Analysis
-
max time kernel
147s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
20/01/2024, 18:09
Static task
static1
Behavioral task
behavioral1
Sample
6b18a6b20832fb7929ccb4b3043f3218.exe
Resource
win7-20231215-en
General
-
Target
6b18a6b20832fb7929ccb4b3043f3218.exe
-
Size
964KB
-
MD5
6b18a6b20832fb7929ccb4b3043f3218
-
SHA1
6f35aca55396af3e9f8e6939c4ee1bfb3f5bc69a
-
SHA256
70635ba75fdb495bb4c0209f26176f0c0d40fd294c8b39898f18742f2e55ce20
-
SHA512
f69815bc4bead7481be0ecaa43eb53b32c26a5502e40f4b3f68789534cf501246528a35e86bf3b092aed4864691192527414c7c949327c7610e1659377b230f9
-
SSDEEP
24576:CMFvr6fMVQXwU23E/0iprDKUHSIHzOIfbfxRwv6lRu9xitRHsn:CMFO+QXwb3xGmDIHzOIfjblRuCto
Malware Config
Extracted
darkcomet
Guest16
84.72.27.213:1604
DC_MUTEX-3WNETRQ
-
InstallPath
MSDCSC\msdcsc.exe
-
gencode
RJVLW58TNDYF
-
install
true
-
offline_keylogger
true
-
persistence
false
-
reg_key
MicroUpdate
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Users\\Admin\\Documents\\MSDCSC\\msdcsc.exe" 6b18a6b20832fb7929ccb4b3043f3218.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1815711207-1844170477-3539718864-1000\Control Panel\International\Geo\Nation 6b18a6b20832fb7929ccb4b3043f3218.exe -
Executes dropped EXE 2 IoCs
pid Process 2740 msdcsc.exe 3604 msdcsc.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1815711207-1844170477-3539718864-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Users\\Admin\\Documents\\MSDCSC\\msdcsc.exe" 6b18a6b20832fb7929ccb4b3043f3218.exe -
Program crash 1 IoCs
pid pid_target Process procid_target 4940 4648 WerFault.exe 93 -
Writes to the Master Boot Record (MBR) 1 TTPs 3 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
description ioc Process File opened for modification \??\PhysicalDrive0 6b18a6b20832fb7929ccb4b3043f3218.exe File opened for modification \??\PhysicalDrive0 msdcsc.exe File opened for modification \??\PhysicalDrive0 iexplore.exe -
Suspicious use of SetThreadContext 4 IoCs
description pid Process procid_target PID 4824 set thread context of 4072 4824 6b18a6b20832fb7929ccb4b3043f3218.exe 88 PID 2740 set thread context of 3604 2740 msdcsc.exe 90 PID 3604 set thread context of 3340 3604 msdcsc.exe 92 PID 3340 set thread context of 4648 3340 iexplore.exe 93 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of AdjustPrivilegeToken 48 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 4072 6b18a6b20832fb7929ccb4b3043f3218.exe Token: SeSecurityPrivilege 4072 6b18a6b20832fb7929ccb4b3043f3218.exe Token: SeTakeOwnershipPrivilege 4072 6b18a6b20832fb7929ccb4b3043f3218.exe Token: SeLoadDriverPrivilege 4072 6b18a6b20832fb7929ccb4b3043f3218.exe Token: SeSystemProfilePrivilege 4072 6b18a6b20832fb7929ccb4b3043f3218.exe Token: SeSystemtimePrivilege 4072 6b18a6b20832fb7929ccb4b3043f3218.exe Token: SeProfSingleProcessPrivilege 4072 6b18a6b20832fb7929ccb4b3043f3218.exe Token: SeIncBasePriorityPrivilege 4072 6b18a6b20832fb7929ccb4b3043f3218.exe Token: SeCreatePagefilePrivilege 4072 6b18a6b20832fb7929ccb4b3043f3218.exe Token: SeBackupPrivilege 4072 6b18a6b20832fb7929ccb4b3043f3218.exe Token: SeRestorePrivilege 4072 6b18a6b20832fb7929ccb4b3043f3218.exe Token: SeShutdownPrivilege 4072 6b18a6b20832fb7929ccb4b3043f3218.exe Token: SeDebugPrivilege 4072 6b18a6b20832fb7929ccb4b3043f3218.exe Token: SeSystemEnvironmentPrivilege 4072 6b18a6b20832fb7929ccb4b3043f3218.exe Token: SeChangeNotifyPrivilege 4072 6b18a6b20832fb7929ccb4b3043f3218.exe Token: SeRemoteShutdownPrivilege 4072 6b18a6b20832fb7929ccb4b3043f3218.exe Token: SeUndockPrivilege 4072 6b18a6b20832fb7929ccb4b3043f3218.exe Token: SeManageVolumePrivilege 4072 6b18a6b20832fb7929ccb4b3043f3218.exe Token: SeImpersonatePrivilege 4072 6b18a6b20832fb7929ccb4b3043f3218.exe Token: SeCreateGlobalPrivilege 4072 6b18a6b20832fb7929ccb4b3043f3218.exe Token: 33 4072 6b18a6b20832fb7929ccb4b3043f3218.exe Token: 34 4072 6b18a6b20832fb7929ccb4b3043f3218.exe Token: 35 4072 6b18a6b20832fb7929ccb4b3043f3218.exe Token: 36 4072 6b18a6b20832fb7929ccb4b3043f3218.exe Token: SeIncreaseQuotaPrivilege 3604 msdcsc.exe Token: SeSecurityPrivilege 3604 msdcsc.exe Token: SeTakeOwnershipPrivilege 3604 msdcsc.exe Token: SeLoadDriverPrivilege 3604 msdcsc.exe Token: SeSystemProfilePrivilege 3604 msdcsc.exe Token: SeSystemtimePrivilege 3604 msdcsc.exe Token: SeProfSingleProcessPrivilege 3604 msdcsc.exe Token: SeIncBasePriorityPrivilege 3604 msdcsc.exe Token: SeCreatePagefilePrivilege 3604 msdcsc.exe Token: SeBackupPrivilege 3604 msdcsc.exe Token: SeRestorePrivilege 3604 msdcsc.exe Token: SeShutdownPrivilege 3604 msdcsc.exe Token: SeDebugPrivilege 3604 msdcsc.exe Token: SeSystemEnvironmentPrivilege 3604 msdcsc.exe Token: SeChangeNotifyPrivilege 3604 msdcsc.exe Token: SeRemoteShutdownPrivilege 3604 msdcsc.exe Token: SeUndockPrivilege 3604 msdcsc.exe Token: SeManageVolumePrivilege 3604 msdcsc.exe Token: SeImpersonatePrivilege 3604 msdcsc.exe Token: SeCreateGlobalPrivilege 3604 msdcsc.exe Token: 33 3604 msdcsc.exe Token: 34 3604 msdcsc.exe Token: 35 3604 msdcsc.exe Token: 36 3604 msdcsc.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 4824 6b18a6b20832fb7929ccb4b3043f3218.exe 2740 msdcsc.exe 3340 iexplore.exe -
Suspicious use of WriteProcessMemory 40 IoCs
description pid Process procid_target PID 4824 wrote to memory of 4072 4824 6b18a6b20832fb7929ccb4b3043f3218.exe 88 PID 4824 wrote to memory of 4072 4824 6b18a6b20832fb7929ccb4b3043f3218.exe 88 PID 4824 wrote to memory of 4072 4824 6b18a6b20832fb7929ccb4b3043f3218.exe 88 PID 4824 wrote to memory of 4072 4824 6b18a6b20832fb7929ccb4b3043f3218.exe 88 PID 4824 wrote to memory of 4072 4824 6b18a6b20832fb7929ccb4b3043f3218.exe 88 PID 4824 wrote to memory of 4072 4824 6b18a6b20832fb7929ccb4b3043f3218.exe 88 PID 4824 wrote to memory of 4072 4824 6b18a6b20832fb7929ccb4b3043f3218.exe 88 PID 4824 wrote to memory of 4072 4824 6b18a6b20832fb7929ccb4b3043f3218.exe 88 PID 4824 wrote to memory of 4072 4824 6b18a6b20832fb7929ccb4b3043f3218.exe 88 PID 4824 wrote to memory of 4072 4824 6b18a6b20832fb7929ccb4b3043f3218.exe 88 PID 4824 wrote to memory of 4072 4824 6b18a6b20832fb7929ccb4b3043f3218.exe 88 PID 4824 wrote to memory of 4072 4824 6b18a6b20832fb7929ccb4b3043f3218.exe 88 PID 4824 wrote to memory of 4072 4824 6b18a6b20832fb7929ccb4b3043f3218.exe 88 PID 4824 wrote to memory of 4072 4824 6b18a6b20832fb7929ccb4b3043f3218.exe 88 PID 4072 wrote to memory of 2740 4072 6b18a6b20832fb7929ccb4b3043f3218.exe 89 PID 4072 wrote to memory of 2740 4072 6b18a6b20832fb7929ccb4b3043f3218.exe 89 PID 4072 wrote to memory of 2740 4072 6b18a6b20832fb7929ccb4b3043f3218.exe 89 PID 2740 wrote to memory of 3604 2740 msdcsc.exe 90 PID 2740 wrote to memory of 3604 2740 msdcsc.exe 90 PID 2740 wrote to memory of 3604 2740 msdcsc.exe 90 PID 2740 wrote to memory of 3604 2740 msdcsc.exe 90 PID 2740 wrote to memory of 3604 2740 msdcsc.exe 90 PID 2740 wrote to memory of 3604 2740 msdcsc.exe 90 PID 2740 wrote to memory of 3604 2740 msdcsc.exe 90 PID 2740 wrote to memory of 3604 2740 msdcsc.exe 90 PID 2740 wrote to memory of 3604 2740 msdcsc.exe 90 PID 2740 wrote to memory of 3604 2740 msdcsc.exe 90 PID 2740 wrote to memory of 3604 2740 msdcsc.exe 90 PID 2740 wrote to memory of 3604 2740 msdcsc.exe 90 PID 2740 wrote to memory of 3604 2740 msdcsc.exe 90 PID 2740 wrote to memory of 3604 2740 msdcsc.exe 90 PID 3604 wrote to memory of 3340 3604 msdcsc.exe 92 PID 3604 wrote to memory of 3340 3604 msdcsc.exe 92 PID 3604 wrote to memory of 3340 3604 msdcsc.exe 92 PID 3604 wrote to memory of 3340 3604 msdcsc.exe 92 PID 3604 wrote to memory of 3340 3604 msdcsc.exe 92 PID 3340 wrote to memory of 4648 3340 iexplore.exe 93 PID 3340 wrote to memory of 4648 3340 iexplore.exe 93 PID 3340 wrote to memory of 4648 3340 iexplore.exe 93 PID 3340 wrote to memory of 4648 3340 iexplore.exe 93
Processes
-
C:\Users\Admin\AppData\Local\Temp\6b18a6b20832fb7929ccb4b3043f3218.exe"C:\Users\Admin\AppData\Local\Temp\6b18a6b20832fb7929ccb4b3043f3218.exe"1⤵
- Writes to the Master Boot Record (MBR)
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4824 -
C:\Users\Admin\AppData\Local\Temp\6b18a6b20832fb7929ccb4b3043f3218.exe"C:\Users\Admin\AppData\Local\Temp\6b18a6b20832fb7929ccb4b3043f3218.exe"2⤵
- Modifies WinLogon for persistence
- Checks computer location settings
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4072 -
C:\Users\Admin\Documents\MSDCSC\msdcsc.exe"C:\Users\Admin\Documents\MSDCSC\msdcsc.exe"3⤵
- Executes dropped EXE
- Writes to the Master Boot Record (MBR)
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2740 -
C:\Users\Admin\Documents\MSDCSC\msdcsc.exe"C:\Users\Admin\Documents\MSDCSC\msdcsc.exe"4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3604 -
C:\Program Files (x86)\Internet Explorer\iexplore.exe"C:\Program Files (x86)\Internet Explorer\iexplore.exe"5⤵
- Writes to the Master Boot Record (MBR)
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3340 -
C:\Program Files (x86)\Internet Explorer\iexplore.exe"C:\Program Files (x86)\Internet Explorer\iexplore.exe"6⤵PID:4648
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4648 -s 847⤵
- Program crash
PID:4940
-
-
-
-
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 356 -p 4648 -ip 46481⤵PID:2528
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Pre-OS Boot
1Bootkit
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
964KB
MD56b18a6b20832fb7929ccb4b3043f3218
SHA16f35aca55396af3e9f8e6939c4ee1bfb3f5bc69a
SHA25670635ba75fdb495bb4c0209f26176f0c0d40fd294c8b39898f18742f2e55ce20
SHA512f69815bc4bead7481be0ecaa43eb53b32c26a5502e40f4b3f68789534cf501246528a35e86bf3b092aed4864691192527414c7c949327c7610e1659377b230f9
-
Filesize
642KB
MD583ca740e49c563d0601ac4814fbaf290
SHA152078490097e9507c60531b081231b89fcc10a27
SHA256c1634b036cc7b82c68246af1fb32fbca23d364a05763a1d70bfbeb2a1b8c74bf
SHA51233817687be440fb581d3bbb411ee56e531e7fd5c13aca582a0814ed896b8ca2bd0e10be7757fe686c7501ced58e7d121dbf9d5588667926e6affcd1cc91a63d9
-
Filesize
694KB
MD5889d5824f56c3e078758ef4e53f31727
SHA1e77aacc4bc9edde803f92a70ea50f9fa4975cf35
SHA25630fb698b784ebb140d2d21b137d762638a58d8ceef1942a22923ca7fb1b53de3
SHA512d656a683b0051989c958de8ea3c689e080612a78a36da3d7ba7154fcc82977fc1136d5e1b54208336ee9ecfcf36a7e61edbc19b0ffac0d6a667679c5a613e5a1