Analysis
-
max time kernel
151s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
13-03-2024 17:25
Static task
static1
Behavioral task
behavioral1
Sample
0a3eb0e960fe681f9c9c087866e452fea90ea01b6be8546f18a193877684e2c4.exe
Resource
win7-20240221-en
General
-
Target
0a3eb0e960fe681f9c9c087866e452fea90ea01b6be8546f18a193877684e2c4.exe
-
Size
3.6MB
-
MD5
2cc5fe892456803c78acb4533131cfd0
-
SHA1
fb784a69b211a211cc37216ef0fab175b3fcb17b
-
SHA256
0a3eb0e960fe681f9c9c087866e452fea90ea01b6be8546f18a193877684e2c4
-
SHA512
dd7f18aa36ab5f6ec3e0f36a340a5e14f769594ba9b64c597f69741b85e8c0ef8d9f486bc58d29ae6339752223b3495a99a892150876ce728837caf779faa3b1
-
SSDEEP
98304:6yfTJdwh2D/v2m/x494+JIUqKGEv+4UvAvmO1Sqw:Yh2L2UcNJjGE5eO
Malware Config
Extracted
darkcomet
Guest16
bhanufuckingkajal.zapto.org:1604
DC_MUTEX-51BCPDY
-
gencode
cs3uXQkGvRRY
-
install
false
-
offline_keylogger
true
-
persistence
false
Extracted
latentbot
bhanufuckingkajal.zapto.org
Signatures
-
Detects executables built or packed with MPress PE compressor 5 IoCs
Processes:
resource yara_rule C:\Users\Admin\AppData\LocaljhRXHiSsGx.exe INDICATOR_EXE_Packed_MPress behavioral2/memory/724-13-0x0000000000400000-0x00000000004E6000-memory.dmp INDICATOR_EXE_Packed_MPress behavioral2/memory/724-31-0x0000000000400000-0x00000000004E6000-memory.dmp INDICATOR_EXE_Packed_MPress behavioral2/memory/724-93-0x0000000000400000-0x00000000004E6000-memory.dmp INDICATOR_EXE_Packed_MPress behavioral2/memory/724-217-0x0000000000400000-0x00000000004E6000-memory.dmp INDICATOR_EXE_Packed_MPress -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
0a3eb0e960fe681f9c9c087866e452fea90ea01b6be8546f18a193877684e2c4.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation 0a3eb0e960fe681f9c9c087866e452fea90ea01b6be8546f18a193877684e2c4.exe -
Executes dropped EXE 1 IoCs
Processes:
LocaljhRXHiSsGx.exepid process 724 LocaljhRXHiSsGx.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 1 IoCs
Processes:
0a3eb0e960fe681f9c9c087866e452fea90ea01b6be8546f18a193877684e2c4.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings 0a3eb0e960fe681f9c9c087866e452fea90ea01b6be8546f18a193877684e2c4.exe -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
vlc.exepid process 1004 vlc.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
vlc.exepid process 1004 vlc.exe -
Suspicious use of AdjustPrivilegeToken 28 IoCs
Processes:
LocaljhRXHiSsGx.exeAUDIODG.EXEvlc.exedescription pid process Token: SeIncreaseQuotaPrivilege 724 LocaljhRXHiSsGx.exe Token: SeSecurityPrivilege 724 LocaljhRXHiSsGx.exe Token: SeTakeOwnershipPrivilege 724 LocaljhRXHiSsGx.exe Token: SeLoadDriverPrivilege 724 LocaljhRXHiSsGx.exe Token: SeSystemProfilePrivilege 724 LocaljhRXHiSsGx.exe Token: SeSystemtimePrivilege 724 LocaljhRXHiSsGx.exe Token: SeProfSingleProcessPrivilege 724 LocaljhRXHiSsGx.exe Token: SeIncBasePriorityPrivilege 724 LocaljhRXHiSsGx.exe Token: SeCreatePagefilePrivilege 724 LocaljhRXHiSsGx.exe Token: SeBackupPrivilege 724 LocaljhRXHiSsGx.exe Token: SeRestorePrivilege 724 LocaljhRXHiSsGx.exe Token: SeShutdownPrivilege 724 LocaljhRXHiSsGx.exe Token: SeDebugPrivilege 724 LocaljhRXHiSsGx.exe Token: SeSystemEnvironmentPrivilege 724 LocaljhRXHiSsGx.exe Token: SeChangeNotifyPrivilege 724 LocaljhRXHiSsGx.exe Token: SeRemoteShutdownPrivilege 724 LocaljhRXHiSsGx.exe Token: SeUndockPrivilege 724 LocaljhRXHiSsGx.exe Token: SeManageVolumePrivilege 724 LocaljhRXHiSsGx.exe Token: SeImpersonatePrivilege 724 LocaljhRXHiSsGx.exe Token: SeCreateGlobalPrivilege 724 LocaljhRXHiSsGx.exe Token: 33 724 LocaljhRXHiSsGx.exe Token: 34 724 LocaljhRXHiSsGx.exe Token: 35 724 LocaljhRXHiSsGx.exe Token: 36 724 LocaljhRXHiSsGx.exe Token: 33 448 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 448 AUDIODG.EXE Token: 33 1004 vlc.exe Token: SeIncBasePriorityPrivilege 1004 vlc.exe -
Suspicious use of FindShellTrayWindow 5 IoCs
Processes:
vlc.exepid process 1004 vlc.exe 1004 vlc.exe 1004 vlc.exe 1004 vlc.exe 1004 vlc.exe -
Suspicious use of SendNotifyMessage 4 IoCs
Processes:
vlc.exepid process 1004 vlc.exe 1004 vlc.exe 1004 vlc.exe 1004 vlc.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
vlc.exeLocaljhRXHiSsGx.exepid process 1004 vlc.exe 724 LocaljhRXHiSsGx.exe -
Suspicious use of WriteProcessMemory 5 IoCs
Processes:
0a3eb0e960fe681f9c9c087866e452fea90ea01b6be8546f18a193877684e2c4.exedescription pid process target process PID 4384 wrote to memory of 724 4384 0a3eb0e960fe681f9c9c087866e452fea90ea01b6be8546f18a193877684e2c4.exe LocaljhRXHiSsGx.exe PID 4384 wrote to memory of 724 4384 0a3eb0e960fe681f9c9c087866e452fea90ea01b6be8546f18a193877684e2c4.exe LocaljhRXHiSsGx.exe PID 4384 wrote to memory of 724 4384 0a3eb0e960fe681f9c9c087866e452fea90ea01b6be8546f18a193877684e2c4.exe LocaljhRXHiSsGx.exe PID 4384 wrote to memory of 1004 4384 0a3eb0e960fe681f9c9c087866e452fea90ea01b6be8546f18a193877684e2c4.exe vlc.exe PID 4384 wrote to memory of 1004 4384 0a3eb0e960fe681f9c9c087866e452fea90ea01b6be8546f18a193877684e2c4.exe vlc.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\0a3eb0e960fe681f9c9c087866e452fea90ea01b6be8546f18a193877684e2c4.exe"C:\Users\Admin\AppData\Local\Temp\0a3eb0e960fe681f9c9c087866e452fea90ea01b6be8546f18a193877684e2c4.exe"1⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\LocaljhRXHiSsGx.exe"C:\Users\Admin\AppData\LocaljhRXHiSsGx.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
C:\Program Files\VideoLAN\VLC\vlc.exe"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\LocaljmDdbAeUJe..mp3"2⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x510 0x40c1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1792 --field-trial-handle=2284,i,15722001240173834669,15048020084704567542,262144 --variations-seed-version /prefetch:81⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocaljhRXHiSsGx.exeFilesize
332KB
MD5e5fca3eec45a6afd27df36698f6a76c8
SHA13580d0a1cf8ead9ecee64ce61046b2950620deae
SHA256a71a9654f6f0bd8d9aa8885e7484f091a7a878c025cfdf42da63f106a32d9a76
SHA512718aaf5ef739e6a787e584c70941a311846af3191c92830f6b9ee89142d9b50e83419b4e4a524a5ffcdf6589dc868eca5217a44499c8974de49204ca31b4900b
-
C:\Users\Admin\AppData\LocaljmDdbAeUJe..mp3Filesize
3.0MB
MD5a970954c99733400bcd164640276289c
SHA11619f8cfbde5ff97b6d6309afd72f5451a030432
SHA256fd5ef5e0a05c412c8168f7e87319ed6f3b7094c9676cf084a26db70fbb9a6c6d
SHA512e4d7dbbb881430c693917f3bad07f85dcc77647335929a70c5d87451ffc412acdee9a430dac1d19ff673988522e6f6515e03a0be71c7c2090c2d278c252510ed
-
memory/724-13-0x0000000000400000-0x00000000004E6000-memory.dmpFilesize
920KB
-
memory/724-23-0x0000000000730000-0x0000000000731000-memory.dmpFilesize
4KB
-
memory/724-31-0x0000000000400000-0x00000000004E6000-memory.dmpFilesize
920KB
-
memory/724-217-0x0000000000400000-0x00000000004E6000-memory.dmpFilesize
920KB
-
memory/724-93-0x0000000000400000-0x00000000004E6000-memory.dmpFilesize
920KB
-
memory/1004-61-0x00007FF982E30000-0x00007FF982E43000-memory.dmpFilesize
76KB
-
memory/1004-49-0x00007FF9830B0000-0x00007FF9830C1000-memory.dmpFilesize
68KB
-
memory/1004-34-0x00007FF980C70000-0x00007FF980F24000-memory.dmpFilesize
2.7MB
-
memory/1004-38-0x00007FF994010000-0x00007FF994027000-memory.dmpFilesize
92KB
-
memory/1004-40-0x00007FF984940000-0x00007FF98495D000-memory.dmpFilesize
116KB
-
memory/1004-66-0x00007FF982CE0000-0x00007FF982CF4000-memory.dmpFilesize
80KB
-
memory/1004-39-0x00007FF98EB40000-0x00007FF98EB51000-memory.dmpFilesize
68KB
-
memory/1004-37-0x00007FF995AC0000-0x00007FF995AD1000-memory.dmpFilesize
68KB
-
memory/1004-36-0x00007FF995AE0000-0x00007FF995AF7000-memory.dmpFilesize
92KB
-
memory/1004-35-0x00007FF995B00000-0x00007FF995B18000-memory.dmpFilesize
96KB
-
memory/1004-42-0x00007FF983490000-0x00007FF98453B000-memory.dmpFilesize
16.7MB
-
memory/1004-43-0x00007FF9830F0000-0x00007FF9832F0000-memory.dmpFilesize
2.0MB
-
memory/1004-44-0x00007FF984850000-0x00007FF98488F000-memory.dmpFilesize
252KB
-
memory/1004-68-0x00007FF982CA0000-0x00007FF982CB4000-memory.dmpFilesize
80KB
-
memory/1004-50-0x00007FF983090000-0x00007FF9830AB000-memory.dmpFilesize
108KB
-
memory/1004-51-0x00007FF983070000-0x00007FF983081000-memory.dmpFilesize
68KB
-
memory/1004-52-0x00007FF983050000-0x00007FF983068000-memory.dmpFilesize
96KB
-
memory/1004-53-0x00007FF983020000-0x00007FF983050000-memory.dmpFilesize
192KB
-
memory/1004-48-0x00007FF9830D0000-0x00007FF9830E1000-memory.dmpFilesize
68KB
-
memory/1004-47-0x00007FF9847E0000-0x00007FF9847F1000-memory.dmpFilesize
68KB
-
memory/1004-46-0x00007FF984800000-0x00007FF984818000-memory.dmpFilesize
96KB
-
memory/1004-54-0x00007FF982FB0000-0x00007FF983017000-memory.dmpFilesize
412KB
-
memory/1004-45-0x00007FF984820000-0x00007FF984841000-memory.dmpFilesize
132KB
-
memory/1004-55-0x00007FF982F40000-0x00007FF982FAF000-memory.dmpFilesize
444KB
-
memory/1004-58-0x00007FF982EE0000-0x00007FF982EF1000-memory.dmpFilesize
68KB
-
memory/1004-69-0x00007FF982C80000-0x00007FF982C9E000-memory.dmpFilesize
120KB
-
memory/1004-56-0x00007FF982F20000-0x00007FF982F31000-memory.dmpFilesize
68KB
-
memory/1004-59-0x00007FF982E80000-0x00007FF982ED7000-memory.dmpFilesize
348KB
-
memory/1004-60-0x00007FF982E50000-0x00007FF982E7F000-memory.dmpFilesize
188KB
-
memory/1004-32-0x00007FF64A8C0000-0x00007FF64A9B8000-memory.dmpFilesize
992KB
-
memory/1004-62-0x00007FF982E10000-0x00007FF982E21000-memory.dmpFilesize
68KB
-
memory/1004-63-0x00007FF982D40000-0x00007FF982E05000-memory.dmpFilesize
788KB
-
memory/1004-41-0x00007FF984920000-0x00007FF984931000-memory.dmpFilesize
68KB
-
memory/1004-33-0x00007FF980F30000-0x00007FF980F64000-memory.dmpFilesize
208KB
-
memory/1004-57-0x00007FF982F00000-0x00007FF982F17000-memory.dmpFilesize
92KB
-
memory/1004-71-0x00007FF982C40000-0x00007FF982C55000-memory.dmpFilesize
84KB
-
memory/1004-73-0x00007FF982BF0000-0x00007FF982C1C000-memory.dmpFilesize
176KB
-
memory/1004-72-0x00007FF982C20000-0x00007FF982C34000-memory.dmpFilesize
80KB
-
memory/1004-75-0x00007FF982BA0000-0x00007FF982BD0000-memory.dmpFilesize
192KB
-
memory/1004-76-0x00007FF982B80000-0x00007FF982B97000-memory.dmpFilesize
92KB
-
memory/1004-74-0x00007FF982BD0000-0x00007FF982BE2000-memory.dmpFilesize
72KB
-
memory/1004-70-0x00007FF982C60000-0x00007FF982C76000-memory.dmpFilesize
88KB
-
memory/1004-67-0x00007FF982CC0000-0x00007FF982CD2000-memory.dmpFilesize
72KB
-
memory/1004-65-0x00007FF982D00000-0x00007FF982D11000-memory.dmpFilesize
68KB
-
memory/1004-64-0x00007FF982D20000-0x00007FF982D32000-memory.dmpFilesize
72KB
-
memory/1004-77-0x00007FF97A620000-0x00007FF97BDD0000-memory.dmpFilesize
23.7MB
-
memory/1004-78-0x00007FF982B60000-0x00007FF982B71000-memory.dmpFilesize
68KB
-
memory/1004-79-0x00007FF982B40000-0x00007FF982B52000-memory.dmpFilesize
72KB
-
memory/1004-80-0x00007FF9829C0000-0x00007FF982B38000-memory.dmpFilesize
1.5MB
-
memory/1004-81-0x00007FF982510000-0x00007FF982566000-memory.dmpFilesize
344KB
-
memory/1004-82-0x00007FF995F50000-0x00007FF995F78000-memory.dmpFilesize
160KB
-
memory/1004-83-0x00007FF9824E0000-0x00007FF982504000-memory.dmpFilesize
144KB
-
memory/1004-84-0x00007FF9962A0000-0x00007FF9962B0000-memory.dmpFilesize
64KB
-
memory/1004-85-0x00007FF9824C0000-0x00007FF9824D6000-memory.dmpFilesize
88KB
-
memory/1004-86-0x00007FF982410000-0x00007FF982485000-memory.dmpFilesize
468KB
-
memory/1004-87-0x00007FF9823A0000-0x00007FF982402000-memory.dmpFilesize
392KB
-
memory/1004-88-0x00007FF982330000-0x00007FF98239D000-memory.dmpFilesize
436KB
-
memory/1004-89-0x00007FF982310000-0x00007FF982325000-memory.dmpFilesize
84KB
-
memory/1004-90-0x00007FF982210000-0x00007FF982221000-memory.dmpFilesize
68KB
-
memory/1004-91-0x00007FF9821F0000-0x00007FF982202000-memory.dmpFilesize
72KB
-
memory/1004-92-0x00007FF981450000-0x00007FF9815CA000-memory.dmpFilesize
1.5MB
-
memory/4384-0-0x00007FF983AE0000-0x00007FF984481000-memory.dmpFilesize
9.6MB
-
memory/4384-1-0x0000000001BA0000-0x0000000001BB0000-memory.dmpFilesize
64KB
-
memory/4384-2-0x00007FF983AE0000-0x00007FF984481000-memory.dmpFilesize
9.6MB
-
memory/4384-21-0x00007FF983AE0000-0x00007FF984481000-memory.dmpFilesize
9.6MB