Analysis
-
max time kernel
140s -
max time network
140s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
20/01/2024, 04:29
Behavioral task
behavioral1
Sample
loader_cheat.exe
Resource
win7-20231129-en
General
-
Target
loader_cheat.exe
-
Size
408KB
-
MD5
e2df2edc888e3c84bf1bd728c6e42100
-
SHA1
9568c9f3ba712bf403ac7aa7af90241d79d6ea46
-
SHA256
1d47db6e436daec107ca6166a1e61cbec6d12121fb5fa0664191d37e79256e4c
-
SHA512
70070da3988e3ebd40de675f384d93f5fe1e6aa2944e5843736505b708a1b55167dfcc2540965bbe0636125049c791d4d39fe3b60db1bd41e93dd3f0712ec354
-
SSDEEP
6144:KcNYS996KFifeVjBpeExgVTFSXFoMc5RhCaL37zAtyhb8yBUs9P0wkDLDv:KcW7KEZlPzCy37zAtyhb9BRCwCvv
Malware Config
Extracted
darkcomet
Guest16
tadaronneeng.ddns.net:5353
DC_MUTEX-2C4PPGM
-
gencode
6EN5BFnr5B4P
-
install
false
-
offline_keylogger
true
-
persistence
false
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 3040 LOADER_BUILD.EXE -
Loads dropped DLL 1 IoCs
pid Process 2028 loader_cheat.exe -
resource yara_rule behavioral1/memory/2028-0-0x0000000000400000-0x000000000050B000-memory.dmp upx behavioral1/memory/2028-7-0x0000000000400000-0x000000000050B000-memory.dmp upx behavioral1/memory/2028-9-0x0000000000400000-0x000000000050B000-memory.dmp upx -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of AdjustPrivilegeToken 23 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 2028 loader_cheat.exe Token: SeSecurityPrivilege 2028 loader_cheat.exe Token: SeTakeOwnershipPrivilege 2028 loader_cheat.exe Token: SeLoadDriverPrivilege 2028 loader_cheat.exe Token: SeSystemProfilePrivilege 2028 loader_cheat.exe Token: SeSystemtimePrivilege 2028 loader_cheat.exe Token: SeProfSingleProcessPrivilege 2028 loader_cheat.exe Token: SeIncBasePriorityPrivilege 2028 loader_cheat.exe Token: SeCreatePagefilePrivilege 2028 loader_cheat.exe Token: SeBackupPrivilege 2028 loader_cheat.exe Token: SeRestorePrivilege 2028 loader_cheat.exe Token: SeShutdownPrivilege 2028 loader_cheat.exe Token: SeDebugPrivilege 2028 loader_cheat.exe Token: SeSystemEnvironmentPrivilege 2028 loader_cheat.exe Token: SeChangeNotifyPrivilege 2028 loader_cheat.exe Token: SeRemoteShutdownPrivilege 2028 loader_cheat.exe Token: SeUndockPrivilege 2028 loader_cheat.exe Token: SeManageVolumePrivilege 2028 loader_cheat.exe Token: SeImpersonatePrivilege 2028 loader_cheat.exe Token: SeCreateGlobalPrivilege 2028 loader_cheat.exe Token: 33 2028 loader_cheat.exe Token: 34 2028 loader_cheat.exe Token: 35 2028 loader_cheat.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2028 loader_cheat.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2028 wrote to memory of 3040 2028 loader_cheat.exe 28 PID 2028 wrote to memory of 3040 2028 loader_cheat.exe 28 PID 2028 wrote to memory of 3040 2028 loader_cheat.exe 28 PID 2028 wrote to memory of 3040 2028 loader_cheat.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\loader_cheat.exe"C:\Users\Admin\AppData\Local\Temp\loader_cheat.exe"1⤵
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2028 -
C:\Users\Admin\AppData\Local\Temp\LOADER_BUILD.EXE"C:\Users\Admin\AppData\Local\Temp\LOADER_BUILD.EXE"2⤵
- Executes dropped EXE
PID:3040
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
139KB
MD5974463c392b19373ffdddd7394a1c120
SHA1af1d97fdaa881b92c2bdf8915562f139943da45b
SHA256c35b92c5c836152290d90ad1cea75b18cb24e3271886473c976812384369eb5e
SHA5129b39edd75c8ccfcce109d4a84ca58e92ac47a49eb8663dcfd3b60ca4b616f8092af6c86bb933a4a41d75029a4783d6ed71966b0b25ca4a152afc654e357e15c9