Analysis
- max time kernel
150s - max time network
122s - platform
windows10-2004_x64 - resource
win10v2004-20231215-en - resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system - submitted
15/02/2024, 02:07
Behavioral task
behavioral1
Sample
9cabc52b6a9b330aa00580dc5427f8ee.exe
Resource
win7-20231215-en
windows7-x64
14 signatures
150 seconds
General
- Target 9cabc52b6a9b330aa00580dc5427f8ee.exe
- Size 799KB
- Sample240215-cjyqcaeb4s
- SHA256 6c04ef5ba2d81c95ceafe84f13bf4b2b50fc1cd63b98eedbf3df8bf080d4732b
- MD5 9cabc52b6a9b330aa00580dc5427f8ee
- SHA1 0a9580462faf6b4119b8e752d0a35771b17da5d9
- SHA512 fac36a29422cf090a417dc468a7a282276ec775ff62a022b8008617854dd86dd9712ec82e17b5af614744d9160fbb2ba272202334f3555e7958ac5753d182aaf
- SSDEEP 24576:qnAw2WWeFcfbP9VPSPMTSPL/rWvzq4JJfp2+:gELbVMTrOq4w+
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Extracted
Family
-
darkcomet
Botnet
-
amiros*-"
C2
-
drok.zapto.org:1604
Mutex
-
DC_MUTEX-1XMB4PD
Attributes
-
InstallPath
MSDCSC\msdcsc.exe
-
gencode
Jv8x24KxpiYG
-
install
true
-
offline_keylogger
true
-
persistence
true
-
reg_key
MicroUpdate
Signatures
- Modifies WinLogon for persistence 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Users\\Admin\\Documents\\MSDCSC\\msdcsc.exe" 9cabc52b6a9b330aa00580dc5427f8ee.exe - Modifies firewall policy service 2 TTPs 3 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile msdcsc.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" msdcsc.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "0" msdcsc.exe - Disables RegEdit via registry modification 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" msdcsc.exe - Disables Task Manager via registry modification
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000\Control Panel\International\Geo\Nation 9cabc52b6a9b330aa00580dc5427f8ee.exe - Deletes itself 1 IoCs
pid Process 4844 notepad.exe - Executes dropped EXE 1 IoCs
pid Process 2864 msdcsc.exe - Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Users\\Admin\\Documents\\MSDCSC\\msdcsc.exe" msdcsc.exe Set value (str) \REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Users\\Admin\\Documents\\MSDCSC\\msdcsc.exe" 9cabc52b6a9b330aa00580dc5427f8ee.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious use of AdjustPrivilegeToken 48 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 2784 9cabc52b6a9b330aa00580dc5427f8ee.exe Token: SeSecurityPrivilege 2784 9cabc52b6a9b330aa00580dc5427f8ee.exe Token: SeTakeOwnershipPrivilege 2784 9cabc52b6a9b330aa00580dc5427f8ee.exe Token: SeLoadDriverPrivilege 2784 9cabc52b6a9b330aa00580dc5427f8ee.exe Token: SeSystemProfilePrivilege 2784 9cabc52b6a9b330aa00580dc5427f8ee.exe Token: SeSystemtimePrivilege 2784 9cabc52b6a9b330aa00580dc5427f8ee.exe Token: SeProfSingleProcessPrivilege 2784 9cabc52b6a9b330aa00580dc5427f8ee.exe Token: SeIncBasePriorityPrivilege 2784 9cabc52b6a9b330aa00580dc5427f8ee.exe Token: SeCreatePagefilePrivilege 2784 9cabc52b6a9b330aa00580dc5427f8ee.exe Token: SeBackupPrivilege 2784 9cabc52b6a9b330aa00580dc5427f8ee.exe Token: SeRestorePrivilege 2784 9cabc52b6a9b330aa00580dc5427f8ee.exe Token: SeShutdownPrivilege 2784 9cabc52b6a9b330aa00580dc5427f8ee.exe Token: SeDebugPrivilege 2784 9cabc52b6a9b330aa00580dc5427f8ee.exe Token: SeSystemEnvironmentPrivilege 2784 9cabc52b6a9b330aa00580dc5427f8ee.exe Token: SeChangeNotifyPrivilege 2784 9cabc52b6a9b330aa00580dc5427f8ee.exe Token: SeRemoteShutdownPrivilege 2784 9cabc52b6a9b330aa00580dc5427f8ee.exe Token: SeUndockPrivilege 2784 9cabc52b6a9b330aa00580dc5427f8ee.exe Token: SeManageVolumePrivilege 2784 9cabc52b6a9b330aa00580dc5427f8ee.exe Token: SeImpersonatePrivilege 2784 9cabc52b6a9b330aa00580dc5427f8ee.exe Token: SeCreateGlobalPrivilege 2784 9cabc52b6a9b330aa00580dc5427f8ee.exe Token: 33 2784 9cabc52b6a9b330aa00580dc5427f8ee.exe Token: 34 2784 9cabc52b6a9b330aa00580dc5427f8ee.exe Token: 35 2784 9cabc52b6a9b330aa00580dc5427f8ee.exe Token: 36 2784 9cabc52b6a9b330aa00580dc5427f8ee.exe Token: SeIncreaseQuotaPrivilege 2864 msdcsc.exe Token: SeSecurityPrivilege 2864 msdcsc.exe Token: SeTakeOwnershipPrivilege 2864 msdcsc.exe Token: SeLoadDriverPrivilege 2864 msdcsc.exe Token: SeSystemProfilePrivilege 2864 msdcsc.exe Token: SeSystemtimePrivilege 2864 msdcsc.exe Token: SeProfSingleProcessPrivilege 2864 msdcsc.exe Token: SeIncBasePriorityPrivilege 2864 msdcsc.exe Token: SeCreatePagefilePrivilege 2864 msdcsc.exe Token: SeBackupPrivilege 2864 msdcsc.exe Token: SeRestorePrivilege 2864 msdcsc.exe Token: SeShutdownPrivilege 2864 msdcsc.exe Token: SeDebugPrivilege 2864 msdcsc.exe Token: SeSystemEnvironmentPrivilege 2864 msdcsc.exe Token: SeChangeNotifyPrivilege 2864 msdcsc.exe Token: SeRemoteShutdownPrivilege 2864 msdcsc.exe Token: SeUndockPrivilege 2864 msdcsc.exe Token: SeManageVolumePrivilege 2864 msdcsc.exe Token: SeImpersonatePrivilege 2864 msdcsc.exe Token: SeCreateGlobalPrivilege 2864 msdcsc.exe Token: 33 2864 msdcsc.exe Token: 34 2864 msdcsc.exe Token: 35 2864 msdcsc.exe Token: 36 2864 msdcsc.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2864 msdcsc.exe - Suspicious use of WriteProcessMemory 47 IoCs
description pid Process procid_target PID 2784 wrote to memory of 4844 2784 9cabc52b6a9b330aa00580dc5427f8ee.exe 85 PID 2784 wrote to memory of 4844 2784 9cabc52b6a9b330aa00580dc5427f8ee.exe 85 PID 2784 wrote to memory of 4844 2784 9cabc52b6a9b330aa00580dc5427f8ee.exe 85 PID 2784 wrote to memory of 4844 2784 9cabc52b6a9b330aa00580dc5427f8ee.exe 85 PID 2784 wrote to memory of 4844 2784 9cabc52b6a9b330aa00580dc5427f8ee.exe 85 PID 2784 wrote to memory of 4844 2784 9cabc52b6a9b330aa00580dc5427f8ee.exe 85 PID 2784 wrote to memory of 4844 2784 9cabc52b6a9b330aa00580dc5427f8ee.exe 85 PID 2784 wrote to memory of 4844 2784 9cabc52b6a9b330aa00580dc5427f8ee.exe 85 PID 2784 wrote to memory of 4844 2784 9cabc52b6a9b330aa00580dc5427f8ee.exe 85 PID 2784 wrote to memory of 4844 2784 9cabc52b6a9b330aa00580dc5427f8ee.exe 85 PID 2784 wrote to memory of 4844 2784 9cabc52b6a9b330aa00580dc5427f8ee.exe 85 PID 2784 wrote to memory of 4844 2784 9cabc52b6a9b330aa00580dc5427f8ee.exe 85 PID 2784 wrote to memory of 4844 2784 9cabc52b6a9b330aa00580dc5427f8ee.exe 85 PID 2784 wrote to memory of 4844 2784 9cabc52b6a9b330aa00580dc5427f8ee.exe 85 PID 2784 wrote to memory of 4844 2784 9cabc52b6a9b330aa00580dc5427f8ee.exe 85 PID 2784 wrote to memory of 4844 2784 9cabc52b6a9b330aa00580dc5427f8ee.exe 85 PID 2784 wrote to memory of 4844 2784 9cabc52b6a9b330aa00580dc5427f8ee.exe 85 PID 2784 wrote to memory of 2864 2784 9cabc52b6a9b330aa00580dc5427f8ee.exe 86 PID 2784 wrote to memory of 2864 2784 9cabc52b6a9b330aa00580dc5427f8ee.exe 86 PID 2784 wrote to memory of 2864 2784 9cabc52b6a9b330aa00580dc5427f8ee.exe 86 PID 2864 wrote to memory of 4012 2864 msdcsc.exe 87 PID 2864 wrote to memory of 4012 2864 msdcsc.exe 87 PID 2864 wrote to memory of 4012 2864 msdcsc.exe 87 PID 2864 wrote to memory of 5096 2864 msdcsc.exe 88 PID 2864 wrote to memory of 5096 2864 msdcsc.exe 88 PID 2864 wrote to memory of 1368 2864 msdcsc.exe 89 PID 2864 wrote to memory of 1368 2864 msdcsc.exe 89 PID 2864 wrote to memory of 1368 2864 msdcsc.exe 89 PID 2864 wrote to memory of 1368 2864 msdcsc.exe 89 PID 2864 wrote to memory of 1368 2864 msdcsc.exe 89 PID 2864 wrote to memory of 1368 2864 msdcsc.exe 89 PID 2864 wrote to memory of 1368 2864 msdcsc.exe 89 PID 2864 wrote to memory of 1368 2864 msdcsc.exe 89 PID 2864 wrote to memory of 1368 2864 msdcsc.exe 89 PID 2864 wrote to memory of 1368 2864 msdcsc.exe 89 PID 2864 wrote to memory of 1368 2864 msdcsc.exe 89 PID 2864 wrote to memory of 1368 2864 msdcsc.exe 89 PID 2864 wrote to memory of 1368 2864 msdcsc.exe 89 PID 2864 wrote to memory of 1368 2864 msdcsc.exe 89 PID 2864 wrote to memory of 1368 2864 msdcsc.exe 89 PID 2864 wrote to memory of 1368 2864 msdcsc.exe 89 PID 2864 wrote to memory of 1368 2864 msdcsc.exe 89 PID 2864 wrote to memory of 1368 2864 msdcsc.exe 89 PID 2864 wrote to memory of 1368 2864 msdcsc.exe 89 PID 2864 wrote to memory of 1368 2864 msdcsc.exe 89 PID 2864 wrote to memory of 1368 2864 msdcsc.exe 89 PID 2864 wrote to memory of 1368 2864 msdcsc.exe 89
Processes
-
C:\Users\Admin\AppData\Local\Temp\9cabc52b6a9b330aa00580dc5427f8ee.exe"C:\Users\Admin\AppData\Local\Temp\9cabc52b6a9b330aa00580dc5427f8ee.exe"1⤵
- Modifies WinLogon for persistence
- Checks computer location settings
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2784 -
C:\Windows\SysWOW64\notepad.exenotepad2⤵
- Deletes itself
PID:4844
-
-
C:\Users\Admin\Documents\MSDCSC\msdcsc.exe"C:\Users\Admin\Documents\MSDCSC\msdcsc.exe"2⤵
- Modifies firewall policy service
- Disables RegEdit via registry modification
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2864 -
C:\Program Files (x86)\Internet Explorer\iexplore.exe"C:\Program Files (x86)\Internet Explorer\iexplore.exe"3⤵PID:4012
-
-
C:\Windows\explorer.exe"C:\Windows\explorer.exe"3⤵PID:5096
-
-
C:\Windows\SysWOW64\notepad.exenotepad3⤵PID:1368
-
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Create or Modify System Process
1Windows Service
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\Documents\MSDCSC\msdcsc.exe
- Size 799KB
- SHA256 6c04ef5ba2d81c95ceafe84f13bf4b2b50fc1cd63b98eedbf3df8bf080d4732b
- MD5 9cabc52b6a9b330aa00580dc5427f8ee
- SHA1 0a9580462faf6b4119b8e752d0a35771b17da5d9
- SHA512 fac36a29422cf090a417dc468a7a282276ec775ff62a022b8008617854dd86dd9712ec82e17b5af614744d9160fbb2ba272202334f3555e7958ac5753d182aaf
- SSDEEP 24576:qnAw2WWeFcfbP9VPSPMTSPL/rWvzq4JJfp2+:gELbVMTrOq4w+
- MD5 SHA1 SHA512 SSDEEP