Analysis
-
max time kernel
139s -
max time network
129s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
11-01-2024 20:05
Static task
static1
Behavioral task
behavioral1
Sample
53f9da2780b6f5a90cfa960a7ba80eef.exe
Resource
win7-20231129-en
General
-
Target
53f9da2780b6f5a90cfa960a7ba80eef.exe
-
Size
1.3MB
-
MD5
53f9da2780b6f5a90cfa960a7ba80eef
-
SHA1
797377e262f78ebcbb50203a286fdcbc76b45e81
-
SHA256
4764430a1dcd759ca63408103232d28a82c2e1ae3c1cc29a536fecdee9171fb3
-
SHA512
bced0651108eecdad60f6b9291e065877f9b7b43ae5edbf659d6028c192de918f11e8d6019cc5e287f9036f33825c52f5b34fce58d4d76f02c834aa16dfdaa41
-
SSDEEP
24576:Vt3Neacap5W/4UHRY2FhJvQywVLjaGVOUN6nyhkHgKU6Y:VtUaAwls+9j4HgK
Malware Config
Extracted
darkcomet
slave
ratting.no-ip.org:1605
DC_MUTEX-Q21PSYS
-
gencode
3xN2KEijP0Bj
-
install
false
-
offline_keylogger
true
-
password
darkcomet
-
persistence
false
Signatures
-
Disables RegEdit via registry modification 1 IoCs
Processes:
53f9da2780b6f5a90cfa960a7ba80eef.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" 53f9da2780b6f5a90cfa960a7ba80eef.exe -
Sets file to hidden 1 TTPs 2 IoCs
Modifies file attributes to stop it showing in Explorer etc.
Processes:
attrib.exeattrib.exepid process 1700 attrib.exe 3804 attrib.exe -
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
53f9da2780b6f5a90cfa960a7ba80eef.exeCrypted.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\Control Panel\International\Geo\Nation 53f9da2780b6f5a90cfa960a7ba80eef.exe Key value queried \REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\Control Panel\International\Geo\Nation Crypted.exe -
Executes dropped EXE 1 IoCs
Processes:
Crypted.exepid process 4608 Crypted.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
53f9da2780b6f5a90cfa960a7ba80eef.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\53f9da2780b6f5a90cfa960a7ba80eef.exe" 53f9da2780b6f5a90cfa960a7ba80eef.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
taskmgr.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName taskmgr.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
53f9da2780b6f5a90cfa960a7ba80eef.exetaskmgr.exepid process 2900 53f9da2780b6f5a90cfa960a7ba80eef.exe 2900 53f9da2780b6f5a90cfa960a7ba80eef.exe 2900 53f9da2780b6f5a90cfa960a7ba80eef.exe 2900 53f9da2780b6f5a90cfa960a7ba80eef.exe 2900 53f9da2780b6f5a90cfa960a7ba80eef.exe 2900 53f9da2780b6f5a90cfa960a7ba80eef.exe 2996 taskmgr.exe 2996 taskmgr.exe 2996 taskmgr.exe 2996 taskmgr.exe 2996 taskmgr.exe 2996 taskmgr.exe 2996 taskmgr.exe 2996 taskmgr.exe 2996 taskmgr.exe 2996 taskmgr.exe 2996 taskmgr.exe 2996 taskmgr.exe 2996 taskmgr.exe 2996 taskmgr.exe 2996 taskmgr.exe 2996 taskmgr.exe 2996 taskmgr.exe 2996 taskmgr.exe 2996 taskmgr.exe 2996 taskmgr.exe 2996 taskmgr.exe 2996 taskmgr.exe 2996 taskmgr.exe 2996 taskmgr.exe 2996 taskmgr.exe 2996 taskmgr.exe 2996 taskmgr.exe 2996 taskmgr.exe 2996 taskmgr.exe 2996 taskmgr.exe 2996 taskmgr.exe 2996 taskmgr.exe 2996 taskmgr.exe 2996 taskmgr.exe 2996 taskmgr.exe 2996 taskmgr.exe 2996 taskmgr.exe 2996 taskmgr.exe 2996 taskmgr.exe 2996 taskmgr.exe 2996 taskmgr.exe 2996 taskmgr.exe 2996 taskmgr.exe 2996 taskmgr.exe 2996 taskmgr.exe 2996 taskmgr.exe 2996 taskmgr.exe 2996 taskmgr.exe 2996 taskmgr.exe 2996 taskmgr.exe 2996 taskmgr.exe 2996 taskmgr.exe 2996 taskmgr.exe 2996 taskmgr.exe 2996 taskmgr.exe 2996 taskmgr.exe 2996 taskmgr.exe 2996 taskmgr.exe -
Suspicious behavior: GetForegroundWindowSpam 2 IoCs
Processes:
Crypted.exetaskmgr.exepid process 4608 Crypted.exe 2996 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 28 IoCs
Processes:
Crypted.exe53f9da2780b6f5a90cfa960a7ba80eef.exetaskmgr.exedescription pid process Token: SeIncreaseQuotaPrivilege 4608 Crypted.exe Token: SeSecurityPrivilege 4608 Crypted.exe Token: SeTakeOwnershipPrivilege 4608 Crypted.exe Token: SeLoadDriverPrivilege 4608 Crypted.exe Token: SeSystemProfilePrivilege 4608 Crypted.exe Token: SeSystemtimePrivilege 4608 Crypted.exe Token: SeProfSingleProcessPrivilege 4608 Crypted.exe Token: SeIncBasePriorityPrivilege 4608 Crypted.exe Token: SeCreatePagefilePrivilege 4608 Crypted.exe Token: SeBackupPrivilege 4608 Crypted.exe Token: SeRestorePrivilege 4608 Crypted.exe Token: SeShutdownPrivilege 4608 Crypted.exe Token: SeDebugPrivilege 4608 Crypted.exe Token: SeSystemEnvironmentPrivilege 4608 Crypted.exe Token: SeChangeNotifyPrivilege 4608 Crypted.exe Token: SeRemoteShutdownPrivilege 4608 Crypted.exe Token: SeUndockPrivilege 4608 Crypted.exe Token: SeManageVolumePrivilege 4608 Crypted.exe Token: SeImpersonatePrivilege 4608 Crypted.exe Token: SeCreateGlobalPrivilege 4608 Crypted.exe Token: 33 4608 Crypted.exe Token: 34 4608 Crypted.exe Token: 35 4608 Crypted.exe Token: 36 4608 Crypted.exe Token: SeDebugPrivilege 2900 53f9da2780b6f5a90cfa960a7ba80eef.exe Token: SeDebugPrivilege 2996 taskmgr.exe Token: SeSystemProfilePrivilege 2996 taskmgr.exe Token: SeCreateGlobalPrivilege 2996 taskmgr.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
Processes:
taskmgr.exepid process 2996 taskmgr.exe 2996 taskmgr.exe 2996 taskmgr.exe 2996 taskmgr.exe 2996 taskmgr.exe 2996 taskmgr.exe 2996 taskmgr.exe 2996 taskmgr.exe 2996 taskmgr.exe 2996 taskmgr.exe 2996 taskmgr.exe 2996 taskmgr.exe 2996 taskmgr.exe 2996 taskmgr.exe 2996 taskmgr.exe 2996 taskmgr.exe 2996 taskmgr.exe 2996 taskmgr.exe 2996 taskmgr.exe 2996 taskmgr.exe 2996 taskmgr.exe 2996 taskmgr.exe 2996 taskmgr.exe 2996 taskmgr.exe 2996 taskmgr.exe 2996 taskmgr.exe 2996 taskmgr.exe 2996 taskmgr.exe 2996 taskmgr.exe 2996 taskmgr.exe 2996 taskmgr.exe 2996 taskmgr.exe 2996 taskmgr.exe 2996 taskmgr.exe 2996 taskmgr.exe 2996 taskmgr.exe 2996 taskmgr.exe 2996 taskmgr.exe 2996 taskmgr.exe 2996 taskmgr.exe 2996 taskmgr.exe 2996 taskmgr.exe 2996 taskmgr.exe 2996 taskmgr.exe 2996 taskmgr.exe 2996 taskmgr.exe 2996 taskmgr.exe 2996 taskmgr.exe 2996 taskmgr.exe 2996 taskmgr.exe 2996 taskmgr.exe 2996 taskmgr.exe 2996 taskmgr.exe 2996 taskmgr.exe 2996 taskmgr.exe 2996 taskmgr.exe 2996 taskmgr.exe 2996 taskmgr.exe 2996 taskmgr.exe 2996 taskmgr.exe 2996 taskmgr.exe 2996 taskmgr.exe 2996 taskmgr.exe 2996 taskmgr.exe -
Suspicious use of SendNotifyMessage 64 IoCs
Processes:
taskmgr.exepid process 2996 taskmgr.exe 2996 taskmgr.exe 2996 taskmgr.exe 2996 taskmgr.exe 2996 taskmgr.exe 2996 taskmgr.exe 2996 taskmgr.exe 2996 taskmgr.exe 2996 taskmgr.exe 2996 taskmgr.exe 2996 taskmgr.exe 2996 taskmgr.exe 2996 taskmgr.exe 2996 taskmgr.exe 2996 taskmgr.exe 2996 taskmgr.exe 2996 taskmgr.exe 2996 taskmgr.exe 2996 taskmgr.exe 2996 taskmgr.exe 2996 taskmgr.exe 2996 taskmgr.exe 2996 taskmgr.exe 2996 taskmgr.exe 2996 taskmgr.exe 2996 taskmgr.exe 2996 taskmgr.exe 2996 taskmgr.exe 2996 taskmgr.exe 2996 taskmgr.exe 2996 taskmgr.exe 2996 taskmgr.exe 2996 taskmgr.exe 2996 taskmgr.exe 2996 taskmgr.exe 2996 taskmgr.exe 2996 taskmgr.exe 2996 taskmgr.exe 2996 taskmgr.exe 2996 taskmgr.exe 2996 taskmgr.exe 2996 taskmgr.exe 2996 taskmgr.exe 2996 taskmgr.exe 2996 taskmgr.exe 2996 taskmgr.exe 2996 taskmgr.exe 2996 taskmgr.exe 2996 taskmgr.exe 2996 taskmgr.exe 2996 taskmgr.exe 2996 taskmgr.exe 2996 taskmgr.exe 2996 taskmgr.exe 2996 taskmgr.exe 2996 taskmgr.exe 2996 taskmgr.exe 2996 taskmgr.exe 2996 taskmgr.exe 2996 taskmgr.exe 2996 taskmgr.exe 2996 taskmgr.exe 2996 taskmgr.exe 2996 taskmgr.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
Crypted.exepid process 4608 Crypted.exe -
Suspicious use of WriteProcessMemory 18 IoCs
Processes:
53f9da2780b6f5a90cfa960a7ba80eef.exeCrypted.execmd.execmd.exedescription pid process target process PID 2900 wrote to memory of 4608 2900 53f9da2780b6f5a90cfa960a7ba80eef.exe Crypted.exe PID 2900 wrote to memory of 4608 2900 53f9da2780b6f5a90cfa960a7ba80eef.exe Crypted.exe PID 2900 wrote to memory of 4608 2900 53f9da2780b6f5a90cfa960a7ba80eef.exe Crypted.exe PID 4608 wrote to memory of 3700 4608 Crypted.exe cmd.exe PID 4608 wrote to memory of 3700 4608 Crypted.exe cmd.exe PID 4608 wrote to memory of 3700 4608 Crypted.exe cmd.exe PID 4608 wrote to memory of 4292 4608 Crypted.exe cmd.exe PID 4608 wrote to memory of 4292 4608 Crypted.exe cmd.exe PID 4608 wrote to memory of 4292 4608 Crypted.exe cmd.exe PID 3700 wrote to memory of 1700 3700 cmd.exe attrib.exe PID 3700 wrote to memory of 1700 3700 cmd.exe attrib.exe PID 3700 wrote to memory of 1700 3700 cmd.exe attrib.exe PID 4292 wrote to memory of 3804 4292 cmd.exe attrib.exe PID 4292 wrote to memory of 3804 4292 cmd.exe attrib.exe PID 4292 wrote to memory of 3804 4292 cmd.exe attrib.exe PID 2900 wrote to memory of 2996 2900 53f9da2780b6f5a90cfa960a7ba80eef.exe taskmgr.exe PID 2900 wrote to memory of 2996 2900 53f9da2780b6f5a90cfa960a7ba80eef.exe taskmgr.exe PID 2900 wrote to memory of 2996 2900 53f9da2780b6f5a90cfa960a7ba80eef.exe taskmgr.exe -
Views/modifies file attributes 1 TTPs 2 IoCs
Processes:
attrib.exeattrib.exepid process 3804 attrib.exe 1700 attrib.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\53f9da2780b6f5a90cfa960a7ba80eef.exe"C:\Users\Admin\AppData\Local\Temp\53f9da2780b6f5a90cfa960a7ba80eef.exe"1⤵
- Disables RegEdit via registry modification
- Checks computer location settings
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Crypted.exe"C:\Users\Admin\AppData\Local\Temp\Crypted.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp" +s +h3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp\Crypted.exe" +s +h3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\taskmgr.exetaskmgr.exe2⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Users\Admin\AppData\Local\Temp" +s +h1⤵
- Sets file to hidden
- Views/modifies file attributes
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Users\Admin\AppData\Local\Temp\Crypted.exe" +s +h1⤵
- Sets file to hidden
- Views/modifies file attributes
Network
MITRE ATT&CK Matrix ATT&CK v13
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Defense Evasion
Hide Artifacts
2Hidden Files and Directories
2Modify Registry
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\Crypted.exeFilesize
649KB
MD5c0cebd70cd9ab9af0582764101331351
SHA12e1308817abe1151fd63622b2316491e4a25de8e
SHA25684fd686a3ee7c0326ab6058bb49667c18250660a79c3f710730f8ef941028f92
SHA51289bed80bedc435e7b7c7a25ab6c4d2dff81d18c1fe550bd9ce3f8b21d5441ca7e764b23108979f3cec0fe7528ce163d8c6aeab61719aba690b9630883af765d6
-
C:\Users\Admin\AppData\Local\Temp\Crypted.exeFilesize
251KB
MD5cea9e18d1928a85ef304d3896c1bd1d0
SHA17e02f6dda75062e2897078035ddfbeda3b8a0694
SHA256405d939f6c92c86a02b8277328604661af1de2bbd4cc5e0a83088e8064f8641b
SHA512068274165efc965487bf6348f882fd1aab5e60b969247d83c238fc195e089af072314791ccaf8973c345cfaa474ac6238785608ba7836438162c1d209f6669f8
-
C:\Users\Admin\AppData\Local\Temp\Crypted.exeFilesize
363KB
MD56d41053daadd5b81835688495405436e
SHA1288f34cec9b18a8801c13f4a3b65df6f00b3884b
SHA256248f637e1223e831c3d891de6827cb6f996a861959cfdc909c8c3e9c73f72874
SHA51205cab82180ac2156b88d8eafe1295e6e2fcc6037516e0c9fce301a46c3b35a8a99eac28ecb858af304d98c2e086520d86aefeebee0230b5e829450d13bb2cc76
-
memory/2900-19-0x0000000075580000-0x0000000075B31000-memory.dmpFilesize
5.7MB
-
memory/2900-1-0x0000000000D10000-0x0000000000D20000-memory.dmpFilesize
64KB
-
memory/2900-2-0x0000000075580000-0x0000000075B31000-memory.dmpFilesize
5.7MB
-
memory/2900-36-0x0000000000D10000-0x0000000000D20000-memory.dmpFilesize
64KB
-
memory/2900-0-0x0000000075580000-0x0000000075B31000-memory.dmpFilesize
5.7MB
-
memory/2900-20-0x0000000000D10000-0x0000000000D20000-memory.dmpFilesize
64KB
-
memory/2900-18-0x0000000000D10000-0x0000000000D20000-memory.dmpFilesize
64KB
-
memory/2900-17-0x0000000075580000-0x0000000075B31000-memory.dmpFilesize
5.7MB
-
memory/2996-29-0x0000000006070000-0x0000000006071000-memory.dmpFilesize
4KB
-
memory/2996-22-0x0000000006070000-0x0000000006071000-memory.dmpFilesize
4KB
-
memory/2996-23-0x0000000006070000-0x0000000006071000-memory.dmpFilesize
4KB
-
memory/2996-33-0x0000000006070000-0x0000000006071000-memory.dmpFilesize
4KB
-
memory/2996-32-0x0000000006070000-0x0000000006071000-memory.dmpFilesize
4KB
-
memory/2996-31-0x0000000006070000-0x0000000006071000-memory.dmpFilesize
4KB
-
memory/2996-30-0x0000000006070000-0x0000000006071000-memory.dmpFilesize
4KB
-
memory/2996-21-0x0000000006070000-0x0000000006071000-memory.dmpFilesize
4KB
-
memory/2996-28-0x0000000006070000-0x0000000006071000-memory.dmpFilesize
4KB
-
memory/2996-27-0x0000000006070000-0x0000000006071000-memory.dmpFilesize
4KB
-
memory/4608-35-0x0000000000400000-0x00000000004B0000-memory.dmpFilesize
704KB
-
memory/4608-39-0x0000000000400000-0x00000000004B0000-memory.dmpFilesize
704KB
-
memory/4608-34-0x0000000000400000-0x00000000004B0000-memory.dmpFilesize
704KB
-
memory/4608-16-0x0000000000400000-0x00000000004B0000-memory.dmpFilesize
704KB
-
memory/4608-14-0x00000000022B0000-0x00000000022B1000-memory.dmpFilesize
4KB
-
memory/4608-37-0x0000000000400000-0x00000000004B0000-memory.dmpFilesize
704KB
-
memory/4608-38-0x0000000000400000-0x00000000004B0000-memory.dmpFilesize
704KB
-
memory/4608-15-0x0000000000400000-0x00000000004B0000-memory.dmpFilesize
704KB
-
memory/4608-40-0x0000000000400000-0x00000000004B0000-memory.dmpFilesize
704KB
-
memory/4608-42-0x0000000000400000-0x00000000004B0000-memory.dmpFilesize
704KB
-
memory/4608-43-0x0000000000400000-0x00000000004B0000-memory.dmpFilesize
704KB
-
memory/4608-44-0x0000000000400000-0x00000000004B0000-memory.dmpFilesize
704KB
-
memory/4608-45-0x0000000000400000-0x00000000004B0000-memory.dmpFilesize
704KB
-
memory/4608-46-0x0000000000400000-0x00000000004B0000-memory.dmpFilesize
704KB
-
memory/4608-47-0x0000000000400000-0x00000000004B0000-memory.dmpFilesize
704KB