Analysis
-
max time kernel
395s -
max time network
446s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
09-03-2024 19:30
Behavioral task
behavioral1
Sample
NeptuneClient.exe
Resource
win10v2004-20240226-en
General
-
Target
NeptuneClient.exe
-
Size
663KB
-
MD5
2e5c6aa1fb45422ca7411a76901abad0
-
SHA1
f33e086464ff9727c61dace2d2de45ed57abbae9
-
SHA256
72a73dc938994f7426f53815af73c89a04ce96094bceeef83b4810bd3d69fef3
-
SHA512
9a2e150433c7047812b4950d3ce5e30f07a2b017b4a0f61be01fcd1eed4800b82576b38dbc641e380f21491cbfee108ca4fd89838101e3b1c2ea19255b45912f
-
SSDEEP
12288:29HFJ9rJxRX1uVVjoaWSoynxdO1FVBaOiRZTERfIhNkNCCLo9Ek5C/hy:SZ1xuVVjfFoynPaVBUR8f+kN10EBw
Malware Config
Extracted
darkcomet
Sazan
inspiring-moon-99738.pktriot.net:22710
DC_MUTEX-PVB2U01
-
InstallPath
MSDCSC\msdcsc.exe
-
gencode
glfikLGHfVF2
-
install
true
-
offline_keylogger
true
-
persistence
true
-
reg_key
MicroUpdate
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
Processes:
NeptuneClient.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Users\\Admin\\Documents\\MSDCSC\\msdcsc.exe" NeptuneClient.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
NeptuneClient.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-609813121-2907144057-1731107329-1000\Control Panel\International\Geo\Nation NeptuneClient.exe -
Executes dropped EXE 1 IoCs
Processes:
msdcsc.exepid process 4408 msdcsc.exe -
Adds Run key to start application 2 TTPs 3 IoCs
Processes:
NeptuneClient.exemsdcsc.exeiexplore.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-609813121-2907144057-1731107329-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Users\\Admin\\Documents\\MSDCSC\\msdcsc.exe" NeptuneClient.exe Set value (str) \REGISTRY\USER\S-1-5-21-609813121-2907144057-1731107329-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Users\\Admin\\Documents\\MSDCSC\\msdcsc.exe" msdcsc.exe Set value (str) \REGISTRY\USER\S-1-5-21-609813121-2907144057-1731107329-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Users\\Admin\\Documents\\MSDCSC\\msdcsc.exe" iexplore.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
msdcsc.exedescription pid process target process PID 4408 set thread context of 184 4408 msdcsc.exe iexplore.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 1 IoCs
Processes:
NeptuneClient.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ NeptuneClient.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
NeptuneClient.exemsdcsc.exeiexplore.exedescription pid process Token: SeIncreaseQuotaPrivilege 4428 NeptuneClient.exe Token: SeSecurityPrivilege 4428 NeptuneClient.exe Token: SeTakeOwnershipPrivilege 4428 NeptuneClient.exe Token: SeLoadDriverPrivilege 4428 NeptuneClient.exe Token: SeSystemProfilePrivilege 4428 NeptuneClient.exe Token: SeSystemtimePrivilege 4428 NeptuneClient.exe Token: SeProfSingleProcessPrivilege 4428 NeptuneClient.exe Token: SeIncBasePriorityPrivilege 4428 NeptuneClient.exe Token: SeCreatePagefilePrivilege 4428 NeptuneClient.exe Token: SeBackupPrivilege 4428 NeptuneClient.exe Token: SeRestorePrivilege 4428 NeptuneClient.exe Token: SeShutdownPrivilege 4428 NeptuneClient.exe Token: SeDebugPrivilege 4428 NeptuneClient.exe Token: SeSystemEnvironmentPrivilege 4428 NeptuneClient.exe Token: SeChangeNotifyPrivilege 4428 NeptuneClient.exe Token: SeRemoteShutdownPrivilege 4428 NeptuneClient.exe Token: SeUndockPrivilege 4428 NeptuneClient.exe Token: SeManageVolumePrivilege 4428 NeptuneClient.exe Token: SeImpersonatePrivilege 4428 NeptuneClient.exe Token: SeCreateGlobalPrivilege 4428 NeptuneClient.exe Token: 33 4428 NeptuneClient.exe Token: 34 4428 NeptuneClient.exe Token: 35 4428 NeptuneClient.exe Token: 36 4428 NeptuneClient.exe Token: SeIncreaseQuotaPrivilege 4408 msdcsc.exe Token: SeSecurityPrivilege 4408 msdcsc.exe Token: SeTakeOwnershipPrivilege 4408 msdcsc.exe Token: SeLoadDriverPrivilege 4408 msdcsc.exe Token: SeSystemProfilePrivilege 4408 msdcsc.exe Token: SeSystemtimePrivilege 4408 msdcsc.exe Token: SeProfSingleProcessPrivilege 4408 msdcsc.exe Token: SeIncBasePriorityPrivilege 4408 msdcsc.exe Token: SeCreatePagefilePrivilege 4408 msdcsc.exe Token: SeBackupPrivilege 4408 msdcsc.exe Token: SeRestorePrivilege 4408 msdcsc.exe Token: SeShutdownPrivilege 4408 msdcsc.exe Token: SeDebugPrivilege 4408 msdcsc.exe Token: SeSystemEnvironmentPrivilege 4408 msdcsc.exe Token: SeChangeNotifyPrivilege 4408 msdcsc.exe Token: SeRemoteShutdownPrivilege 4408 msdcsc.exe Token: SeUndockPrivilege 4408 msdcsc.exe Token: SeManageVolumePrivilege 4408 msdcsc.exe Token: SeImpersonatePrivilege 4408 msdcsc.exe Token: SeCreateGlobalPrivilege 4408 msdcsc.exe Token: 33 4408 msdcsc.exe Token: 34 4408 msdcsc.exe Token: 35 4408 msdcsc.exe Token: 36 4408 msdcsc.exe Token: SeIncreaseQuotaPrivilege 184 iexplore.exe Token: SeSecurityPrivilege 184 iexplore.exe Token: SeTakeOwnershipPrivilege 184 iexplore.exe Token: SeLoadDriverPrivilege 184 iexplore.exe Token: SeSystemProfilePrivilege 184 iexplore.exe Token: SeSystemtimePrivilege 184 iexplore.exe Token: SeProfSingleProcessPrivilege 184 iexplore.exe Token: SeIncBasePriorityPrivilege 184 iexplore.exe Token: SeCreatePagefilePrivilege 184 iexplore.exe Token: SeBackupPrivilege 184 iexplore.exe Token: SeRestorePrivilege 184 iexplore.exe Token: SeShutdownPrivilege 184 iexplore.exe Token: SeDebugPrivilege 184 iexplore.exe Token: SeSystemEnvironmentPrivilege 184 iexplore.exe Token: SeChangeNotifyPrivilege 184 iexplore.exe Token: SeRemoteShutdownPrivilege 184 iexplore.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
iexplore.exepid process 184 iexplore.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
NeptuneClient.exemsdcsc.exedescription pid process target process PID 4428 wrote to memory of 4408 4428 NeptuneClient.exe msdcsc.exe PID 4428 wrote to memory of 4408 4428 NeptuneClient.exe msdcsc.exe PID 4428 wrote to memory of 4408 4428 NeptuneClient.exe msdcsc.exe PID 4408 wrote to memory of 184 4408 msdcsc.exe iexplore.exe PID 4408 wrote to memory of 184 4408 msdcsc.exe iexplore.exe PID 4408 wrote to memory of 184 4408 msdcsc.exe iexplore.exe PID 4408 wrote to memory of 184 4408 msdcsc.exe iexplore.exe PID 4408 wrote to memory of 184 4408 msdcsc.exe iexplore.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\NeptuneClient.exe"C:\Users\Admin\AppData\Local\Temp\NeptuneClient.exe"1⤵
- Modifies WinLogon for persistence
- Checks computer location settings
- Adds Run key to start application
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\Documents\MSDCSC\msdcsc.exe"C:\Users\Admin\Documents\MSDCSC\msdcsc.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\iexplore.exe"C:\Program Files (x86)\Internet Explorer\iexplore.exe"3⤵
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\Documents\MSDCSC\msdcsc.exeFilesize
663KB
MD52e5c6aa1fb45422ca7411a76901abad0
SHA1f33e086464ff9727c61dace2d2de45ed57abbae9
SHA25672a73dc938994f7426f53815af73c89a04ce96094bceeef83b4810bd3d69fef3
SHA5129a2e150433c7047812b4950d3ce5e30f07a2b017b4a0f61be01fcd1eed4800b82576b38dbc641e380f21491cbfee108ca4fd89838101e3b1c2ea19255b45912f
-
memory/184-70-0x0000000000400000-0x00000000004B3000-memory.dmpFilesize
716KB
-
memory/4408-67-0x0000000002170000-0x0000000002171000-memory.dmpFilesize
4KB
-
memory/4408-71-0x0000000000400000-0x00000000004B3000-memory.dmpFilesize
716KB
-
memory/4428-0-0x0000000000400000-0x00000000004B3000-memory.dmpFilesize
716KB
-
memory/4428-1-0x00000000022D0000-0x00000000022D1000-memory.dmpFilesize
4KB
-
memory/4428-53-0x0000000000400000-0x00000000004B3000-memory.dmpFilesize
716KB