Analysis
-
max time kernel
150s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
31-12-2023 05:33
Static task
static1
Behavioral task
behavioral1
Sample
2a27e1bf3054ed3419dce0040b5e5671.exe
Resource
win7-20231215-en
General
-
Target
2a27e1bf3054ed3419dce0040b5e5671.exe
-
Size
235KB
-
MD5
2a27e1bf3054ed3419dce0040b5e5671
-
SHA1
10af5ff9c7b622f835236640498e32bbdb3d7c84
-
SHA256
e971bba2a884dbbbd5e9d4859522232170b4d4678c84214293d772aa07dacf59
-
SHA512
02cc1860b90687618eb8686438d37d5a9955ed335188ea553cc36e5709ed6223b83dad5408b409560bd501395b41da9f3d6ffcf42fa59317601fae40174f5b86
-
SSDEEP
6144:imDUj24gqU85IzrFA9NfmDuLpNr5NhWudrWDhSG:iqUj2LkizrzDujVNhWucD4G
Malware Config
Extracted
darkcomet
BOT
dctexh.zapto.org:21
DC_MUTEX-7WCDBD6
-
gencode
4yFpatnwhkXC
-
install
false
-
offline_keylogger
true
-
persistence
false
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of AdjustPrivilegeToken 24 IoCs
Processes:
2a27e1bf3054ed3419dce0040b5e5671.exedescription pid process Token: SeIncreaseQuotaPrivilege 4036 2a27e1bf3054ed3419dce0040b5e5671.exe Token: SeSecurityPrivilege 4036 2a27e1bf3054ed3419dce0040b5e5671.exe Token: SeTakeOwnershipPrivilege 4036 2a27e1bf3054ed3419dce0040b5e5671.exe Token: SeLoadDriverPrivilege 4036 2a27e1bf3054ed3419dce0040b5e5671.exe Token: SeSystemProfilePrivilege 4036 2a27e1bf3054ed3419dce0040b5e5671.exe Token: SeSystemtimePrivilege 4036 2a27e1bf3054ed3419dce0040b5e5671.exe Token: SeProfSingleProcessPrivilege 4036 2a27e1bf3054ed3419dce0040b5e5671.exe Token: SeIncBasePriorityPrivilege 4036 2a27e1bf3054ed3419dce0040b5e5671.exe Token: SeCreatePagefilePrivilege 4036 2a27e1bf3054ed3419dce0040b5e5671.exe Token: SeBackupPrivilege 4036 2a27e1bf3054ed3419dce0040b5e5671.exe Token: SeRestorePrivilege 4036 2a27e1bf3054ed3419dce0040b5e5671.exe Token: SeShutdownPrivilege 4036 2a27e1bf3054ed3419dce0040b5e5671.exe Token: SeDebugPrivilege 4036 2a27e1bf3054ed3419dce0040b5e5671.exe Token: SeSystemEnvironmentPrivilege 4036 2a27e1bf3054ed3419dce0040b5e5671.exe Token: SeChangeNotifyPrivilege 4036 2a27e1bf3054ed3419dce0040b5e5671.exe Token: SeRemoteShutdownPrivilege 4036 2a27e1bf3054ed3419dce0040b5e5671.exe Token: SeUndockPrivilege 4036 2a27e1bf3054ed3419dce0040b5e5671.exe Token: SeManageVolumePrivilege 4036 2a27e1bf3054ed3419dce0040b5e5671.exe Token: SeImpersonatePrivilege 4036 2a27e1bf3054ed3419dce0040b5e5671.exe Token: SeCreateGlobalPrivilege 4036 2a27e1bf3054ed3419dce0040b5e5671.exe Token: 33 4036 2a27e1bf3054ed3419dce0040b5e5671.exe Token: 34 4036 2a27e1bf3054ed3419dce0040b5e5671.exe Token: 35 4036 2a27e1bf3054ed3419dce0040b5e5671.exe Token: 36 4036 2a27e1bf3054ed3419dce0040b5e5671.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
2a27e1bf3054ed3419dce0040b5e5671.exepid process 4036 2a27e1bf3054ed3419dce0040b5e5671.exe
Processes
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/4036-0-0x0000000000400000-0x00000000004B8000-memory.dmpFilesize
736KB
-
memory/4036-1-0x00000000023E0000-0x00000000023E1000-memory.dmpFilesize
4KB
-
memory/4036-2-0x0000000000400000-0x00000000004B8000-memory.dmpFilesize
736KB
-
memory/4036-3-0x0000000000400000-0x00000000004B8000-memory.dmpFilesize
736KB
-
memory/4036-4-0x0000000000400000-0x00000000004B8000-memory.dmpFilesize
736KB
-
memory/4036-5-0x0000000000400000-0x00000000004B8000-memory.dmpFilesize
736KB
-
memory/4036-6-0x0000000000400000-0x00000000004B8000-memory.dmpFilesize
736KB
-
memory/4036-7-0x0000000000400000-0x00000000004B8000-memory.dmpFilesize
736KB
-
memory/4036-8-0x0000000000400000-0x00000000004B8000-memory.dmpFilesize
736KB
-
memory/4036-9-0x0000000000400000-0x00000000004B8000-memory.dmpFilesize
736KB
-
memory/4036-10-0x0000000000400000-0x00000000004B8000-memory.dmpFilesize
736KB
-
memory/4036-11-0x0000000000400000-0x00000000004B8000-memory.dmpFilesize
736KB
-
memory/4036-12-0x0000000000400000-0x00000000004B8000-memory.dmpFilesize
736KB
-
memory/4036-13-0x0000000000400000-0x00000000004B8000-memory.dmpFilesize
736KB
-
memory/4036-14-0x0000000000400000-0x00000000004B8000-memory.dmpFilesize
736KB
-
memory/4036-15-0x0000000000400000-0x00000000004B8000-memory.dmpFilesize
736KB
-
memory/4036-16-0x0000000000400000-0x00000000004B8000-memory.dmpFilesize
736KB