Analysis
-
max time kernel
141s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-20231222-en -
resource tags
arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system -
submitted
20/01/2024, 04:29
Behavioral task
behavioral1
Sample
loader_cheat.exe
Resource
win7-20231129-en
General
-
Target
loader_cheat.exe
-
Size
408KB
-
MD5
e2df2edc888e3c84bf1bd728c6e42100
-
SHA1
9568c9f3ba712bf403ac7aa7af90241d79d6ea46
-
SHA256
1d47db6e436daec107ca6166a1e61cbec6d12121fb5fa0664191d37e79256e4c
-
SHA512
70070da3988e3ebd40de675f384d93f5fe1e6aa2944e5843736505b708a1b55167dfcc2540965bbe0636125049c791d4d39fe3b60db1bd41e93dd3f0712ec354
-
SSDEEP
6144:KcNYS996KFifeVjBpeExgVTFSXFoMc5RhCaL37zAtyhb8yBUs9P0wkDLDv:KcW7KEZlPzCy37zAtyhb9BRCwCvv
Malware Config
Extracted
darkcomet
Guest16
tadaronneeng.ddns.net:5353
DC_MUTEX-2C4PPGM
-
gencode
6EN5BFnr5B4P
-
install
false
-
offline_keylogger
true
-
persistence
false
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\Control Panel\International\Geo\Nation loader_cheat.exe -
Executes dropped EXE 1 IoCs
pid Process 4052 LOADER_BUILD.EXE -
resource yara_rule behavioral2/memory/4712-0-0x0000000000400000-0x000000000050B000-memory.dmp upx behavioral2/memory/4712-13-0x0000000000400000-0x000000000050B000-memory.dmp upx behavioral2/memory/4712-16-0x0000000000400000-0x000000000050B000-memory.dmp upx behavioral2/memory/4712-18-0x0000000000400000-0x000000000050B000-memory.dmp upx behavioral2/memory/4712-20-0x0000000000400000-0x000000000050B000-memory.dmp upx behavioral2/memory/4712-22-0x0000000000400000-0x000000000050B000-memory.dmp upx behavioral2/memory/4712-24-0x0000000000400000-0x000000000050B000-memory.dmp upx -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of AdjustPrivilegeToken 24 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 4712 loader_cheat.exe Token: SeSecurityPrivilege 4712 loader_cheat.exe Token: SeTakeOwnershipPrivilege 4712 loader_cheat.exe Token: SeLoadDriverPrivilege 4712 loader_cheat.exe Token: SeSystemProfilePrivilege 4712 loader_cheat.exe Token: SeSystemtimePrivilege 4712 loader_cheat.exe Token: SeProfSingleProcessPrivilege 4712 loader_cheat.exe Token: SeIncBasePriorityPrivilege 4712 loader_cheat.exe Token: SeCreatePagefilePrivilege 4712 loader_cheat.exe Token: SeBackupPrivilege 4712 loader_cheat.exe Token: SeRestorePrivilege 4712 loader_cheat.exe Token: SeShutdownPrivilege 4712 loader_cheat.exe Token: SeDebugPrivilege 4712 loader_cheat.exe Token: SeSystemEnvironmentPrivilege 4712 loader_cheat.exe Token: SeChangeNotifyPrivilege 4712 loader_cheat.exe Token: SeRemoteShutdownPrivilege 4712 loader_cheat.exe Token: SeUndockPrivilege 4712 loader_cheat.exe Token: SeManageVolumePrivilege 4712 loader_cheat.exe Token: SeImpersonatePrivilege 4712 loader_cheat.exe Token: SeCreateGlobalPrivilege 4712 loader_cheat.exe Token: 33 4712 loader_cheat.exe Token: 34 4712 loader_cheat.exe Token: 35 4712 loader_cheat.exe Token: 36 4712 loader_cheat.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 4712 loader_cheat.exe -
Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 4712 wrote to memory of 4052 4712 loader_cheat.exe 101 PID 4712 wrote to memory of 4052 4712 loader_cheat.exe 101
Processes
-
C:\Users\Admin\AppData\Local\Temp\loader_cheat.exe"C:\Users\Admin\AppData\Local\Temp\loader_cheat.exe"1⤵
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4712 -
C:\Users\Admin\AppData\Local\Temp\LOADER_BUILD.EXE"C:\Users\Admin\AppData\Local\Temp\LOADER_BUILD.EXE"2⤵
- Executes dropped EXE
PID:4052
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
139KB
MD5974463c392b19373ffdddd7394a1c120
SHA1af1d97fdaa881b92c2bdf8915562f139943da45b
SHA256c35b92c5c836152290d90ad1cea75b18cb24e3271886473c976812384369eb5e
SHA5129b39edd75c8ccfcce109d4a84ca58e92ac47a49eb8663dcfd3b60ca4b616f8092af6c86bb933a4a41d75029a4783d6ed71966b0b25ca4a152afc654e357e15c9