adds Run key to start application
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Windows\SysWOW64\MSDCSC\msdcsc.exeFilesize
347KB
MD521fb8f40424a8f2356dc51ce43d1af22
SHA1940c797a0201f182e451ac5e28df4526a0fb6d39
SHA2563d3c0207409076d6c9f7800a4557000aabeec2a6f81462b59f5fc76f1b215839
SHA5129d1126b6487788848cc2b79211bf730d7c655794fd7d33e060aaf067e9bda04d8d9ad9ec1d55070497f618e25f2c61b918998159ccaacbdaf5f2eaa609803b39
-
memory/1652-0-0x0000000000400000-0x00000000004E7000-memory.dmpFilesize
924KB
-
memory/1652-1-0x0000000000400000-0x00000000004E7000-memory.dmpFilesize
924KB
-
memory/1652-3-0x00000000022F0000-0x00000000022F1000-memory.dmpFilesize
4KB
-
memory/1652-4-0x0000000000400000-0x00000000004E7000-memory.dmpFilesize
924KB
-
memory/1652-7-0x0000000000400000-0x00000000004E7000-memory.dmpFilesize
924KB
-
memory/1652-8-0x00000000022F0000-0x00000000022F1000-memory.dmpFilesize
4KB
-
memory/1652-11-0x0000000000400000-0x00000000004E7000-memory.dmpFilesize
924KB