Analysis
- max time kernel
151s - max time network
157s - platform
windows10-2004_x64 - resource
win10v2004-20240226-en - resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system - submitted
27/02/2024, 10:41
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
a8f3f22dda294b02f410ca95116a23bf.exe
Resource
win7-20240221-en
windows7-x64
18 signatures
150 seconds
General
- Target a8f3f22dda294b02f410ca95116a23bf.exe
- Size 13.7MB
- Sample240227-mrkhssfb5w
- SHA256 64f87a54df363755339567ae103af89b64be18546b14b22b93610e0080c3793d
- MD5 a8f3f22dda294b02f410ca95116a23bf
- SHA1 413062e5f6a7ec6c23cb56fbb68c8984855e8a58
- SHA512 a75fc1269444e2aff46a7901da89fd56b17120c56e4c7f89147a673e312dcc09366c9f16d3b4082f27a19a6f6aeed420c07112a5cbd04f8cd53d9792bb2ea711
- SSDEEP 24576:4RmJkcoQricOIQxiZY1iaZzCvJtvH1MTZthrK5VifNCAM2CRJOon2b5Y/gGYaHH7:9JZoQrbTFZY1iaZzCvJtvHKTG
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Extracted
Family
-
darkcomet
Botnet
-
Guest16
C2
-
onlinebonjour1pt.ddns.net:1605
Mutex
-
DC_MUTEX-XJRH105
Attributes
-
InstallPath
MSDCSC\msdcsc.exe
-
gencode
7qC8eTvgaGxs
-
install
true
-
offline_keylogger
true
-
persistence
true
-
reg_key
MicroUpdapt
Signatures
- Modifies WinLogon for persistence 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Users\\Admin\\AppData\\Local\\Temp\\MSDCSC\\msdcsc.exe" a8f3f22dda294b02f410ca95116a23bf.exe - Modifies firewall policy service 2 TTPs 3 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile msdcsc.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" msdcsc.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "0" msdcsc.exe - Modifies security service 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wscsvc\Start = "4" msdcsc.exe -
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" msdcsc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" msdcsc.exe - Disables RegEdit via registry modification 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-609813121-2907144057-1731107329-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" msdcsc.exe - Sets file to hidden 1 TTPs 2 IoCs
Modifies file attributes to stop it showing in Explorer etc.
pid Process 3260 attrib.exe 1640 attrib.exe - Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-609813121-2907144057-1731107329-1000\Control Panel\International\Geo\Nation a8f3f22dda294b02f410ca95116a23bf.exe - Executes dropped EXE 2 IoCs
pid Process 1932 msdcsc.exe 1752 msdcsc.exe -
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" msdcsc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" msdcsc.exe - Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-609813121-2907144057-1731107329-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MicroUpdapt = "C:\\Users\\Admin\\AppData\\Local\\Temp\\MSDCSC\\msdcsc.exe" a8f3f22dda294b02f410ca95116a23bf.exe Set value (str) \REGISTRY\USER\S-1-5-21-609813121-2907144057-1731107329-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MicroUpdapt = "C:\\Users\\Admin\\AppData\\Local\\Temp\\MSDCSC\\msdcsc.exe" msdcsc.exe - AutoIT Executable 3 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule behavioral2/files/0x000a0000000231ec-9.dat autoit_exe behavioral2/files/0x000a0000000231ec-63.dat autoit_exe behavioral2/files/0x000a0000000231ec-64.dat autoit_exe - Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 2324 set thread context of 1436 2324 a8f3f22dda294b02f410ca95116a23bf.exe 87 PID 1932 set thread context of 1752 1932 msdcsc.exe 97 - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ a8f3f22dda294b02f410ca95116a23bf.exe - Suspicious use of AdjustPrivilegeToken 48 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 1436 a8f3f22dda294b02f410ca95116a23bf.exe Token: SeSecurityPrivilege 1436 a8f3f22dda294b02f410ca95116a23bf.exe Token: SeTakeOwnershipPrivilege 1436 a8f3f22dda294b02f410ca95116a23bf.exe Token: SeLoadDriverPrivilege 1436 a8f3f22dda294b02f410ca95116a23bf.exe Token: SeSystemProfilePrivilege 1436 a8f3f22dda294b02f410ca95116a23bf.exe Token: SeSystemtimePrivilege 1436 a8f3f22dda294b02f410ca95116a23bf.exe Token: SeProfSingleProcessPrivilege 1436 a8f3f22dda294b02f410ca95116a23bf.exe Token: SeIncBasePriorityPrivilege 1436 a8f3f22dda294b02f410ca95116a23bf.exe Token: SeCreatePagefilePrivilege 1436 a8f3f22dda294b02f410ca95116a23bf.exe Token: SeBackupPrivilege 1436 a8f3f22dda294b02f410ca95116a23bf.exe Token: SeRestorePrivilege 1436 a8f3f22dda294b02f410ca95116a23bf.exe Token: SeShutdownPrivilege 1436 a8f3f22dda294b02f410ca95116a23bf.exe Token: SeDebugPrivilege 1436 a8f3f22dda294b02f410ca95116a23bf.exe Token: SeSystemEnvironmentPrivilege 1436 a8f3f22dda294b02f410ca95116a23bf.exe Token: SeChangeNotifyPrivilege 1436 a8f3f22dda294b02f410ca95116a23bf.exe Token: SeRemoteShutdownPrivilege 1436 a8f3f22dda294b02f410ca95116a23bf.exe Token: SeUndockPrivilege 1436 a8f3f22dda294b02f410ca95116a23bf.exe Token: SeManageVolumePrivilege 1436 a8f3f22dda294b02f410ca95116a23bf.exe Token: SeImpersonatePrivilege 1436 a8f3f22dda294b02f410ca95116a23bf.exe Token: SeCreateGlobalPrivilege 1436 a8f3f22dda294b02f410ca95116a23bf.exe Token: 33 1436 a8f3f22dda294b02f410ca95116a23bf.exe Token: 34 1436 a8f3f22dda294b02f410ca95116a23bf.exe Token: 35 1436 a8f3f22dda294b02f410ca95116a23bf.exe Token: 36 1436 a8f3f22dda294b02f410ca95116a23bf.exe Token: SeIncreaseQuotaPrivilege 1752 msdcsc.exe Token: SeSecurityPrivilege 1752 msdcsc.exe Token: SeTakeOwnershipPrivilege 1752 msdcsc.exe Token: SeLoadDriverPrivilege 1752 msdcsc.exe Token: SeSystemProfilePrivilege 1752 msdcsc.exe Token: SeSystemtimePrivilege 1752 msdcsc.exe Token: SeProfSingleProcessPrivilege 1752 msdcsc.exe Token: SeIncBasePriorityPrivilege 1752 msdcsc.exe Token: SeCreatePagefilePrivilege 1752 msdcsc.exe Token: SeBackupPrivilege 1752 msdcsc.exe Token: SeRestorePrivilege 1752 msdcsc.exe Token: SeShutdownPrivilege 1752 msdcsc.exe Token: SeDebugPrivilege 1752 msdcsc.exe Token: SeSystemEnvironmentPrivilege 1752 msdcsc.exe Token: SeChangeNotifyPrivilege 1752 msdcsc.exe Token: SeRemoteShutdownPrivilege 1752 msdcsc.exe Token: SeUndockPrivilege 1752 msdcsc.exe Token: SeManageVolumePrivilege 1752 msdcsc.exe Token: SeImpersonatePrivilege 1752 msdcsc.exe Token: SeCreateGlobalPrivilege 1752 msdcsc.exe Token: 33 1752 msdcsc.exe Token: 34 1752 msdcsc.exe Token: 35 1752 msdcsc.exe Token: 36 1752 msdcsc.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 1752 msdcsc.exe - Suspicious use of WriteProcessMemory 47 IoCs
description pid Process procid_target PID 2324 wrote to memory of 1436 2324 a8f3f22dda294b02f410ca95116a23bf.exe 87 PID 2324 wrote to memory of 1436 2324 a8f3f22dda294b02f410ca95116a23bf.exe 87 PID 2324 wrote to memory of 1436 2324 a8f3f22dda294b02f410ca95116a23bf.exe 87 PID 2324 wrote to memory of 1436 2324 a8f3f22dda294b02f410ca95116a23bf.exe 87 PID 2324 wrote to memory of 1436 2324 a8f3f22dda294b02f410ca95116a23bf.exe 87 PID 1436 wrote to memory of 3228 1436 a8f3f22dda294b02f410ca95116a23bf.exe 90 PID 1436 wrote to memory of 3228 1436 a8f3f22dda294b02f410ca95116a23bf.exe 90 PID 1436 wrote to memory of 3228 1436 a8f3f22dda294b02f410ca95116a23bf.exe 90 PID 1436 wrote to memory of 2996 1436 a8f3f22dda294b02f410ca95116a23bf.exe 91 PID 1436 wrote to memory of 2996 1436 a8f3f22dda294b02f410ca95116a23bf.exe 91 PID 1436 wrote to memory of 2996 1436 a8f3f22dda294b02f410ca95116a23bf.exe 91 PID 3228 wrote to memory of 1640 3228 cmd.exe 95 PID 3228 wrote to memory of 1640 3228 cmd.exe 95 PID 3228 wrote to memory of 1640 3228 cmd.exe 95 PID 2996 wrote to memory of 3260 2996 cmd.exe 94 PID 2996 wrote to memory of 3260 2996 cmd.exe 94 PID 2996 wrote to memory of 3260 2996 cmd.exe 94 PID 1436 wrote to memory of 1932 1436 a8f3f22dda294b02f410ca95116a23bf.exe 96 PID 1436 wrote to memory of 1932 1436 a8f3f22dda294b02f410ca95116a23bf.exe 96 PID 1436 wrote to memory of 1932 1436 a8f3f22dda294b02f410ca95116a23bf.exe 96 PID 1932 wrote to memory of 1752 1932 msdcsc.exe 97 PID 1932 wrote to memory of 1752 1932 msdcsc.exe 97 PID 1932 wrote to memory of 1752 1932 msdcsc.exe 97 PID 1932 wrote to memory of 1752 1932 msdcsc.exe 97 PID 1932 wrote to memory of 1752 1932 msdcsc.exe 97 PID 1752 wrote to memory of 3368 1752 msdcsc.exe 98 PID 1752 wrote to memory of 3368 1752 msdcsc.exe 98 PID 1752 wrote to memory of 3368 1752 msdcsc.exe 98 PID 1752 wrote to memory of 3368 1752 msdcsc.exe 98 PID 1752 wrote to memory of 3368 1752 msdcsc.exe 98 PID 1752 wrote to memory of 3368 1752 msdcsc.exe 98 PID 1752 wrote to memory of 3368 1752 msdcsc.exe 98 PID 1752 wrote to memory of 3368 1752 msdcsc.exe 98 PID 1752 wrote to memory of 3368 1752 msdcsc.exe 98 PID 1752 wrote to memory of 3368 1752 msdcsc.exe 98 PID 1752 wrote to memory of 3368 1752 msdcsc.exe 98 PID 1752 wrote to memory of 3368 1752 msdcsc.exe 98 PID 1752 wrote to memory of 3368 1752 msdcsc.exe 98 PID 1752 wrote to memory of 3368 1752 msdcsc.exe 98 PID 1752 wrote to memory of 3368 1752 msdcsc.exe 98 PID 1752 wrote to memory of 3368 1752 msdcsc.exe 98 PID 1752 wrote to memory of 3368 1752 msdcsc.exe 98 PID 1752 wrote to memory of 3368 1752 msdcsc.exe 98 PID 1752 wrote to memory of 3368 1752 msdcsc.exe 98 PID 1752 wrote to memory of 3368 1752 msdcsc.exe 98 PID 1752 wrote to memory of 3368 1752 msdcsc.exe 98 PID 1752 wrote to memory of 3368 1752 msdcsc.exe 98 - Views/modifies file attributes 1 TTPs 2 IoCs
pid Process 3260 attrib.exe 1640 attrib.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\a8f3f22dda294b02f410ca95116a23bf.exe"C:\Users\Admin\AppData\Local\Temp\a8f3f22dda294b02f410ca95116a23bf.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2324 -
C:\Users\Admin\AppData\Local\Temp\a8f3f22dda294b02f410ca95116a23bf.exe"C:\Users\Admin\AppData\Local\Temp\a8f3f22dda294b02f410ca95116a23bf.exe"2⤵
- Modifies WinLogon for persistence
- Checks computer location settings
- Adds Run key to start application
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1436 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp\a8f3f22dda294b02f410ca95116a23bf.exe" +s +h3⤵
- Suspicious use of WriteProcessMemory
PID:3228 -
C:\Windows\SysWOW64\attrib.exeattrib "C:\Users\Admin\AppData\Local\Temp\a8f3f22dda294b02f410ca95116a23bf.exe" +s +h4⤵
- Sets file to hidden
- Views/modifies file attributes
PID:1640
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp" +s +h3⤵
- Suspicious use of WriteProcessMemory
PID:2996 -
C:\Windows\SysWOW64\attrib.exeattrib "C:\Users\Admin\AppData\Local\Temp" +s +h4⤵
- Sets file to hidden
- Views/modifies file attributes
PID:3260
-
-
-
C:\Users\Admin\AppData\Local\Temp\MSDCSC\msdcsc.exe"C:\Users\Admin\AppData\Local\Temp\MSDCSC\msdcsc.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1932 -
C:\Users\Admin\AppData\Local\Temp\MSDCSC\msdcsc.exe"C:\Users\Admin\AppData\Local\Temp\MSDCSC\msdcsc.exe"4⤵
- Modifies firewall policy service
- Modifies security service
- Windows security bypass
- Disables RegEdit via registry modification
- Executes dropped EXE
- Windows security modification
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1752 -
C:\Windows\SysWOW64\notepad.exenotepad5⤵PID:3368
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Create or Modify System Process
2Windows Service
2Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Create or Modify System Process
2Windows Service
2Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\MSDCSC\msdcsc.exe
- Size 6.3MB
- SHA256 663a3c6d0c31c308a006e09eba82f90a17c41f849e9582b11c1cba9686de5703
- MD5 93e52390dddf5ad3f9842b31bba93f94
- SHA1 f46ed2e376b9c144170d65e4ada64e03ca8cfe2a
- SHA512 8fd8d8403f6a7e31008c2f8ef8c0ab1e779c5548b102de310900218ac34f8c95661053939894515d35cb37b5fad0eedc769c55250cd41f3c9357c01a8148fada
- SSDEEP 24576:4RmJkcoQricOIQxiZY1iaZzCvJtvH1MTZthrK5VifNCAM2CRJOon2b5Y/gGYaHHa:9JZoQrbTFZY1iaZzCvJtvHKT3
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\MSDCSC\msdcsc.exe
- Size 7.1MB
- SHA256 7a37c619994011d4aba2c0b88d90b8e801cd8d3aaea685445d2f7caef8ae1428
- MD5 bf5466085c04eb6d1dd1e3742f08273d
- SHA1 60cd25c011196c7a08e0206e2a9e6b722e19cd25
- SHA512 6c4e17ce2e3d3fb10f6e10e382240cd71d9a00d784ed6ea8d2fac2d6b74aa824e3f25ec9abea4d7cb7b7531ff7df83fe7250d41ab3c866364fd135e6cfc3eb16
- SSDEEP 24576:4RmJkcoQricOIQxiZY1iaZzCvJtvH1MTZthrK5VifNCAM2CRJOon2b5Y/gGYaHH+:9JZoQrbTFZY1iaZzCvJtvHKT3
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\MSDCSC\msdcsc.exe
- Size 13.7MB
- SHA256 64f87a54df363755339567ae103af89b64be18546b14b22b93610e0080c3793d
- MD5 a8f3f22dda294b02f410ca95116a23bf
- SHA1 413062e5f6a7ec6c23cb56fbb68c8984855e8a58
- SHA512 a75fc1269444e2aff46a7901da89fd56b17120c56e4c7f89147a673e312dcc09366c9f16d3b4082f27a19a6f6aeed420c07112a5cbd04f8cd53d9792bb2ea711
- SSDEEP 24576:4RmJkcoQricOIQxiZY1iaZzCvJtvH1MTZthrK5VifNCAM2CRJOon2b5Y/gGYaHH7:9JZoQrbTFZY1iaZzCvJtvHKTG
- MD5 SHA1 SHA512 SSDEEP