Analysis
-
max time kernel
158s -
max time network
162s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
20/01/2024, 03:05
Behavioral task
behavioral1
Sample
latest.exe
Resource
win7-20231215-en
General
-
Target
latest.exe
-
Size
756KB
-
MD5
3d44f7937fb46ea4de708e90a4ca4587
-
SHA1
db54473365d6aa656523607286c777ce37aee53b
-
SHA256
f993cc832ebf9603779a0d03ef696305818f27d0edf14dca665eb8571b13b98e
-
SHA512
c4d686e875ad26e5debed497630d7d1e6acecf64864928375fbd09130b9761fa54e623b9d41b2d984ee4a4f5b83debb2f194a485242fdad70ecec17dbfeae2fe
-
SSDEEP
12288:x9HFJ9rJxRX1uVVjoaWSoynxdO1FVBaOiRZTERfIhNkNCCLo9Ek5C/hz:rZ1xuVVjfFoynPaVBUR8f+kN10EB1
Malware Config
Extracted
darkcomet
Guest16
122.176.133.66:2181
DC_MUTEX-10VBW8X
-
InstallPath
MSDCSC\msdcsc.exe
-
gencode
EVjYUENRn40t
-
install
true
-
offline_keylogger
true
-
password
hacker667
-
persistence
true
-
reg_key
MicroUpdate
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Users\\Admin\\AppData\\Local\\Temp\\MSDCSC\\msdcsc.exe" latest.exe -
Sets file to hidden 1 TTPs 2 IoCs
Modifies file attributes to stop it showing in Explorer etc.
pid Process 1928 attrib.exe 1152 attrib.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\Control Panel\International\Geo\Nation latest.exe -
Executes dropped EXE 1 IoCs
pid Process 1932 msdcsc.exe -
Adds Run key to start application 2 TTPs 3 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Users\\Admin\\AppData\\Local\\Temp\\MSDCSC\\msdcsc.exe" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Users\\Admin\\AppData\\Local\\Temp\\MSDCSC\\msdcsc.exe" latest.exe Set value (str) \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Users\\Admin\\AppData\\Local\\Temp\\MSDCSC\\msdcsc.exe" msdcsc.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 1932 set thread context of 1836 1932 msdcsc.exe 98 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ latest.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1836 iexplore.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 4408 latest.exe Token: SeSecurityPrivilege 4408 latest.exe Token: SeTakeOwnershipPrivilege 4408 latest.exe Token: SeLoadDriverPrivilege 4408 latest.exe Token: SeSystemProfilePrivilege 4408 latest.exe Token: SeSystemtimePrivilege 4408 latest.exe Token: SeProfSingleProcessPrivilege 4408 latest.exe Token: SeIncBasePriorityPrivilege 4408 latest.exe Token: SeCreatePagefilePrivilege 4408 latest.exe Token: SeBackupPrivilege 4408 latest.exe Token: SeRestorePrivilege 4408 latest.exe Token: SeShutdownPrivilege 4408 latest.exe Token: SeDebugPrivilege 4408 latest.exe Token: SeSystemEnvironmentPrivilege 4408 latest.exe Token: SeChangeNotifyPrivilege 4408 latest.exe Token: SeRemoteShutdownPrivilege 4408 latest.exe Token: SeUndockPrivilege 4408 latest.exe Token: SeManageVolumePrivilege 4408 latest.exe Token: SeImpersonatePrivilege 4408 latest.exe Token: SeCreateGlobalPrivilege 4408 latest.exe Token: 33 4408 latest.exe Token: 34 4408 latest.exe Token: 35 4408 latest.exe Token: 36 4408 latest.exe Token: SeIncreaseQuotaPrivilege 1932 msdcsc.exe Token: SeSecurityPrivilege 1932 msdcsc.exe Token: SeTakeOwnershipPrivilege 1932 msdcsc.exe Token: SeLoadDriverPrivilege 1932 msdcsc.exe Token: SeSystemProfilePrivilege 1932 msdcsc.exe Token: SeSystemtimePrivilege 1932 msdcsc.exe Token: SeProfSingleProcessPrivilege 1932 msdcsc.exe Token: SeIncBasePriorityPrivilege 1932 msdcsc.exe Token: SeCreatePagefilePrivilege 1932 msdcsc.exe Token: SeBackupPrivilege 1932 msdcsc.exe Token: SeRestorePrivilege 1932 msdcsc.exe Token: SeShutdownPrivilege 1932 msdcsc.exe Token: SeDebugPrivilege 1932 msdcsc.exe Token: SeSystemEnvironmentPrivilege 1932 msdcsc.exe Token: SeChangeNotifyPrivilege 1932 msdcsc.exe Token: SeRemoteShutdownPrivilege 1932 msdcsc.exe Token: SeUndockPrivilege 1932 msdcsc.exe Token: SeManageVolumePrivilege 1932 msdcsc.exe Token: SeImpersonatePrivilege 1932 msdcsc.exe Token: SeCreateGlobalPrivilege 1932 msdcsc.exe Token: 33 1932 msdcsc.exe Token: 34 1932 msdcsc.exe Token: 35 1932 msdcsc.exe Token: 36 1932 msdcsc.exe Token: SeIncreaseQuotaPrivilege 1836 iexplore.exe Token: SeSecurityPrivilege 1836 iexplore.exe Token: SeTakeOwnershipPrivilege 1836 iexplore.exe Token: SeLoadDriverPrivilege 1836 iexplore.exe Token: SeSystemProfilePrivilege 1836 iexplore.exe Token: SeSystemtimePrivilege 1836 iexplore.exe Token: SeProfSingleProcessPrivilege 1836 iexplore.exe Token: SeIncBasePriorityPrivilege 1836 iexplore.exe Token: SeCreatePagefilePrivilege 1836 iexplore.exe Token: SeBackupPrivilege 1836 iexplore.exe Token: SeRestorePrivilege 1836 iexplore.exe Token: SeShutdownPrivilege 1836 iexplore.exe Token: SeDebugPrivilege 1836 iexplore.exe Token: SeSystemEnvironmentPrivilege 1836 iexplore.exe Token: SeChangeNotifyPrivilege 1836 iexplore.exe Token: SeRemoteShutdownPrivilege 1836 iexplore.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 1836 iexplore.exe -
Suspicious use of WriteProcessMemory 42 IoCs
description pid Process procid_target PID 4408 wrote to memory of 4896 4408 latest.exe 89 PID 4408 wrote to memory of 4896 4408 latest.exe 89 PID 4408 wrote to memory of 4896 4408 latest.exe 89 PID 4408 wrote to memory of 3916 4408 latest.exe 91 PID 4408 wrote to memory of 3916 4408 latest.exe 91 PID 4408 wrote to memory of 3916 4408 latest.exe 91 PID 4896 wrote to memory of 1928 4896 cmd.exe 93 PID 4896 wrote to memory of 1928 4896 cmd.exe 93 PID 4896 wrote to memory of 1928 4896 cmd.exe 93 PID 3916 wrote to memory of 1152 3916 cmd.exe 94 PID 3916 wrote to memory of 1152 3916 cmd.exe 94 PID 3916 wrote to memory of 1152 3916 cmd.exe 94 PID 4408 wrote to memory of 1932 4408 latest.exe 97 PID 4408 wrote to memory of 1932 4408 latest.exe 97 PID 4408 wrote to memory of 1932 4408 latest.exe 97 PID 1932 wrote to memory of 1836 1932 msdcsc.exe 98 PID 1932 wrote to memory of 1836 1932 msdcsc.exe 98 PID 1932 wrote to memory of 1836 1932 msdcsc.exe 98 PID 1932 wrote to memory of 1836 1932 msdcsc.exe 98 PID 1932 wrote to memory of 1836 1932 msdcsc.exe 98 PID 1836 wrote to memory of 1796 1836 iexplore.exe 100 PID 1836 wrote to memory of 1796 1836 iexplore.exe 100 PID 1836 wrote to memory of 1796 1836 iexplore.exe 100 PID 1836 wrote to memory of 1796 1836 iexplore.exe 100 PID 1836 wrote to memory of 1796 1836 iexplore.exe 100 PID 1836 wrote to memory of 1796 1836 iexplore.exe 100 PID 1836 wrote to memory of 1796 1836 iexplore.exe 100 PID 1836 wrote to memory of 1796 1836 iexplore.exe 100 PID 1836 wrote to memory of 1796 1836 iexplore.exe 100 PID 1836 wrote to memory of 1796 1836 iexplore.exe 100 PID 1836 wrote to memory of 1796 1836 iexplore.exe 100 PID 1836 wrote to memory of 1796 1836 iexplore.exe 100 PID 1836 wrote to memory of 1796 1836 iexplore.exe 100 PID 1836 wrote to memory of 1796 1836 iexplore.exe 100 PID 1836 wrote to memory of 1796 1836 iexplore.exe 100 PID 1836 wrote to memory of 1796 1836 iexplore.exe 100 PID 1836 wrote to memory of 1796 1836 iexplore.exe 100 PID 1836 wrote to memory of 1796 1836 iexplore.exe 100 PID 1836 wrote to memory of 1796 1836 iexplore.exe 100 PID 1836 wrote to memory of 1796 1836 iexplore.exe 100 PID 1836 wrote to memory of 1796 1836 iexplore.exe 100 PID 1836 wrote to memory of 1796 1836 iexplore.exe 100 -
Views/modifies file attributes 1 TTPs 2 IoCs
pid Process 1928 attrib.exe 1152 attrib.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\latest.exe"C:\Users\Admin\AppData\Local\Temp\latest.exe"1⤵
- Modifies WinLogon for persistence
- Checks computer location settings
- Adds Run key to start application
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4408 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp\latest.exe" +s +h2⤵
- Suspicious use of WriteProcessMemory
PID:4896 -
C:\Windows\SysWOW64\attrib.exeattrib "C:\Users\Admin\AppData\Local\Temp\latest.exe" +s +h3⤵
- Sets file to hidden
- Views/modifies file attributes
PID:1928
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp" +s +h2⤵
- Suspicious use of WriteProcessMemory
PID:3916 -
C:\Windows\SysWOW64\attrib.exeattrib "C:\Users\Admin\AppData\Local\Temp" +s +h3⤵
- Sets file to hidden
- Views/modifies file attributes
PID:1152
-
-
-
C:\Users\Admin\AppData\Local\Temp\MSDCSC\msdcsc.exe"C:\Users\Admin\AppData\Local\Temp\MSDCSC\msdcsc.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1932 -
C:\Program Files (x86)\Internet Explorer\iexplore.exe"C:\Program Files (x86)\Internet Explorer\iexplore.exe"3⤵
- Adds Run key to start application
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1836 -
C:\Windows\SysWOW64\notepad.exenotepad4⤵PID:1796
-
-
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
756KB
MD53d44f7937fb46ea4de708e90a4ca4587
SHA1db54473365d6aa656523607286c777ce37aee53b
SHA256f993cc832ebf9603779a0d03ef696305818f27d0edf14dca665eb8571b13b98e
SHA512c4d686e875ad26e5debed497630d7d1e6acecf64864928375fbd09130b9761fa54e623b9d41b2d984ee4a4f5b83debb2f194a485242fdad70ecec17dbfeae2fe