Analysis
- max time kernel
198s - max time network
212s - platform
windows10-2004_x64 - resource
win10v2004-20231215-en - resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system - submitted
07/01/2024, 19:32
Behavioral task
behavioral1
Sample
a1cbb38a007ac7d907a657370e4d81d3.exe
Resource
win7-20231215-en
windows7-x64
22 signatures
150 seconds
General
- Target a1cbb38a007ac7d907a657370e4d81d3.exe
- Size 283KB
- Sample240107-x9dhbadeb5
- SHA256 77f4ac865a0c893d1667f97795899264be2b7f16e00ef4134b01873d29438903
- MD5 a1cbb38a007ac7d907a657370e4d81d3
- SHA1 743fe5c1b7056e358a6c84db5ad1b214e002fb81
- SHA512 9fcd8f989656ce3d6d11efa31821e32f42fda2da39adfc26f13c3d811444d73f5ea82edad8c43d6f3b2944a6d0f88da2672db85896855f01f5ab12988d9a44cf
- SSDEEP 6144:ZcNYS996KFifeVjBpeExgVTFSXFoMc5RhCaL37P:ZcW7KEZlPzCy37P
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Extracted
Family
-
darkcomet
Botnet
-
Guest16
C2
-
ultrakrautlp.zapto.org:1604
Mutex
-
DC_MUTEX-45WQE80
Attributes
-
InstallPath
MSDCSC\msdcsc.exe
-
gencode
woj8h9nkwYmm
-
install
true
-
offline_keylogger
true
-
persistence
true
-
reg_key
MicroUpdate
Signatures
- Modifies WinLogon for persistence 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Users\\Admin\\Documents\\MSDCSC\\msdcsc.exe" a1cbb38a007ac7d907a657370e4d81d3.exe - Modifies firewall policy service 2 TTPs 3 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile msdcsc.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" msdcsc.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "0" msdcsc.exe - Modifies security service 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wscsvc\Start = "4" msdcsc.exe -
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" msdcsc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" msdcsc.exe - Disables RegEdit via registry modification 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" msdcsc.exe - Disables Task Manager via registry modification
- Sets file to hidden 1 TTPs 2 IoCs
Modifies file attributes to stop it showing in Explorer etc.
pid Process 2084 attrib.exe 4352 attrib.exe - Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\Control Panel\International\Geo\Nation a1cbb38a007ac7d907a657370e4d81d3.exe - Deletes itself 1 IoCs
pid Process 3176 notepad.exe - Executes dropped EXE 1 IoCs
pid Process 1540 msdcsc.exe -
resource yara_rule behavioral2/memory/3992-0-0x0000000000400000-0x00000000004C7000-memory.dmp upx behavioral2/memory/3992-3-0x0000000000400000-0x00000000004C7000-memory.dmp upx behavioral2/memory/3992-5-0x0000000000400000-0x00000000004C7000-memory.dmp upx behavioral2/files/0x0007000000023203-9.dat upx behavioral2/memory/1540-65-0x0000000000400000-0x00000000004C7000-memory.dmp upx behavioral2/memory/3992-68-0x0000000000400000-0x00000000004C7000-memory.dmp upx behavioral2/memory/1540-70-0x0000000000400000-0x00000000004C7000-memory.dmp upx behavioral2/memory/1540-71-0x0000000000400000-0x00000000004C7000-memory.dmp upx behavioral2/memory/1540-72-0x0000000000400000-0x00000000004C7000-memory.dmp upx behavioral2/memory/1540-73-0x0000000000400000-0x00000000004C7000-memory.dmp upx behavioral2/memory/1540-74-0x0000000000400000-0x00000000004C7000-memory.dmp upx behavioral2/memory/1540-75-0x0000000000400000-0x00000000004C7000-memory.dmp upx behavioral2/memory/1540-76-0x0000000000400000-0x00000000004C7000-memory.dmp upx behavioral2/memory/1540-77-0x0000000000400000-0x00000000004C7000-memory.dmp upx behavioral2/memory/1540-78-0x0000000000400000-0x00000000004C7000-memory.dmp upx behavioral2/memory/1540-79-0x0000000000400000-0x00000000004C7000-memory.dmp upx behavioral2/memory/1540-80-0x0000000000400000-0x00000000004C7000-memory.dmp upx behavioral2/memory/1540-81-0x0000000000400000-0x00000000004C7000-memory.dmp upx -
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" msdcsc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" msdcsc.exe - Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Users\\Admin\\Documents\\MSDCSC\\msdcsc.exe" a1cbb38a007ac7d907a657370e4d81d3.exe Set value (str) \REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Users\\Admin\\Documents\\MSDCSC\\msdcsc.exe" msdcsc.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ a1cbb38a007ac7d907a657370e4d81d3.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1540 msdcsc.exe - Suspicious use of AdjustPrivilegeToken 48 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 3992 a1cbb38a007ac7d907a657370e4d81d3.exe Token: SeSecurityPrivilege 3992 a1cbb38a007ac7d907a657370e4d81d3.exe Token: SeTakeOwnershipPrivilege 3992 a1cbb38a007ac7d907a657370e4d81d3.exe Token: SeLoadDriverPrivilege 3992 a1cbb38a007ac7d907a657370e4d81d3.exe Token: SeSystemProfilePrivilege 3992 a1cbb38a007ac7d907a657370e4d81d3.exe Token: SeSystemtimePrivilege 3992 a1cbb38a007ac7d907a657370e4d81d3.exe Token: SeProfSingleProcessPrivilege 3992 a1cbb38a007ac7d907a657370e4d81d3.exe Token: SeIncBasePriorityPrivilege 3992 a1cbb38a007ac7d907a657370e4d81d3.exe Token: SeCreatePagefilePrivilege 3992 a1cbb38a007ac7d907a657370e4d81d3.exe Token: SeBackupPrivilege 3992 a1cbb38a007ac7d907a657370e4d81d3.exe Token: SeRestorePrivilege 3992 a1cbb38a007ac7d907a657370e4d81d3.exe Token: SeShutdownPrivilege 3992 a1cbb38a007ac7d907a657370e4d81d3.exe Token: SeDebugPrivilege 3992 a1cbb38a007ac7d907a657370e4d81d3.exe Token: SeSystemEnvironmentPrivilege 3992 a1cbb38a007ac7d907a657370e4d81d3.exe Token: SeChangeNotifyPrivilege 3992 a1cbb38a007ac7d907a657370e4d81d3.exe Token: SeRemoteShutdownPrivilege 3992 a1cbb38a007ac7d907a657370e4d81d3.exe Token: SeUndockPrivilege 3992 a1cbb38a007ac7d907a657370e4d81d3.exe Token: SeManageVolumePrivilege 3992 a1cbb38a007ac7d907a657370e4d81d3.exe Token: SeImpersonatePrivilege 3992 a1cbb38a007ac7d907a657370e4d81d3.exe Token: SeCreateGlobalPrivilege 3992 a1cbb38a007ac7d907a657370e4d81d3.exe Token: 33 3992 a1cbb38a007ac7d907a657370e4d81d3.exe Token: 34 3992 a1cbb38a007ac7d907a657370e4d81d3.exe Token: 35 3992 a1cbb38a007ac7d907a657370e4d81d3.exe Token: 36 3992 a1cbb38a007ac7d907a657370e4d81d3.exe Token: SeIncreaseQuotaPrivilege 1540 msdcsc.exe Token: SeSecurityPrivilege 1540 msdcsc.exe Token: SeTakeOwnershipPrivilege 1540 msdcsc.exe Token: SeLoadDriverPrivilege 1540 msdcsc.exe Token: SeSystemProfilePrivilege 1540 msdcsc.exe Token: SeSystemtimePrivilege 1540 msdcsc.exe Token: SeProfSingleProcessPrivilege 1540 msdcsc.exe Token: SeIncBasePriorityPrivilege 1540 msdcsc.exe Token: SeCreatePagefilePrivilege 1540 msdcsc.exe Token: SeBackupPrivilege 1540 msdcsc.exe Token: SeRestorePrivilege 1540 msdcsc.exe Token: SeShutdownPrivilege 1540 msdcsc.exe Token: SeDebugPrivilege 1540 msdcsc.exe Token: SeSystemEnvironmentPrivilege 1540 msdcsc.exe Token: SeChangeNotifyPrivilege 1540 msdcsc.exe Token: SeRemoteShutdownPrivilege 1540 msdcsc.exe Token: SeUndockPrivilege 1540 msdcsc.exe Token: SeManageVolumePrivilege 1540 msdcsc.exe Token: SeImpersonatePrivilege 1540 msdcsc.exe Token: SeCreateGlobalPrivilege 1540 msdcsc.exe Token: 33 1540 msdcsc.exe Token: 34 1540 msdcsc.exe Token: 35 1540 msdcsc.exe Token: 36 1540 msdcsc.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 1540 msdcsc.exe - Suspicious use of WriteProcessMemory 59 IoCs
description pid Process procid_target PID 3992 wrote to memory of 1692 3992 a1cbb38a007ac7d907a657370e4d81d3.exe 92 PID 3992 wrote to memory of 1692 3992 a1cbb38a007ac7d907a657370e4d81d3.exe 92 PID 3992 wrote to memory of 1692 3992 a1cbb38a007ac7d907a657370e4d81d3.exe 92 PID 3992 wrote to memory of 3480 3992 a1cbb38a007ac7d907a657370e4d81d3.exe 91 PID 3992 wrote to memory of 3480 3992 a1cbb38a007ac7d907a657370e4d81d3.exe 91 PID 3992 wrote to memory of 3480 3992 a1cbb38a007ac7d907a657370e4d81d3.exe 91 PID 3992 wrote to memory of 3176 3992 a1cbb38a007ac7d907a657370e4d81d3.exe 95 PID 3992 wrote to memory of 3176 3992 a1cbb38a007ac7d907a657370e4d81d3.exe 95 PID 3992 wrote to memory of 3176 3992 a1cbb38a007ac7d907a657370e4d81d3.exe 95 PID 3992 wrote to memory of 3176 3992 a1cbb38a007ac7d907a657370e4d81d3.exe 95 PID 3992 wrote to memory of 3176 3992 a1cbb38a007ac7d907a657370e4d81d3.exe 95 PID 3992 wrote to memory of 3176 3992 a1cbb38a007ac7d907a657370e4d81d3.exe 95 PID 3992 wrote to memory of 3176 3992 a1cbb38a007ac7d907a657370e4d81d3.exe 95 PID 3992 wrote to memory of 3176 3992 a1cbb38a007ac7d907a657370e4d81d3.exe 95 PID 3992 wrote to memory of 3176 3992 a1cbb38a007ac7d907a657370e4d81d3.exe 95 PID 3992 wrote to memory of 3176 3992 a1cbb38a007ac7d907a657370e4d81d3.exe 95 PID 3992 wrote to memory of 3176 3992 a1cbb38a007ac7d907a657370e4d81d3.exe 95 PID 3992 wrote to memory of 3176 3992 a1cbb38a007ac7d907a657370e4d81d3.exe 95 PID 3992 wrote to memory of 3176 3992 a1cbb38a007ac7d907a657370e4d81d3.exe 95 PID 3992 wrote to memory of 3176 3992 a1cbb38a007ac7d907a657370e4d81d3.exe 95 PID 3992 wrote to memory of 3176 3992 a1cbb38a007ac7d907a657370e4d81d3.exe 95 PID 3992 wrote to memory of 3176 3992 a1cbb38a007ac7d907a657370e4d81d3.exe 95 PID 3992 wrote to memory of 3176 3992 a1cbb38a007ac7d907a657370e4d81d3.exe 95 PID 3480 wrote to memory of 2084 3480 cmd.exe 96 PID 3480 wrote to memory of 2084 3480 cmd.exe 96 PID 3480 wrote to memory of 2084 3480 cmd.exe 96 PID 1692 wrote to memory of 4352 1692 cmd.exe 97 PID 1692 wrote to memory of 4352 1692 cmd.exe 97 PID 1692 wrote to memory of 4352 1692 cmd.exe 97 PID 3992 wrote to memory of 1540 3992 a1cbb38a007ac7d907a657370e4d81d3.exe 98 PID 3992 wrote to memory of 1540 3992 a1cbb38a007ac7d907a657370e4d81d3.exe 98 PID 3992 wrote to memory of 1540 3992 a1cbb38a007ac7d907a657370e4d81d3.exe 98 PID 1540 wrote to memory of 3936 1540 msdcsc.exe 99 PID 1540 wrote to memory of 3936 1540 msdcsc.exe 99 PID 1540 wrote to memory of 3936 1540 msdcsc.exe 99 PID 1540 wrote to memory of 1400 1540 msdcsc.exe 101 PID 1540 wrote to memory of 1400 1540 msdcsc.exe 101 PID 1540 wrote to memory of 2728 1540 msdcsc.exe 100 PID 1540 wrote to memory of 2728 1540 msdcsc.exe 100 PID 1540 wrote to memory of 2728 1540 msdcsc.exe 100 PID 1540 wrote to memory of 2728 1540 msdcsc.exe 100 PID 1540 wrote to memory of 2728 1540 msdcsc.exe 100 PID 1540 wrote to memory of 2728 1540 msdcsc.exe 100 PID 1540 wrote to memory of 2728 1540 msdcsc.exe 100 PID 1540 wrote to memory of 2728 1540 msdcsc.exe 100 PID 1540 wrote to memory of 2728 1540 msdcsc.exe 100 PID 1540 wrote to memory of 2728 1540 msdcsc.exe 100 PID 1540 wrote to memory of 2728 1540 msdcsc.exe 100 PID 1540 wrote to memory of 2728 1540 msdcsc.exe 100 PID 1540 wrote to memory of 2728 1540 msdcsc.exe 100 PID 1540 wrote to memory of 2728 1540 msdcsc.exe 100 PID 1540 wrote to memory of 2728 1540 msdcsc.exe 100 PID 1540 wrote to memory of 2728 1540 msdcsc.exe 100 PID 1540 wrote to memory of 2728 1540 msdcsc.exe 100 PID 1540 wrote to memory of 2728 1540 msdcsc.exe 100 PID 1540 wrote to memory of 2728 1540 msdcsc.exe 100 PID 1540 wrote to memory of 2728 1540 msdcsc.exe 100 PID 1540 wrote to memory of 2728 1540 msdcsc.exe 100 PID 1540 wrote to memory of 2728 1540 msdcsc.exe 100 - System policy modification 1 TTPs 3 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\CurrentVersion msdcsc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\CurrentVersion\Explorern msdcsc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\CurrentVersion\Explorern\NoControlPanel = "1" msdcsc.exe - Views/modifies file attributes 1 TTPs 2 IoCs
pid Process 2084 attrib.exe 4352 attrib.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\a1cbb38a007ac7d907a657370e4d81d3.exe"C:\Users\Admin\AppData\Local\Temp\a1cbb38a007ac7d907a657370e4d81d3.exe"1⤵
- Modifies WinLogon for persistence
- Checks computer location settings
- Adds Run key to start application
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3992 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp" +s +h2⤵
- Suspicious use of WriteProcessMemory
PID:3480 -
C:\Windows\SysWOW64\attrib.exeattrib "C:\Users\Admin\AppData\Local\Temp" +s +h3⤵
- Sets file to hidden
- Views/modifies file attributes
PID:2084
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp\a1cbb38a007ac7d907a657370e4d81d3.exe" +s +h2⤵
- Suspicious use of WriteProcessMemory
PID:1692 -
C:\Windows\SysWOW64\attrib.exeattrib "C:\Users\Admin\AppData\Local\Temp\a1cbb38a007ac7d907a657370e4d81d3.exe" +s +h3⤵
- Sets file to hidden
- Views/modifies file attributes
PID:4352
-
-
-
C:\Windows\SysWOW64\notepad.exenotepad2⤵
- Deletes itself
PID:3176
-
-
C:\Users\Admin\Documents\MSDCSC\msdcsc.exe"C:\Users\Admin\Documents\MSDCSC\msdcsc.exe"2⤵
- Modifies firewall policy service
- Modifies security service
- Windows security bypass
- Disables RegEdit via registry modification
- Executes dropped EXE
- Windows security modification
- Adds Run key to start application
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1540 -
C:\Program Files (x86)\Internet Explorer\iexplore.exe"C:\Program Files (x86)\Internet Explorer\iexplore.exe"3⤵PID:3936
-
-
C:\Windows\SysWOW64\notepad.exenotepad3⤵PID:2728
-
-
C:\Windows\explorer.exe"C:\Windows\explorer.exe"3⤵PID:1400
-
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Create or Modify System Process
2Windows Service
2Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Create or Modify System Process
2Windows Service
2Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\Documents\MSDCSC\msdcsc.exe
- Size 283KB
- SHA256 77f4ac865a0c893d1667f97795899264be2b7f16e00ef4134b01873d29438903
- MD5 a1cbb38a007ac7d907a657370e4d81d3
- SHA1 743fe5c1b7056e358a6c84db5ad1b214e002fb81
- SHA512 9fcd8f989656ce3d6d11efa31821e32f42fda2da39adfc26f13c3d811444d73f5ea82edad8c43d6f3b2944a6d0f88da2672db85896855f01f5ab12988d9a44cf
- SSDEEP 6144:ZcNYS996KFifeVjBpeExgVTFSXFoMc5RhCaL37P:ZcW7KEZlPzCy37P
- MD5 SHA1 SHA512 SSDEEP