Analysis
-
max time kernel
150s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
16-02-2024 07:27
Static task
static1
Behavioral task
behavioral1
Sample
9fc730001f0b9de1015cb0544c3cc775.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
9fc730001f0b9de1015cb0544c3cc775.exe
Resource
win10v2004-20231215-en
General
-
Target
9fc730001f0b9de1015cb0544c3cc775.exe
-
Size
1.2MB
-
MD5
9fc730001f0b9de1015cb0544c3cc775
-
SHA1
180cafcff5843da1bb4e6b898007352bd8f7422a
-
SHA256
25e21ed65dbb774bf9ba33bc6ed82ada407e2e47d9333bf983aadcef5ae6828a
-
SHA512
89e0b6fb131af80a313fc6c4ef61e937b46173b75f868f1110cf8b3724b9503c62c205c5a2509edae0ada6cfc6a56e6d078ca8c4f1d20e3f6b680be4b3377302
-
SSDEEP
24576:RmJuqft9oiO8jrzI1LmpqoTYo7IOUAF7/cfg/c10tcT4QqiBmxf0:RmleejUm4Lsxc
Malware Config
Extracted
darkcomet
Guest16
alrdmh1.no-ip.info:1604
DC_MUTEX-T32EFR2
-
InstallPath
MSDCSC\ssms.exe
-
gencode
d3jVJWfh6uR6
-
install
true
-
offline_keylogger
true
-
persistence
true
-
reg_key
MicroUpdate
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
Processes:
9fc730001f0b9de1015cb0544c3cc775.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Users\\Admin\\Documents\\MSDCSC\\ssms.exe" 9fc730001f0b9de1015cb0544c3cc775.exe -
Executes dropped EXE 2 IoCs
Processes:
ssms.exessms.exepid process 2812 ssms.exe 2640 ssms.exe -
Loads dropped DLL 2 IoCs
Processes:
9fc730001f0b9de1015cb0544c3cc775.exepid process 2316 9fc730001f0b9de1015cb0544c3cc775.exe 2316 9fc730001f0b9de1015cb0544c3cc775.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
9fc730001f0b9de1015cb0544c3cc775.exessms.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Users\\Admin\\Documents\\MSDCSC\\ssms.exe" 9fc730001f0b9de1015cb0544c3cc775.exe Set value (str) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Users\\Admin\\Documents\\MSDCSC\\ssms.exe" ssms.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
9fc730001f0b9de1015cb0544c3cc775.exessms.exedescription pid process target process PID 2296 set thread context of 2316 2296 9fc730001f0b9de1015cb0544c3cc775.exe 9fc730001f0b9de1015cb0544c3cc775.exe PID 2812 set thread context of 2640 2812 ssms.exe ssms.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
ssms.exepid process 2640 ssms.exe -
Suspicious use of AdjustPrivilegeToken 46 IoCs
Processes:
9fc730001f0b9de1015cb0544c3cc775.exessms.exedescription pid process Token: SeIncreaseQuotaPrivilege 2316 9fc730001f0b9de1015cb0544c3cc775.exe Token: SeSecurityPrivilege 2316 9fc730001f0b9de1015cb0544c3cc775.exe Token: SeTakeOwnershipPrivilege 2316 9fc730001f0b9de1015cb0544c3cc775.exe Token: SeLoadDriverPrivilege 2316 9fc730001f0b9de1015cb0544c3cc775.exe Token: SeSystemProfilePrivilege 2316 9fc730001f0b9de1015cb0544c3cc775.exe Token: SeSystemtimePrivilege 2316 9fc730001f0b9de1015cb0544c3cc775.exe Token: SeProfSingleProcessPrivilege 2316 9fc730001f0b9de1015cb0544c3cc775.exe Token: SeIncBasePriorityPrivilege 2316 9fc730001f0b9de1015cb0544c3cc775.exe Token: SeCreatePagefilePrivilege 2316 9fc730001f0b9de1015cb0544c3cc775.exe Token: SeBackupPrivilege 2316 9fc730001f0b9de1015cb0544c3cc775.exe Token: SeRestorePrivilege 2316 9fc730001f0b9de1015cb0544c3cc775.exe Token: SeShutdownPrivilege 2316 9fc730001f0b9de1015cb0544c3cc775.exe Token: SeDebugPrivilege 2316 9fc730001f0b9de1015cb0544c3cc775.exe Token: SeSystemEnvironmentPrivilege 2316 9fc730001f0b9de1015cb0544c3cc775.exe Token: SeChangeNotifyPrivilege 2316 9fc730001f0b9de1015cb0544c3cc775.exe Token: SeRemoteShutdownPrivilege 2316 9fc730001f0b9de1015cb0544c3cc775.exe Token: SeUndockPrivilege 2316 9fc730001f0b9de1015cb0544c3cc775.exe Token: SeManageVolumePrivilege 2316 9fc730001f0b9de1015cb0544c3cc775.exe Token: SeImpersonatePrivilege 2316 9fc730001f0b9de1015cb0544c3cc775.exe Token: SeCreateGlobalPrivilege 2316 9fc730001f0b9de1015cb0544c3cc775.exe Token: 33 2316 9fc730001f0b9de1015cb0544c3cc775.exe Token: 34 2316 9fc730001f0b9de1015cb0544c3cc775.exe Token: 35 2316 9fc730001f0b9de1015cb0544c3cc775.exe Token: SeIncreaseQuotaPrivilege 2640 ssms.exe Token: SeSecurityPrivilege 2640 ssms.exe Token: SeTakeOwnershipPrivilege 2640 ssms.exe Token: SeLoadDriverPrivilege 2640 ssms.exe Token: SeSystemProfilePrivilege 2640 ssms.exe Token: SeSystemtimePrivilege 2640 ssms.exe Token: SeProfSingleProcessPrivilege 2640 ssms.exe Token: SeIncBasePriorityPrivilege 2640 ssms.exe Token: SeCreatePagefilePrivilege 2640 ssms.exe Token: SeBackupPrivilege 2640 ssms.exe Token: SeRestorePrivilege 2640 ssms.exe Token: SeShutdownPrivilege 2640 ssms.exe Token: SeDebugPrivilege 2640 ssms.exe Token: SeSystemEnvironmentPrivilege 2640 ssms.exe Token: SeChangeNotifyPrivilege 2640 ssms.exe Token: SeRemoteShutdownPrivilege 2640 ssms.exe Token: SeUndockPrivilege 2640 ssms.exe Token: SeManageVolumePrivilege 2640 ssms.exe Token: SeImpersonatePrivilege 2640 ssms.exe Token: SeCreateGlobalPrivilege 2640 ssms.exe Token: 33 2640 ssms.exe Token: 34 2640 ssms.exe Token: 35 2640 ssms.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
ssms.exepid process 2640 ssms.exe -
Suspicious use of WriteProcessMemory 30 IoCs
Processes:
9fc730001f0b9de1015cb0544c3cc775.exe9fc730001f0b9de1015cb0544c3cc775.exessms.exedescription pid process target process PID 2296 wrote to memory of 2316 2296 9fc730001f0b9de1015cb0544c3cc775.exe 9fc730001f0b9de1015cb0544c3cc775.exe PID 2296 wrote to memory of 2316 2296 9fc730001f0b9de1015cb0544c3cc775.exe 9fc730001f0b9de1015cb0544c3cc775.exe PID 2296 wrote to memory of 2316 2296 9fc730001f0b9de1015cb0544c3cc775.exe 9fc730001f0b9de1015cb0544c3cc775.exe PID 2296 wrote to memory of 2316 2296 9fc730001f0b9de1015cb0544c3cc775.exe 9fc730001f0b9de1015cb0544c3cc775.exe PID 2296 wrote to memory of 2316 2296 9fc730001f0b9de1015cb0544c3cc775.exe 9fc730001f0b9de1015cb0544c3cc775.exe PID 2296 wrote to memory of 2316 2296 9fc730001f0b9de1015cb0544c3cc775.exe 9fc730001f0b9de1015cb0544c3cc775.exe PID 2296 wrote to memory of 2316 2296 9fc730001f0b9de1015cb0544c3cc775.exe 9fc730001f0b9de1015cb0544c3cc775.exe PID 2296 wrote to memory of 2316 2296 9fc730001f0b9de1015cb0544c3cc775.exe 9fc730001f0b9de1015cb0544c3cc775.exe PID 2296 wrote to memory of 2316 2296 9fc730001f0b9de1015cb0544c3cc775.exe 9fc730001f0b9de1015cb0544c3cc775.exe PID 2296 wrote to memory of 2316 2296 9fc730001f0b9de1015cb0544c3cc775.exe 9fc730001f0b9de1015cb0544c3cc775.exe PID 2296 wrote to memory of 2316 2296 9fc730001f0b9de1015cb0544c3cc775.exe 9fc730001f0b9de1015cb0544c3cc775.exe PID 2296 wrote to memory of 2316 2296 9fc730001f0b9de1015cb0544c3cc775.exe 9fc730001f0b9de1015cb0544c3cc775.exe PID 2296 wrote to memory of 2316 2296 9fc730001f0b9de1015cb0544c3cc775.exe 9fc730001f0b9de1015cb0544c3cc775.exe PID 2316 wrote to memory of 2812 2316 9fc730001f0b9de1015cb0544c3cc775.exe ssms.exe PID 2316 wrote to memory of 2812 2316 9fc730001f0b9de1015cb0544c3cc775.exe ssms.exe PID 2316 wrote to memory of 2812 2316 9fc730001f0b9de1015cb0544c3cc775.exe ssms.exe PID 2316 wrote to memory of 2812 2316 9fc730001f0b9de1015cb0544c3cc775.exe ssms.exe PID 2812 wrote to memory of 2640 2812 ssms.exe ssms.exe PID 2812 wrote to memory of 2640 2812 ssms.exe ssms.exe PID 2812 wrote to memory of 2640 2812 ssms.exe ssms.exe PID 2812 wrote to memory of 2640 2812 ssms.exe ssms.exe PID 2812 wrote to memory of 2640 2812 ssms.exe ssms.exe PID 2812 wrote to memory of 2640 2812 ssms.exe ssms.exe PID 2812 wrote to memory of 2640 2812 ssms.exe ssms.exe PID 2812 wrote to memory of 2640 2812 ssms.exe ssms.exe PID 2812 wrote to memory of 2640 2812 ssms.exe ssms.exe PID 2812 wrote to memory of 2640 2812 ssms.exe ssms.exe PID 2812 wrote to memory of 2640 2812 ssms.exe ssms.exe PID 2812 wrote to memory of 2640 2812 ssms.exe ssms.exe PID 2812 wrote to memory of 2640 2812 ssms.exe ssms.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\9fc730001f0b9de1015cb0544c3cc775.exe"C:\Users\Admin\AppData\Local\Temp\9fc730001f0b9de1015cb0544c3cc775.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\9fc730001f0b9de1015cb0544c3cc775.exeC:\Users\Admin\AppData\Local\Temp\9fc730001f0b9de1015cb0544c3cc775.exe2⤵
- Modifies WinLogon for persistence
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\Documents\MSDCSC\ssms.exe"C:\Users\Admin\Documents\MSDCSC\ssms.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\Documents\MSDCSC\ssms.exeC:\Users\Admin\Documents\MSDCSC\ssms.exe4⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\Documents\MSDCSC\ssms.exeFilesize
1.2MB
MD59fc730001f0b9de1015cb0544c3cc775
SHA1180cafcff5843da1bb4e6b898007352bd8f7422a
SHA25625e21ed65dbb774bf9ba33bc6ed82ada407e2e47d9333bf983aadcef5ae6828a
SHA51289e0b6fb131af80a313fc6c4ef61e937b46173b75f868f1110cf8b3724b9503c62c205c5a2509edae0ada6cfc6a56e6d078ca8c4f1d20e3f6b680be4b3377302
-
memory/2296-30-0x0000000000400000-0x000000000053B000-memory.dmpFilesize
1.2MB
-
memory/2296-0-0x00000000001B0000-0x00000000001B1000-memory.dmpFilesize
4KB
-
memory/2316-8-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/2316-29-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/2316-5-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/2316-15-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/2316-19-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/2316-22-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/2316-26-0x000000007EFDE000-0x000000007EFDF000-memory.dmpFilesize
4KB
-
memory/2316-44-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/2316-25-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/2316-31-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/2316-32-0x0000000000280000-0x0000000000281000-memory.dmpFilesize
4KB
-
memory/2316-11-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/2316-1-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/2316-3-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/2640-79-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/2640-77-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/2640-78-0x0000000000260000-0x0000000000261000-memory.dmpFilesize
4KB
-
memory/2812-75-0x0000000000400000-0x000000000053B000-memory.dmpFilesize
1.2MB
-
memory/2812-43-0x0000000000220000-0x0000000000221000-memory.dmpFilesize
4KB