Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
25-02-2024 21:20
Behavioral task
behavioral1
Sample
a49f8963a4c3949b06e4301caa2de435.exe
Resource
win7-20240221-en
General
-
Target
a49f8963a4c3949b06e4301caa2de435.exe
-
Size
318KB
-
MD5
a49f8963a4c3949b06e4301caa2de435
-
SHA1
2784038e702ea56c70b56d0ba2dab6dac5512746
-
SHA256
074193e6032463916cca5208b1dd4eaea758dfb41684888438e01cc7c8bf795f
-
SHA512
f3b43f49bb38c7ff98eae0657a272d1b877a76586b0226969f8c6f5063b80fcce675ad49fa727b9dd68d32b300c8472ceb3e2ca0d38c629fdd8aded948b9208d
-
SSDEEP
6144:DcNYS996KFifeVjBpeExgVTFSXFoMc5RhCaL37yJh:DcW7KEZlPzCy37E
Malware Config
Extracted
darkcomet
Sazan
127.0.0.1:1604
185.29.120.189:1604
DC_MUTEX-C85CWU2
-
InstallPath
S1\updater.exe
-
gencode
DlWfWyuahoYK
-
install
true
-
offline_keylogger
true
-
persistence
true
-
reg_key
Windows Firewall
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
Processes:
a49f8963a4c3949b06e4301caa2de435.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\S1\\updater.exe" a49f8963a4c3949b06e4301caa2de435.exe -
Disables RegEdit via registry modification 1 IoCs
Processes:
updater.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" updater.exe -
Disables Task Manager via registry modification
-
Sets file to hidden 1 TTPs 2 IoCs
Modifies file attributes to stop it showing in Explorer etc.
Processes:
attrib.exeattrib.exepid process 2960 attrib.exe 1128 attrib.exe -
Deletes itself 1 IoCs
Processes:
notepad.exepid process 1028 notepad.exe -
Executes dropped EXE 1 IoCs
Processes:
updater.exepid process 1172 updater.exe -
Loads dropped DLL 4 IoCs
Processes:
a49f8963a4c3949b06e4301caa2de435.exeupdater.exepid process 2176 a49f8963a4c3949b06e4301caa2de435.exe 1172 updater.exe 1172 updater.exe 1172 updater.exe -
Processes:
resource yara_rule behavioral1/memory/2176-0-0x0000000000400000-0x00000000004D8000-memory.dmp upx behavioral1/memory/2176-10-0x0000000000400000-0x00000000004D8000-memory.dmp upx \ProgramData\Microsoft\Windows\Start Menu\S1\updater.exe upx behavioral1/memory/2176-38-0x0000000000400000-0x00000000004D8000-memory.dmp upx behavioral1/memory/1172-44-0x0000000000400000-0x00000000004D8000-memory.dmp upx behavioral1/memory/1172-91-0x0000000000400000-0x00000000004D8000-memory.dmp upx -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
a49f8963a4c3949b06e4301caa2de435.exeupdater.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Windows\CurrentVersion\Run\Windows Firewall = "C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\S1\\updater.exe" a49f8963a4c3949b06e4301caa2de435.exe Set value (str) \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Windows\CurrentVersion\Run\Windows Firewall = "C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\S1\\updater.exe" updater.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of AdjustPrivilegeToken 46 IoCs
Processes:
a49f8963a4c3949b06e4301caa2de435.exeupdater.exedescription pid process Token: SeIncreaseQuotaPrivilege 2176 a49f8963a4c3949b06e4301caa2de435.exe Token: SeSecurityPrivilege 2176 a49f8963a4c3949b06e4301caa2de435.exe Token: SeTakeOwnershipPrivilege 2176 a49f8963a4c3949b06e4301caa2de435.exe Token: SeLoadDriverPrivilege 2176 a49f8963a4c3949b06e4301caa2de435.exe Token: SeSystemProfilePrivilege 2176 a49f8963a4c3949b06e4301caa2de435.exe Token: SeSystemtimePrivilege 2176 a49f8963a4c3949b06e4301caa2de435.exe Token: SeProfSingleProcessPrivilege 2176 a49f8963a4c3949b06e4301caa2de435.exe Token: SeIncBasePriorityPrivilege 2176 a49f8963a4c3949b06e4301caa2de435.exe Token: SeCreatePagefilePrivilege 2176 a49f8963a4c3949b06e4301caa2de435.exe Token: SeBackupPrivilege 2176 a49f8963a4c3949b06e4301caa2de435.exe Token: SeRestorePrivilege 2176 a49f8963a4c3949b06e4301caa2de435.exe Token: SeShutdownPrivilege 2176 a49f8963a4c3949b06e4301caa2de435.exe Token: SeDebugPrivilege 2176 a49f8963a4c3949b06e4301caa2de435.exe Token: SeSystemEnvironmentPrivilege 2176 a49f8963a4c3949b06e4301caa2de435.exe Token: SeChangeNotifyPrivilege 2176 a49f8963a4c3949b06e4301caa2de435.exe Token: SeRemoteShutdownPrivilege 2176 a49f8963a4c3949b06e4301caa2de435.exe Token: SeUndockPrivilege 2176 a49f8963a4c3949b06e4301caa2de435.exe Token: SeManageVolumePrivilege 2176 a49f8963a4c3949b06e4301caa2de435.exe Token: SeImpersonatePrivilege 2176 a49f8963a4c3949b06e4301caa2de435.exe Token: SeCreateGlobalPrivilege 2176 a49f8963a4c3949b06e4301caa2de435.exe Token: 33 2176 a49f8963a4c3949b06e4301caa2de435.exe Token: 34 2176 a49f8963a4c3949b06e4301caa2de435.exe Token: 35 2176 a49f8963a4c3949b06e4301caa2de435.exe Token: SeIncreaseQuotaPrivilege 1172 updater.exe Token: SeSecurityPrivilege 1172 updater.exe Token: SeTakeOwnershipPrivilege 1172 updater.exe Token: SeLoadDriverPrivilege 1172 updater.exe Token: SeSystemProfilePrivilege 1172 updater.exe Token: SeSystemtimePrivilege 1172 updater.exe Token: SeProfSingleProcessPrivilege 1172 updater.exe Token: SeIncBasePriorityPrivilege 1172 updater.exe Token: SeCreatePagefilePrivilege 1172 updater.exe Token: SeBackupPrivilege 1172 updater.exe Token: SeRestorePrivilege 1172 updater.exe Token: SeShutdownPrivilege 1172 updater.exe Token: SeDebugPrivilege 1172 updater.exe Token: SeSystemEnvironmentPrivilege 1172 updater.exe Token: SeChangeNotifyPrivilege 1172 updater.exe Token: SeRemoteShutdownPrivilege 1172 updater.exe Token: SeUndockPrivilege 1172 updater.exe Token: SeManageVolumePrivilege 1172 updater.exe Token: SeImpersonatePrivilege 1172 updater.exe Token: SeCreateGlobalPrivilege 1172 updater.exe Token: 33 1172 updater.exe Token: 34 1172 updater.exe Token: 35 1172 updater.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
updater.exepid process 1172 updater.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
a49f8963a4c3949b06e4301caa2de435.execmd.execmd.exeupdater.exedescription pid process target process PID 2176 wrote to memory of 2860 2176 a49f8963a4c3949b06e4301caa2de435.exe cmd.exe PID 2176 wrote to memory of 2860 2176 a49f8963a4c3949b06e4301caa2de435.exe cmd.exe PID 2176 wrote to memory of 2860 2176 a49f8963a4c3949b06e4301caa2de435.exe cmd.exe PID 2176 wrote to memory of 2860 2176 a49f8963a4c3949b06e4301caa2de435.exe cmd.exe PID 2176 wrote to memory of 2944 2176 a49f8963a4c3949b06e4301caa2de435.exe cmd.exe PID 2176 wrote to memory of 2944 2176 a49f8963a4c3949b06e4301caa2de435.exe cmd.exe PID 2176 wrote to memory of 2944 2176 a49f8963a4c3949b06e4301caa2de435.exe cmd.exe PID 2176 wrote to memory of 2944 2176 a49f8963a4c3949b06e4301caa2de435.exe cmd.exe PID 2176 wrote to memory of 1028 2176 a49f8963a4c3949b06e4301caa2de435.exe notepad.exe PID 2176 wrote to memory of 1028 2176 a49f8963a4c3949b06e4301caa2de435.exe notepad.exe PID 2176 wrote to memory of 1028 2176 a49f8963a4c3949b06e4301caa2de435.exe notepad.exe PID 2176 wrote to memory of 1028 2176 a49f8963a4c3949b06e4301caa2de435.exe notepad.exe PID 2176 wrote to memory of 1028 2176 a49f8963a4c3949b06e4301caa2de435.exe notepad.exe PID 2944 wrote to memory of 1128 2944 cmd.exe attrib.exe PID 2944 wrote to memory of 1128 2944 cmd.exe attrib.exe PID 2944 wrote to memory of 1128 2944 cmd.exe attrib.exe PID 2944 wrote to memory of 1128 2944 cmd.exe attrib.exe PID 2860 wrote to memory of 2960 2860 cmd.exe attrib.exe PID 2860 wrote to memory of 2960 2860 cmd.exe attrib.exe PID 2860 wrote to memory of 2960 2860 cmd.exe attrib.exe PID 2860 wrote to memory of 2960 2860 cmd.exe attrib.exe PID 2176 wrote to memory of 1028 2176 a49f8963a4c3949b06e4301caa2de435.exe notepad.exe PID 2176 wrote to memory of 1028 2176 a49f8963a4c3949b06e4301caa2de435.exe notepad.exe PID 2176 wrote to memory of 1028 2176 a49f8963a4c3949b06e4301caa2de435.exe notepad.exe PID 2176 wrote to memory of 1028 2176 a49f8963a4c3949b06e4301caa2de435.exe notepad.exe PID 2176 wrote to memory of 1028 2176 a49f8963a4c3949b06e4301caa2de435.exe notepad.exe PID 2176 wrote to memory of 1028 2176 a49f8963a4c3949b06e4301caa2de435.exe notepad.exe PID 2176 wrote to memory of 1028 2176 a49f8963a4c3949b06e4301caa2de435.exe notepad.exe PID 2176 wrote to memory of 1028 2176 a49f8963a4c3949b06e4301caa2de435.exe notepad.exe PID 2176 wrote to memory of 1028 2176 a49f8963a4c3949b06e4301caa2de435.exe notepad.exe PID 2176 wrote to memory of 1028 2176 a49f8963a4c3949b06e4301caa2de435.exe notepad.exe PID 2176 wrote to memory of 1028 2176 a49f8963a4c3949b06e4301caa2de435.exe notepad.exe PID 2176 wrote to memory of 1028 2176 a49f8963a4c3949b06e4301caa2de435.exe notepad.exe PID 2176 wrote to memory of 1028 2176 a49f8963a4c3949b06e4301caa2de435.exe notepad.exe PID 2176 wrote to memory of 1172 2176 a49f8963a4c3949b06e4301caa2de435.exe updater.exe PID 2176 wrote to memory of 1172 2176 a49f8963a4c3949b06e4301caa2de435.exe updater.exe PID 2176 wrote to memory of 1172 2176 a49f8963a4c3949b06e4301caa2de435.exe updater.exe PID 2176 wrote to memory of 1172 2176 a49f8963a4c3949b06e4301caa2de435.exe updater.exe PID 2176 wrote to memory of 1172 2176 a49f8963a4c3949b06e4301caa2de435.exe updater.exe PID 2176 wrote to memory of 1172 2176 a49f8963a4c3949b06e4301caa2de435.exe updater.exe PID 2176 wrote to memory of 1172 2176 a49f8963a4c3949b06e4301caa2de435.exe updater.exe PID 1172 wrote to memory of 2692 1172 updater.exe notepad.exe PID 1172 wrote to memory of 2692 1172 updater.exe notepad.exe PID 1172 wrote to memory of 2692 1172 updater.exe notepad.exe PID 1172 wrote to memory of 2692 1172 updater.exe notepad.exe PID 1172 wrote to memory of 2692 1172 updater.exe notepad.exe PID 1172 wrote to memory of 2692 1172 updater.exe notepad.exe PID 1172 wrote to memory of 2692 1172 updater.exe notepad.exe PID 1172 wrote to memory of 2692 1172 updater.exe notepad.exe PID 1172 wrote to memory of 2692 1172 updater.exe notepad.exe PID 1172 wrote to memory of 2692 1172 updater.exe notepad.exe PID 1172 wrote to memory of 2692 1172 updater.exe notepad.exe PID 1172 wrote to memory of 2692 1172 updater.exe notepad.exe PID 1172 wrote to memory of 2692 1172 updater.exe notepad.exe PID 1172 wrote to memory of 2692 1172 updater.exe notepad.exe PID 1172 wrote to memory of 2692 1172 updater.exe notepad.exe PID 1172 wrote to memory of 2692 1172 updater.exe notepad.exe PID 1172 wrote to memory of 2692 1172 updater.exe notepad.exe PID 1172 wrote to memory of 2692 1172 updater.exe notepad.exe PID 1172 wrote to memory of 2692 1172 updater.exe notepad.exe PID 1172 wrote to memory of 2692 1172 updater.exe notepad.exe PID 1172 wrote to memory of 2692 1172 updater.exe notepad.exe PID 1172 wrote to memory of 2692 1172 updater.exe notepad.exe PID 1172 wrote to memory of 2692 1172 updater.exe notepad.exe -
Views/modifies file attributes 1 TTPs 2 IoCs
Processes:
attrib.exeattrib.exepid process 2960 attrib.exe 1128 attrib.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\a49f8963a4c3949b06e4301caa2de435.exe"C:\Users\Admin\AppData\Local\Temp\a49f8963a4c3949b06e4301caa2de435.exe"1⤵
- Modifies WinLogon for persistence
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp\a49f8963a4c3949b06e4301caa2de435.exe" +s +h2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Users\Admin\AppData\Local\Temp\a49f8963a4c3949b06e4301caa2de435.exe" +s +h3⤵
- Sets file to hidden
- Views/modifies file attributes
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp" +s +h2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Users\Admin\AppData\Local\Temp" +s +h3⤵
- Sets file to hidden
- Views/modifies file attributes
-
C:\Windows\SysWOW64\notepad.exenotepad2⤵
- Deletes itself
-
C:\ProgramData\Microsoft\Windows\Start Menu\S1\updater.exe"C:\ProgramData\Microsoft\Windows\Start Menu\S1\updater.exe"2⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\notepad.exenotepad3⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Replay Monitor
Loading Replay Monitor...
Downloads
-
\ProgramData\Microsoft\Windows\Start Menu\S1\updater.exeFilesize
318KB
MD5a49f8963a4c3949b06e4301caa2de435
SHA12784038e702ea56c70b56d0ba2dab6dac5512746
SHA256074193e6032463916cca5208b1dd4eaea758dfb41684888438e01cc7c8bf795f
SHA512f3b43f49bb38c7ff98eae0657a272d1b877a76586b0226969f8c6f5063b80fcce675ad49fa727b9dd68d32b300c8472ceb3e2ca0d38c629fdd8aded948b9208d
-
memory/1028-4-0x0000000000080000-0x0000000000081000-memory.dmpFilesize
4KB
-
memory/1028-37-0x00000000002F0000-0x00000000002F1000-memory.dmpFilesize
4KB
-
memory/1172-44-0x0000000000400000-0x00000000004D8000-memory.dmpFilesize
864KB
-
memory/1172-49-0x0000000000940000-0x0000000000A18000-memory.dmpFilesize
864KB
-
memory/1172-91-0x0000000000400000-0x00000000004D8000-memory.dmpFilesize
864KB
-
memory/2176-0-0x0000000000400000-0x00000000004D8000-memory.dmpFilesize
864KB
-
memory/2176-1-0x0000000000240000-0x0000000000241000-memory.dmpFilesize
4KB
-
memory/2176-10-0x0000000000400000-0x00000000004D8000-memory.dmpFilesize
864KB
-
memory/2176-12-0x0000000000240000-0x0000000000241000-memory.dmpFilesize
4KB
-
memory/2176-38-0x0000000000400000-0x00000000004D8000-memory.dmpFilesize
864KB