Analysis
-
max time kernel
154s -
max time network
157s -
platform
windows10-2004_x64 -
resource
win10v2004-20240221-en -
resource tags
arch:x64arch:x86image:win10v2004-20240221-enlocale:en-usos:windows10-2004-x64system -
submitted
25-02-2024 21:20
Behavioral task
behavioral1
Sample
a49f8963a4c3949b06e4301caa2de435.exe
Resource
win7-20240221-en
General
-
Target
a49f8963a4c3949b06e4301caa2de435.exe
-
Size
318KB
-
MD5
a49f8963a4c3949b06e4301caa2de435
-
SHA1
2784038e702ea56c70b56d0ba2dab6dac5512746
-
SHA256
074193e6032463916cca5208b1dd4eaea758dfb41684888438e01cc7c8bf795f
-
SHA512
f3b43f49bb38c7ff98eae0657a272d1b877a76586b0226969f8c6f5063b80fcce675ad49fa727b9dd68d32b300c8472ceb3e2ca0d38c629fdd8aded948b9208d
-
SSDEEP
6144:DcNYS996KFifeVjBpeExgVTFSXFoMc5RhCaL37yJh:DcW7KEZlPzCy37E
Malware Config
Extracted
darkcomet
Sazan
127.0.0.1:1604
185.29.120.189:1604
DC_MUTEX-C85CWU2
-
InstallPath
S1\updater.exe
-
gencode
DlWfWyuahoYK
-
install
true
-
offline_keylogger
true
-
persistence
true
-
reg_key
Windows Firewall
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
Processes:
a49f8963a4c3949b06e4301caa2de435.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\S1\\updater.exe" a49f8963a4c3949b06e4301caa2de435.exe -
Disables RegEdit via registry modification 1 IoCs
Processes:
updater.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-3844919115-497234255-166257750-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" updater.exe -
Disables Task Manager via registry modification
-
Sets file to hidden 1 TTPs 2 IoCs
Modifies file attributes to stop it showing in Explorer etc.
Processes:
attrib.exeattrib.exepid process 4924 attrib.exe 1888 attrib.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
a49f8963a4c3949b06e4301caa2de435.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-3844919115-497234255-166257750-1000\Control Panel\International\Geo\Nation a49f8963a4c3949b06e4301caa2de435.exe -
Deletes itself 1 IoCs
Processes:
notepad.exepid process 3328 notepad.exe -
Executes dropped EXE 1 IoCs
Processes:
updater.exepid process 3120 updater.exe -
Processes:
resource yara_rule behavioral2/memory/1540-0-0x0000000000400000-0x00000000004D8000-memory.dmp upx behavioral2/memory/1540-4-0x0000000000400000-0x00000000004D8000-memory.dmp upx C:\ProgramData\Microsoft\Windows\Start Menu\S1\updater.exe upx behavioral2/memory/3120-15-0x0000000000400000-0x00000000004D8000-memory.dmp upx behavioral2/memory/1540-19-0x0000000000400000-0x00000000004D8000-memory.dmp upx behavioral2/memory/3120-21-0x0000000000400000-0x00000000004D8000-memory.dmp upx behavioral2/memory/3120-22-0x0000000000400000-0x00000000004D8000-memory.dmp upx behavioral2/memory/3120-23-0x0000000000400000-0x00000000004D8000-memory.dmp upx behavioral2/memory/3120-25-0x0000000000400000-0x00000000004D8000-memory.dmp upx behavioral2/memory/3120-27-0x0000000000400000-0x00000000004D8000-memory.dmp upx behavioral2/memory/3120-28-0x0000000000400000-0x00000000004D8000-memory.dmp upx behavioral2/memory/3120-30-0x0000000000400000-0x00000000004D8000-memory.dmp upx behavioral2/memory/3120-32-0x0000000000400000-0x00000000004D8000-memory.dmp upx -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
updater.exea49f8963a4c3949b06e4301caa2de435.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3844919115-497234255-166257750-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Windows Firewall = "C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\S1\\updater.exe" updater.exe Set value (str) \REGISTRY\USER\S-1-5-21-3844919115-497234255-166257750-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Windows Firewall = "C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\S1\\updater.exe" a49f8963a4c3949b06e4301caa2de435.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of AdjustPrivilegeToken 48 IoCs
Processes:
a49f8963a4c3949b06e4301caa2de435.exeupdater.exedescription pid process Token: SeIncreaseQuotaPrivilege 1540 a49f8963a4c3949b06e4301caa2de435.exe Token: SeSecurityPrivilege 1540 a49f8963a4c3949b06e4301caa2de435.exe Token: SeTakeOwnershipPrivilege 1540 a49f8963a4c3949b06e4301caa2de435.exe Token: SeLoadDriverPrivilege 1540 a49f8963a4c3949b06e4301caa2de435.exe Token: SeSystemProfilePrivilege 1540 a49f8963a4c3949b06e4301caa2de435.exe Token: SeSystemtimePrivilege 1540 a49f8963a4c3949b06e4301caa2de435.exe Token: SeProfSingleProcessPrivilege 1540 a49f8963a4c3949b06e4301caa2de435.exe Token: SeIncBasePriorityPrivilege 1540 a49f8963a4c3949b06e4301caa2de435.exe Token: SeCreatePagefilePrivilege 1540 a49f8963a4c3949b06e4301caa2de435.exe Token: SeBackupPrivilege 1540 a49f8963a4c3949b06e4301caa2de435.exe Token: SeRestorePrivilege 1540 a49f8963a4c3949b06e4301caa2de435.exe Token: SeShutdownPrivilege 1540 a49f8963a4c3949b06e4301caa2de435.exe Token: SeDebugPrivilege 1540 a49f8963a4c3949b06e4301caa2de435.exe Token: SeSystemEnvironmentPrivilege 1540 a49f8963a4c3949b06e4301caa2de435.exe Token: SeChangeNotifyPrivilege 1540 a49f8963a4c3949b06e4301caa2de435.exe Token: SeRemoteShutdownPrivilege 1540 a49f8963a4c3949b06e4301caa2de435.exe Token: SeUndockPrivilege 1540 a49f8963a4c3949b06e4301caa2de435.exe Token: SeManageVolumePrivilege 1540 a49f8963a4c3949b06e4301caa2de435.exe Token: SeImpersonatePrivilege 1540 a49f8963a4c3949b06e4301caa2de435.exe Token: SeCreateGlobalPrivilege 1540 a49f8963a4c3949b06e4301caa2de435.exe Token: 33 1540 a49f8963a4c3949b06e4301caa2de435.exe Token: 34 1540 a49f8963a4c3949b06e4301caa2de435.exe Token: 35 1540 a49f8963a4c3949b06e4301caa2de435.exe Token: 36 1540 a49f8963a4c3949b06e4301caa2de435.exe Token: SeIncreaseQuotaPrivilege 3120 updater.exe Token: SeSecurityPrivilege 3120 updater.exe Token: SeTakeOwnershipPrivilege 3120 updater.exe Token: SeLoadDriverPrivilege 3120 updater.exe Token: SeSystemProfilePrivilege 3120 updater.exe Token: SeSystemtimePrivilege 3120 updater.exe Token: SeProfSingleProcessPrivilege 3120 updater.exe Token: SeIncBasePriorityPrivilege 3120 updater.exe Token: SeCreatePagefilePrivilege 3120 updater.exe Token: SeBackupPrivilege 3120 updater.exe Token: SeRestorePrivilege 3120 updater.exe Token: SeShutdownPrivilege 3120 updater.exe Token: SeDebugPrivilege 3120 updater.exe Token: SeSystemEnvironmentPrivilege 3120 updater.exe Token: SeChangeNotifyPrivilege 3120 updater.exe Token: SeRemoteShutdownPrivilege 3120 updater.exe Token: SeUndockPrivilege 3120 updater.exe Token: SeManageVolumePrivilege 3120 updater.exe Token: SeImpersonatePrivilege 3120 updater.exe Token: SeCreateGlobalPrivilege 3120 updater.exe Token: 33 3120 updater.exe Token: 34 3120 updater.exe Token: 35 3120 updater.exe Token: 36 3120 updater.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
updater.exepid process 3120 updater.exe -
Suspicious use of WriteProcessMemory 54 IoCs
Processes:
a49f8963a4c3949b06e4301caa2de435.execmd.execmd.exeupdater.exedescription pid process target process PID 1540 wrote to memory of 3748 1540 a49f8963a4c3949b06e4301caa2de435.exe cmd.exe PID 1540 wrote to memory of 3748 1540 a49f8963a4c3949b06e4301caa2de435.exe cmd.exe PID 1540 wrote to memory of 3748 1540 a49f8963a4c3949b06e4301caa2de435.exe cmd.exe PID 1540 wrote to memory of 1896 1540 a49f8963a4c3949b06e4301caa2de435.exe cmd.exe PID 1540 wrote to memory of 1896 1540 a49f8963a4c3949b06e4301caa2de435.exe cmd.exe PID 1540 wrote to memory of 1896 1540 a49f8963a4c3949b06e4301caa2de435.exe cmd.exe PID 1540 wrote to memory of 3328 1540 a49f8963a4c3949b06e4301caa2de435.exe notepad.exe PID 1540 wrote to memory of 3328 1540 a49f8963a4c3949b06e4301caa2de435.exe notepad.exe PID 1540 wrote to memory of 3328 1540 a49f8963a4c3949b06e4301caa2de435.exe notepad.exe PID 1540 wrote to memory of 3328 1540 a49f8963a4c3949b06e4301caa2de435.exe notepad.exe PID 1540 wrote to memory of 3328 1540 a49f8963a4c3949b06e4301caa2de435.exe notepad.exe PID 1540 wrote to memory of 3328 1540 a49f8963a4c3949b06e4301caa2de435.exe notepad.exe PID 1540 wrote to memory of 3328 1540 a49f8963a4c3949b06e4301caa2de435.exe notepad.exe PID 1540 wrote to memory of 3328 1540 a49f8963a4c3949b06e4301caa2de435.exe notepad.exe PID 1540 wrote to memory of 3328 1540 a49f8963a4c3949b06e4301caa2de435.exe notepad.exe PID 1540 wrote to memory of 3328 1540 a49f8963a4c3949b06e4301caa2de435.exe notepad.exe PID 1540 wrote to memory of 3328 1540 a49f8963a4c3949b06e4301caa2de435.exe notepad.exe PID 1540 wrote to memory of 3328 1540 a49f8963a4c3949b06e4301caa2de435.exe notepad.exe PID 1540 wrote to memory of 3328 1540 a49f8963a4c3949b06e4301caa2de435.exe notepad.exe PID 1540 wrote to memory of 3328 1540 a49f8963a4c3949b06e4301caa2de435.exe notepad.exe PID 1540 wrote to memory of 3328 1540 a49f8963a4c3949b06e4301caa2de435.exe notepad.exe PID 1540 wrote to memory of 3328 1540 a49f8963a4c3949b06e4301caa2de435.exe notepad.exe PID 1540 wrote to memory of 3328 1540 a49f8963a4c3949b06e4301caa2de435.exe notepad.exe PID 1540 wrote to memory of 3120 1540 a49f8963a4c3949b06e4301caa2de435.exe updater.exe PID 1540 wrote to memory of 3120 1540 a49f8963a4c3949b06e4301caa2de435.exe updater.exe PID 1540 wrote to memory of 3120 1540 a49f8963a4c3949b06e4301caa2de435.exe updater.exe PID 3748 wrote to memory of 4924 3748 cmd.exe attrib.exe PID 3748 wrote to memory of 4924 3748 cmd.exe attrib.exe PID 3748 wrote to memory of 4924 3748 cmd.exe attrib.exe PID 1896 wrote to memory of 1888 1896 cmd.exe attrib.exe PID 1896 wrote to memory of 1888 1896 cmd.exe attrib.exe PID 1896 wrote to memory of 1888 1896 cmd.exe attrib.exe PID 3120 wrote to memory of 3792 3120 updater.exe notepad.exe PID 3120 wrote to memory of 3792 3120 updater.exe notepad.exe PID 3120 wrote to memory of 3792 3120 updater.exe notepad.exe PID 3120 wrote to memory of 3792 3120 updater.exe notepad.exe PID 3120 wrote to memory of 3792 3120 updater.exe notepad.exe PID 3120 wrote to memory of 3792 3120 updater.exe notepad.exe PID 3120 wrote to memory of 3792 3120 updater.exe notepad.exe PID 3120 wrote to memory of 3792 3120 updater.exe notepad.exe PID 3120 wrote to memory of 3792 3120 updater.exe notepad.exe PID 3120 wrote to memory of 3792 3120 updater.exe notepad.exe PID 3120 wrote to memory of 3792 3120 updater.exe notepad.exe PID 3120 wrote to memory of 3792 3120 updater.exe notepad.exe PID 3120 wrote to memory of 3792 3120 updater.exe notepad.exe PID 3120 wrote to memory of 3792 3120 updater.exe notepad.exe PID 3120 wrote to memory of 3792 3120 updater.exe notepad.exe PID 3120 wrote to memory of 3792 3120 updater.exe notepad.exe PID 3120 wrote to memory of 3792 3120 updater.exe notepad.exe PID 3120 wrote to memory of 3792 3120 updater.exe notepad.exe PID 3120 wrote to memory of 3792 3120 updater.exe notepad.exe PID 3120 wrote to memory of 3792 3120 updater.exe notepad.exe PID 3120 wrote to memory of 3792 3120 updater.exe notepad.exe PID 3120 wrote to memory of 3792 3120 updater.exe notepad.exe -
Views/modifies file attributes 1 TTPs 2 IoCs
Processes:
attrib.exeattrib.exepid process 1888 attrib.exe 4924 attrib.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\a49f8963a4c3949b06e4301caa2de435.exe"C:\Users\Admin\AppData\Local\Temp\a49f8963a4c3949b06e4301caa2de435.exe"1⤵
- Modifies WinLogon for persistence
- Checks computer location settings
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp\a49f8963a4c3949b06e4301caa2de435.exe" +s +h2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Users\Admin\AppData\Local\Temp\a49f8963a4c3949b06e4301caa2de435.exe" +s +h3⤵
- Sets file to hidden
- Views/modifies file attributes
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp" +s +h2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Users\Admin\AppData\Local\Temp" +s +h3⤵
- Sets file to hidden
- Views/modifies file attributes
-
C:\Windows\SysWOW64\notepad.exenotepad2⤵
- Deletes itself
-
C:\ProgramData\Microsoft\Windows\Start Menu\S1\updater.exe"C:\ProgramData\Microsoft\Windows\Start Menu\S1\updater.exe"2⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\notepad.exenotepad3⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ProgramData\Microsoft\Windows\Start Menu\S1\updater.exeFilesize
318KB
MD5a49f8963a4c3949b06e4301caa2de435
SHA12784038e702ea56c70b56d0ba2dab6dac5512746
SHA256074193e6032463916cca5208b1dd4eaea758dfb41684888438e01cc7c8bf795f
SHA512f3b43f49bb38c7ff98eae0657a272d1b877a76586b0226969f8c6f5063b80fcce675ad49fa727b9dd68d32b300c8472ceb3e2ca0d38c629fdd8aded948b9208d
-
memory/1540-19-0x0000000000400000-0x00000000004D8000-memory.dmpFilesize
864KB
-
memory/1540-4-0x0000000000400000-0x00000000004D8000-memory.dmpFilesize
864KB
-
memory/1540-0-0x0000000000400000-0x00000000004D8000-memory.dmpFilesize
864KB
-
memory/1540-1-0x0000000000B30000-0x0000000000B31000-memory.dmpFilesize
4KB
-
memory/3120-23-0x0000000000400000-0x00000000004D8000-memory.dmpFilesize
864KB
-
memory/3120-17-0x00000000009F0000-0x00000000009F1000-memory.dmpFilesize
4KB
-
memory/3120-21-0x0000000000400000-0x00000000004D8000-memory.dmpFilesize
864KB
-
memory/3120-15-0x0000000000400000-0x00000000004D8000-memory.dmpFilesize
864KB
-
memory/3120-22-0x0000000000400000-0x00000000004D8000-memory.dmpFilesize
864KB
-
memory/3120-25-0x0000000000400000-0x00000000004D8000-memory.dmpFilesize
864KB
-
memory/3120-27-0x0000000000400000-0x00000000004D8000-memory.dmpFilesize
864KB
-
memory/3120-28-0x0000000000400000-0x00000000004D8000-memory.dmpFilesize
864KB
-
memory/3120-30-0x0000000000400000-0x00000000004D8000-memory.dmpFilesize
864KB
-
memory/3120-32-0x0000000000400000-0x00000000004D8000-memory.dmpFilesize
864KB
-
memory/3328-5-0x0000000001360000-0x0000000001361000-memory.dmpFilesize
4KB
-
memory/3792-18-0x0000000000CA0000-0x0000000000CA1000-memory.dmpFilesize
4KB