Analysis
-
max time kernel
150s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
11-01-2024 16:11
Static task
static1
Behavioral task
behavioral1
Sample
53f9da2780b6f5a90cfa960a7ba80eef.exe
Resource
win7-20231215-en
General
-
Target
53f9da2780b6f5a90cfa960a7ba80eef.exe
-
Size
1.3MB
-
MD5
53f9da2780b6f5a90cfa960a7ba80eef
-
SHA1
797377e262f78ebcbb50203a286fdcbc76b45e81
-
SHA256
4764430a1dcd759ca63408103232d28a82c2e1ae3c1cc29a536fecdee9171fb3
-
SHA512
bced0651108eecdad60f6b9291e065877f9b7b43ae5edbf659d6028c192de918f11e8d6019cc5e287f9036f33825c52f5b34fce58d4d76f02c834aa16dfdaa41
-
SSDEEP
24576:Vt3Neacap5W/4UHRY2FhJvQywVLjaGVOUN6nyhkHgKU6Y:VtUaAwls+9j4HgK
Malware Config
Extracted
darkcomet
slave
ratting.no-ip.org:1605
DC_MUTEX-Q21PSYS
-
gencode
3xN2KEijP0Bj
-
install
false
-
offline_keylogger
true
-
password
darkcomet
-
persistence
false
Signatures
-
Disables RegEdit via registry modification 1 IoCs
Processes:
53f9da2780b6f5a90cfa960a7ba80eef.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" 53f9da2780b6f5a90cfa960a7ba80eef.exe -
Sets file to hidden 1 TTPs 2 IoCs
Modifies file attributes to stop it showing in Explorer etc.
Processes:
attrib.exeattrib.exepid process 2812 attrib.exe 2820 attrib.exe -
Executes dropped EXE 1 IoCs
Processes:
Crypted.exepid process 2156 Crypted.exe -
Loads dropped DLL 4 IoCs
Processes:
53f9da2780b6f5a90cfa960a7ba80eef.exetaskmgr.exepid process 3004 53f9da2780b6f5a90cfa960a7ba80eef.exe 3004 53f9da2780b6f5a90cfa960a7ba80eef.exe 1444 taskmgr.exe 1444 taskmgr.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
53f9da2780b6f5a90cfa960a7ba80eef.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Windows\CurrentVersion\Run\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\53f9da2780b6f5a90cfa960a7ba80eef.exe" 53f9da2780b6f5a90cfa960a7ba80eef.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
53f9da2780b6f5a90cfa960a7ba80eef.exetaskmgr.exepid process 3004 53f9da2780b6f5a90cfa960a7ba80eef.exe 3004 53f9da2780b6f5a90cfa960a7ba80eef.exe 3004 53f9da2780b6f5a90cfa960a7ba80eef.exe 3004 53f9da2780b6f5a90cfa960a7ba80eef.exe 1444 taskmgr.exe 1444 taskmgr.exe 1444 taskmgr.exe 1444 taskmgr.exe 1444 taskmgr.exe 1444 taskmgr.exe 1444 taskmgr.exe 1444 taskmgr.exe 1444 taskmgr.exe 1444 taskmgr.exe 1444 taskmgr.exe 1444 taskmgr.exe 1444 taskmgr.exe 1444 taskmgr.exe 1444 taskmgr.exe 1444 taskmgr.exe 1444 taskmgr.exe 1444 taskmgr.exe 1444 taskmgr.exe 1444 taskmgr.exe 1444 taskmgr.exe 1444 taskmgr.exe 1444 taskmgr.exe 1444 taskmgr.exe 1444 taskmgr.exe 1444 taskmgr.exe 1444 taskmgr.exe 1444 taskmgr.exe 1444 taskmgr.exe 1444 taskmgr.exe 1444 taskmgr.exe 1444 taskmgr.exe 1444 taskmgr.exe 1444 taskmgr.exe 1444 taskmgr.exe 1444 taskmgr.exe 1444 taskmgr.exe 1444 taskmgr.exe 1444 taskmgr.exe 1444 taskmgr.exe 1444 taskmgr.exe 1444 taskmgr.exe 1444 taskmgr.exe 1444 taskmgr.exe 1444 taskmgr.exe 1444 taskmgr.exe 1444 taskmgr.exe 1444 taskmgr.exe 1444 taskmgr.exe 1444 taskmgr.exe 1444 taskmgr.exe 1444 taskmgr.exe 1444 taskmgr.exe 1444 taskmgr.exe 1444 taskmgr.exe 1444 taskmgr.exe 1444 taskmgr.exe 1444 taskmgr.exe 1444 taskmgr.exe 1444 taskmgr.exe -
Suspicious behavior: GetForegroundWindowSpam 2 IoCs
Processes:
Crypted.exetaskmgr.exepid process 2156 Crypted.exe 1444 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 25 IoCs
Processes:
Crypted.exe53f9da2780b6f5a90cfa960a7ba80eef.exetaskmgr.exedescription pid process Token: SeIncreaseQuotaPrivilege 2156 Crypted.exe Token: SeSecurityPrivilege 2156 Crypted.exe Token: SeTakeOwnershipPrivilege 2156 Crypted.exe Token: SeLoadDriverPrivilege 2156 Crypted.exe Token: SeSystemProfilePrivilege 2156 Crypted.exe Token: SeSystemtimePrivilege 2156 Crypted.exe Token: SeProfSingleProcessPrivilege 2156 Crypted.exe Token: SeIncBasePriorityPrivilege 2156 Crypted.exe Token: SeCreatePagefilePrivilege 2156 Crypted.exe Token: SeBackupPrivilege 2156 Crypted.exe Token: SeRestorePrivilege 2156 Crypted.exe Token: SeShutdownPrivilege 2156 Crypted.exe Token: SeDebugPrivilege 2156 Crypted.exe Token: SeSystemEnvironmentPrivilege 2156 Crypted.exe Token: SeChangeNotifyPrivilege 2156 Crypted.exe Token: SeRemoteShutdownPrivilege 2156 Crypted.exe Token: SeUndockPrivilege 2156 Crypted.exe Token: SeManageVolumePrivilege 2156 Crypted.exe Token: SeImpersonatePrivilege 2156 Crypted.exe Token: SeCreateGlobalPrivilege 2156 Crypted.exe Token: 33 2156 Crypted.exe Token: 34 2156 Crypted.exe Token: 35 2156 Crypted.exe Token: SeDebugPrivilege 3004 53f9da2780b6f5a90cfa960a7ba80eef.exe Token: SeDebugPrivilege 1444 taskmgr.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
Processes:
taskmgr.exepid process 1444 taskmgr.exe 1444 taskmgr.exe 1444 taskmgr.exe 1444 taskmgr.exe 1444 taskmgr.exe 1444 taskmgr.exe 1444 taskmgr.exe 1444 taskmgr.exe 1444 taskmgr.exe 1444 taskmgr.exe 1444 taskmgr.exe 1444 taskmgr.exe 1444 taskmgr.exe 1444 taskmgr.exe 1444 taskmgr.exe 1444 taskmgr.exe 1444 taskmgr.exe 1444 taskmgr.exe 1444 taskmgr.exe 1444 taskmgr.exe 1444 taskmgr.exe 1444 taskmgr.exe 1444 taskmgr.exe 1444 taskmgr.exe 1444 taskmgr.exe 1444 taskmgr.exe 1444 taskmgr.exe 1444 taskmgr.exe 1444 taskmgr.exe 1444 taskmgr.exe 1444 taskmgr.exe 1444 taskmgr.exe 1444 taskmgr.exe 1444 taskmgr.exe 1444 taskmgr.exe 1444 taskmgr.exe 1444 taskmgr.exe 1444 taskmgr.exe 1444 taskmgr.exe 1444 taskmgr.exe 1444 taskmgr.exe 1444 taskmgr.exe 1444 taskmgr.exe 1444 taskmgr.exe 1444 taskmgr.exe 1444 taskmgr.exe 1444 taskmgr.exe 1444 taskmgr.exe 1444 taskmgr.exe 1444 taskmgr.exe 1444 taskmgr.exe 1444 taskmgr.exe 1444 taskmgr.exe 1444 taskmgr.exe 1444 taskmgr.exe 1444 taskmgr.exe 1444 taskmgr.exe 1444 taskmgr.exe 1444 taskmgr.exe 1444 taskmgr.exe 1444 taskmgr.exe 1444 taskmgr.exe 1444 taskmgr.exe 1444 taskmgr.exe -
Suspicious use of SendNotifyMessage 64 IoCs
Processes:
taskmgr.exepid process 1444 taskmgr.exe 1444 taskmgr.exe 1444 taskmgr.exe 1444 taskmgr.exe 1444 taskmgr.exe 1444 taskmgr.exe 1444 taskmgr.exe 1444 taskmgr.exe 1444 taskmgr.exe 1444 taskmgr.exe 1444 taskmgr.exe 1444 taskmgr.exe 1444 taskmgr.exe 1444 taskmgr.exe 1444 taskmgr.exe 1444 taskmgr.exe 1444 taskmgr.exe 1444 taskmgr.exe 1444 taskmgr.exe 1444 taskmgr.exe 1444 taskmgr.exe 1444 taskmgr.exe 1444 taskmgr.exe 1444 taskmgr.exe 1444 taskmgr.exe 1444 taskmgr.exe 1444 taskmgr.exe 1444 taskmgr.exe 1444 taskmgr.exe 1444 taskmgr.exe 1444 taskmgr.exe 1444 taskmgr.exe 1444 taskmgr.exe 1444 taskmgr.exe 1444 taskmgr.exe 1444 taskmgr.exe 1444 taskmgr.exe 1444 taskmgr.exe 1444 taskmgr.exe 1444 taskmgr.exe 1444 taskmgr.exe 1444 taskmgr.exe 1444 taskmgr.exe 1444 taskmgr.exe 1444 taskmgr.exe 1444 taskmgr.exe 1444 taskmgr.exe 1444 taskmgr.exe 1444 taskmgr.exe 1444 taskmgr.exe 1444 taskmgr.exe 1444 taskmgr.exe 1444 taskmgr.exe 1444 taskmgr.exe 1444 taskmgr.exe 1444 taskmgr.exe 1444 taskmgr.exe 1444 taskmgr.exe 1444 taskmgr.exe 1444 taskmgr.exe 1444 taskmgr.exe 1444 taskmgr.exe 1444 taskmgr.exe 1444 taskmgr.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
Crypted.exepid process 2156 Crypted.exe -
Suspicious use of WriteProcessMemory 24 IoCs
Processes:
53f9da2780b6f5a90cfa960a7ba80eef.exeCrypted.execmd.execmd.exedescription pid process target process PID 3004 wrote to memory of 2156 3004 53f9da2780b6f5a90cfa960a7ba80eef.exe Crypted.exe PID 3004 wrote to memory of 2156 3004 53f9da2780b6f5a90cfa960a7ba80eef.exe Crypted.exe PID 3004 wrote to memory of 2156 3004 53f9da2780b6f5a90cfa960a7ba80eef.exe Crypted.exe PID 3004 wrote to memory of 2156 3004 53f9da2780b6f5a90cfa960a7ba80eef.exe Crypted.exe PID 2156 wrote to memory of 2164 2156 Crypted.exe cmd.exe PID 2156 wrote to memory of 2164 2156 Crypted.exe cmd.exe PID 2156 wrote to memory of 2164 2156 Crypted.exe cmd.exe PID 2156 wrote to memory of 2164 2156 Crypted.exe cmd.exe PID 2156 wrote to memory of 2068 2156 Crypted.exe cmd.exe PID 2156 wrote to memory of 2068 2156 Crypted.exe cmd.exe PID 2156 wrote to memory of 2068 2156 Crypted.exe cmd.exe PID 2156 wrote to memory of 2068 2156 Crypted.exe cmd.exe PID 2164 wrote to memory of 2812 2164 cmd.exe attrib.exe PID 2164 wrote to memory of 2812 2164 cmd.exe attrib.exe PID 2164 wrote to memory of 2812 2164 cmd.exe attrib.exe PID 2164 wrote to memory of 2812 2164 cmd.exe attrib.exe PID 2068 wrote to memory of 2820 2068 cmd.exe attrib.exe PID 2068 wrote to memory of 2820 2068 cmd.exe attrib.exe PID 2068 wrote to memory of 2820 2068 cmd.exe attrib.exe PID 2068 wrote to memory of 2820 2068 cmd.exe attrib.exe PID 3004 wrote to memory of 1444 3004 53f9da2780b6f5a90cfa960a7ba80eef.exe taskmgr.exe PID 3004 wrote to memory of 1444 3004 53f9da2780b6f5a90cfa960a7ba80eef.exe taskmgr.exe PID 3004 wrote to memory of 1444 3004 53f9da2780b6f5a90cfa960a7ba80eef.exe taskmgr.exe PID 3004 wrote to memory of 1444 3004 53f9da2780b6f5a90cfa960a7ba80eef.exe taskmgr.exe -
Views/modifies file attributes 1 TTPs 2 IoCs
Processes:
attrib.exeattrib.exepid process 2812 attrib.exe 2820 attrib.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\53f9da2780b6f5a90cfa960a7ba80eef.exe"C:\Users\Admin\AppData\Local\Temp\53f9da2780b6f5a90cfa960a7ba80eef.exe"1⤵
- Disables RegEdit via registry modification
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Crypted.exe"C:\Users\Admin\AppData\Local\Temp\Crypted.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp\Crypted.exe" +s +h3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Users\Admin\AppData\Local\Temp\Crypted.exe" +s +h4⤵
- Sets file to hidden
- Views/modifies file attributes
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp" +s +h3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Users\Admin\AppData\Local\Temp" +s +h4⤵
- Sets file to hidden
- Views/modifies file attributes
-
C:\Windows\SysWOW64\taskmgr.exetaskmgr.exe2⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
\Users\Admin\AppData\Local\Temp\Crypted.exeFilesize
649KB
MD5c0cebd70cd9ab9af0582764101331351
SHA12e1308817abe1151fd63622b2316491e4a25de8e
SHA25684fd686a3ee7c0326ab6058bb49667c18250660a79c3f710730f8ef941028f92
SHA51289bed80bedc435e7b7c7a25ab6c4d2dff81d18c1fe550bd9ce3f8b21d5441ca7e764b23108979f3cec0fe7528ce163d8c6aeab61719aba690b9630883af765d6
-
memory/2156-19-0x0000000000400000-0x00000000004B0000-memory.dmpFilesize
704KB
-
memory/2156-28-0x0000000000400000-0x00000000004B0000-memory.dmpFilesize
704KB
-
memory/2156-20-0x0000000000400000-0x00000000004B0000-memory.dmpFilesize
704KB
-
memory/2156-24-0x0000000000400000-0x00000000004B0000-memory.dmpFilesize
704KB
-
memory/2156-23-0x0000000000400000-0x00000000004B0000-memory.dmpFilesize
704KB
-
memory/2156-32-0x0000000000400000-0x00000000004B0000-memory.dmpFilesize
704KB
-
memory/2156-31-0x0000000000400000-0x00000000004B0000-memory.dmpFilesize
704KB
-
memory/2156-17-0x0000000000400000-0x00000000004B0000-memory.dmpFilesize
704KB
-
memory/2156-30-0x0000000000400000-0x00000000004B0000-memory.dmpFilesize
704KB
-
memory/2156-29-0x0000000000400000-0x00000000004B0000-memory.dmpFilesize
704KB
-
memory/2156-27-0x0000000000400000-0x00000000004B0000-memory.dmpFilesize
704KB
-
memory/2156-14-0x0000000000400000-0x00000000004B0000-memory.dmpFilesize
704KB
-
memory/2156-12-0x0000000000280000-0x0000000000281000-memory.dmpFilesize
4KB
-
memory/2156-25-0x0000000000400000-0x00000000004B0000-memory.dmpFilesize
704KB
-
memory/2156-26-0x0000000000400000-0x00000000004B0000-memory.dmpFilesize
704KB
-
memory/3004-1-0x0000000074930000-0x0000000074EDB000-memory.dmpFilesize
5.7MB
-
memory/3004-2-0x0000000000500000-0x0000000000540000-memory.dmpFilesize
256KB
-
memory/3004-0-0x0000000074930000-0x0000000074EDB000-memory.dmpFilesize
5.7MB
-
memory/3004-18-0x0000000000500000-0x0000000000540000-memory.dmpFilesize
256KB
-
memory/3004-16-0x0000000074930000-0x0000000074EDB000-memory.dmpFilesize
5.7MB
-
memory/3004-15-0x0000000074930000-0x0000000074EDB000-memory.dmpFilesize
5.7MB