Analysis
-
max time kernel
152s -
max time network
146s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
14-03-2024 03:43
Static task
static1
Behavioral task
behavioral1
Sample
c799cd2ae469bbf3de57eb92f53cbb9d.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
c799cd2ae469bbf3de57eb92f53cbb9d.exe
Resource
win10v2004-20240226-en
General
-
Target
c799cd2ae469bbf3de57eb92f53cbb9d.exe
-
Size
1.2MB
-
MD5
c799cd2ae469bbf3de57eb92f53cbb9d
-
SHA1
220907cfb0b1d69197a058e5ed93d19f199840eb
-
SHA256
262b8b6b24b3207d8dea4d204e51707472f6df35d77a71b9198aea9c1f412021
-
SHA512
949ba93b76e9bcdfc0d41ebb44f4f77c2f4d0cec3d9c8ba49891dce74e88ca3a00561c118c2441744cd5e69a85c7dfa3f7eb2171ab67b74c7d0d085bee4c32b2
-
SSDEEP
12288:0d2nCidaZdfUrcKUXGoVAYdMXDXQysHMGqUqSn1pQdICqBS9AtAxDfDBAn3NEF+/:bCEcKtb0yuEvmjscbGDns+UHj
Malware Config
Extracted
darkcomet
Guest16
146.185.24.209:1604
DC_MUTEX-6ZET9U3
-
gencode
rUvTH9YCGM3j
-
install
false
-
offline_keylogger
false
-
persistence
false
Signatures
-
Uses the VBS compiler for execution 1 TTPs
-
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
c799cd2ae469bbf3de57eb92f53cbb9d.exec799cd2ae469bbf3de57eb92f53cbb9d.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Windows\CurrentVersion\Run\svchost = "C:\\Users\\Admin\\AppData\\Roaming\\Adobe-Flash-Update.exe" c799cd2ae469bbf3de57eb92f53cbb9d.exe Set value (str) \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Windows\CurrentVersion\Run\svchost = "C:\\Users\\Admin\\AppData\\Roaming\\Adobe-Flash-Update.exe" c799cd2ae469bbf3de57eb92f53cbb9d.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
c799cd2ae469bbf3de57eb92f53cbb9d.exec799cd2ae469bbf3de57eb92f53cbb9d.exedescription pid process target process PID 1736 set thread context of 2332 1736 c799cd2ae469bbf3de57eb92f53cbb9d.exe vbc.exe PID 2940 set thread context of 2576 2940 c799cd2ae469bbf3de57eb92f53cbb9d.exe vbc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
c799cd2ae469bbf3de57eb92f53cbb9d.exec799cd2ae469bbf3de57eb92f53cbb9d.exepid process 1736 c799cd2ae469bbf3de57eb92f53cbb9d.exe 1736 c799cd2ae469bbf3de57eb92f53cbb9d.exe 1736 c799cd2ae469bbf3de57eb92f53cbb9d.exe 2940 c799cd2ae469bbf3de57eb92f53cbb9d.exe 2940 c799cd2ae469bbf3de57eb92f53cbb9d.exe 1736 c799cd2ae469bbf3de57eb92f53cbb9d.exe 1736 c799cd2ae469bbf3de57eb92f53cbb9d.exe 2940 c799cd2ae469bbf3de57eb92f53cbb9d.exe 2940 c799cd2ae469bbf3de57eb92f53cbb9d.exe 1736 c799cd2ae469bbf3de57eb92f53cbb9d.exe 1736 c799cd2ae469bbf3de57eb92f53cbb9d.exe 2940 c799cd2ae469bbf3de57eb92f53cbb9d.exe 2940 c799cd2ae469bbf3de57eb92f53cbb9d.exe 1736 c799cd2ae469bbf3de57eb92f53cbb9d.exe 1736 c799cd2ae469bbf3de57eb92f53cbb9d.exe 2940 c799cd2ae469bbf3de57eb92f53cbb9d.exe 2940 c799cd2ae469bbf3de57eb92f53cbb9d.exe 1736 c799cd2ae469bbf3de57eb92f53cbb9d.exe 1736 c799cd2ae469bbf3de57eb92f53cbb9d.exe 2940 c799cd2ae469bbf3de57eb92f53cbb9d.exe 2940 c799cd2ae469bbf3de57eb92f53cbb9d.exe 1736 c799cd2ae469bbf3de57eb92f53cbb9d.exe 1736 c799cd2ae469bbf3de57eb92f53cbb9d.exe 2940 c799cd2ae469bbf3de57eb92f53cbb9d.exe 2940 c799cd2ae469bbf3de57eb92f53cbb9d.exe 1736 c799cd2ae469bbf3de57eb92f53cbb9d.exe 1736 c799cd2ae469bbf3de57eb92f53cbb9d.exe 2940 c799cd2ae469bbf3de57eb92f53cbb9d.exe 2940 c799cd2ae469bbf3de57eb92f53cbb9d.exe 1736 c799cd2ae469bbf3de57eb92f53cbb9d.exe 1736 c799cd2ae469bbf3de57eb92f53cbb9d.exe 2940 c799cd2ae469bbf3de57eb92f53cbb9d.exe 2940 c799cd2ae469bbf3de57eb92f53cbb9d.exe 1736 c799cd2ae469bbf3de57eb92f53cbb9d.exe 1736 c799cd2ae469bbf3de57eb92f53cbb9d.exe 2940 c799cd2ae469bbf3de57eb92f53cbb9d.exe 2940 c799cd2ae469bbf3de57eb92f53cbb9d.exe 1736 c799cd2ae469bbf3de57eb92f53cbb9d.exe 1736 c799cd2ae469bbf3de57eb92f53cbb9d.exe 2940 c799cd2ae469bbf3de57eb92f53cbb9d.exe 2940 c799cd2ae469bbf3de57eb92f53cbb9d.exe 1736 c799cd2ae469bbf3de57eb92f53cbb9d.exe 1736 c799cd2ae469bbf3de57eb92f53cbb9d.exe 2940 c799cd2ae469bbf3de57eb92f53cbb9d.exe 2940 c799cd2ae469bbf3de57eb92f53cbb9d.exe 1736 c799cd2ae469bbf3de57eb92f53cbb9d.exe 1736 c799cd2ae469bbf3de57eb92f53cbb9d.exe 2940 c799cd2ae469bbf3de57eb92f53cbb9d.exe 2940 c799cd2ae469bbf3de57eb92f53cbb9d.exe 1736 c799cd2ae469bbf3de57eb92f53cbb9d.exe 1736 c799cd2ae469bbf3de57eb92f53cbb9d.exe 2940 c799cd2ae469bbf3de57eb92f53cbb9d.exe 2940 c799cd2ae469bbf3de57eb92f53cbb9d.exe 1736 c799cd2ae469bbf3de57eb92f53cbb9d.exe 1736 c799cd2ae469bbf3de57eb92f53cbb9d.exe 2940 c799cd2ae469bbf3de57eb92f53cbb9d.exe 2940 c799cd2ae469bbf3de57eb92f53cbb9d.exe 1736 c799cd2ae469bbf3de57eb92f53cbb9d.exe 1736 c799cd2ae469bbf3de57eb92f53cbb9d.exe 2940 c799cd2ae469bbf3de57eb92f53cbb9d.exe 2940 c799cd2ae469bbf3de57eb92f53cbb9d.exe 1736 c799cd2ae469bbf3de57eb92f53cbb9d.exe 1736 c799cd2ae469bbf3de57eb92f53cbb9d.exe 2940 c799cd2ae469bbf3de57eb92f53cbb9d.exe -
Suspicious use of AdjustPrivilegeToken 48 IoCs
Processes:
c799cd2ae469bbf3de57eb92f53cbb9d.exec799cd2ae469bbf3de57eb92f53cbb9d.exevbc.exevbc.exedescription pid process Token: SeDebugPrivilege 1736 c799cd2ae469bbf3de57eb92f53cbb9d.exe Token: SeDebugPrivilege 2940 c799cd2ae469bbf3de57eb92f53cbb9d.exe Token: SeIncreaseQuotaPrivilege 2332 vbc.exe Token: SeSecurityPrivilege 2332 vbc.exe Token: SeTakeOwnershipPrivilege 2332 vbc.exe Token: SeLoadDriverPrivilege 2332 vbc.exe Token: SeSystemProfilePrivilege 2332 vbc.exe Token: SeSystemtimePrivilege 2332 vbc.exe Token: SeProfSingleProcessPrivilege 2332 vbc.exe Token: SeIncBasePriorityPrivilege 2332 vbc.exe Token: SeCreatePagefilePrivilege 2332 vbc.exe Token: SeBackupPrivilege 2332 vbc.exe Token: SeRestorePrivilege 2332 vbc.exe Token: SeShutdownPrivilege 2332 vbc.exe Token: SeDebugPrivilege 2332 vbc.exe Token: SeSystemEnvironmentPrivilege 2332 vbc.exe Token: SeChangeNotifyPrivilege 2332 vbc.exe Token: SeRemoteShutdownPrivilege 2332 vbc.exe Token: SeUndockPrivilege 2332 vbc.exe Token: SeManageVolumePrivilege 2332 vbc.exe Token: SeImpersonatePrivilege 2332 vbc.exe Token: SeCreateGlobalPrivilege 2332 vbc.exe Token: 33 2332 vbc.exe Token: 34 2332 vbc.exe Token: 35 2332 vbc.exe Token: SeIncreaseQuotaPrivilege 2576 vbc.exe Token: SeSecurityPrivilege 2576 vbc.exe Token: SeTakeOwnershipPrivilege 2576 vbc.exe Token: SeLoadDriverPrivilege 2576 vbc.exe Token: SeSystemProfilePrivilege 2576 vbc.exe Token: SeSystemtimePrivilege 2576 vbc.exe Token: SeProfSingleProcessPrivilege 2576 vbc.exe Token: SeIncBasePriorityPrivilege 2576 vbc.exe Token: SeCreatePagefilePrivilege 2576 vbc.exe Token: SeBackupPrivilege 2576 vbc.exe Token: SeRestorePrivilege 2576 vbc.exe Token: SeShutdownPrivilege 2576 vbc.exe Token: SeDebugPrivilege 2576 vbc.exe Token: SeSystemEnvironmentPrivilege 2576 vbc.exe Token: SeChangeNotifyPrivilege 2576 vbc.exe Token: SeRemoteShutdownPrivilege 2576 vbc.exe Token: SeUndockPrivilege 2576 vbc.exe Token: SeManageVolumePrivilege 2576 vbc.exe Token: SeImpersonatePrivilege 2576 vbc.exe Token: SeCreateGlobalPrivilege 2576 vbc.exe Token: 33 2576 vbc.exe Token: 34 2576 vbc.exe Token: 35 2576 vbc.exe -
Suspicious use of WriteProcessMemory 43 IoCs
Processes:
c799cd2ae469bbf3de57eb92f53cbb9d.exec799cd2ae469bbf3de57eb92f53cbb9d.exedescription pid process target process PID 1736 wrote to memory of 2332 1736 c799cd2ae469bbf3de57eb92f53cbb9d.exe vbc.exe PID 1736 wrote to memory of 2332 1736 c799cd2ae469bbf3de57eb92f53cbb9d.exe vbc.exe PID 1736 wrote to memory of 2332 1736 c799cd2ae469bbf3de57eb92f53cbb9d.exe vbc.exe PID 1736 wrote to memory of 2332 1736 c799cd2ae469bbf3de57eb92f53cbb9d.exe vbc.exe PID 1736 wrote to memory of 2332 1736 c799cd2ae469bbf3de57eb92f53cbb9d.exe vbc.exe PID 1736 wrote to memory of 2332 1736 c799cd2ae469bbf3de57eb92f53cbb9d.exe vbc.exe PID 1736 wrote to memory of 2332 1736 c799cd2ae469bbf3de57eb92f53cbb9d.exe vbc.exe PID 1736 wrote to memory of 2332 1736 c799cd2ae469bbf3de57eb92f53cbb9d.exe vbc.exe PID 1736 wrote to memory of 2332 1736 c799cd2ae469bbf3de57eb92f53cbb9d.exe vbc.exe PID 1736 wrote to memory of 2332 1736 c799cd2ae469bbf3de57eb92f53cbb9d.exe vbc.exe PID 1736 wrote to memory of 2332 1736 c799cd2ae469bbf3de57eb92f53cbb9d.exe vbc.exe PID 1736 wrote to memory of 2332 1736 c799cd2ae469bbf3de57eb92f53cbb9d.exe vbc.exe PID 1736 wrote to memory of 2332 1736 c799cd2ae469bbf3de57eb92f53cbb9d.exe vbc.exe PID 1736 wrote to memory of 2332 1736 c799cd2ae469bbf3de57eb92f53cbb9d.exe vbc.exe PID 1736 wrote to memory of 2332 1736 c799cd2ae469bbf3de57eb92f53cbb9d.exe vbc.exe PID 1736 wrote to memory of 2332 1736 c799cd2ae469bbf3de57eb92f53cbb9d.exe vbc.exe PID 1736 wrote to memory of 2332 1736 c799cd2ae469bbf3de57eb92f53cbb9d.exe vbc.exe PID 1736 wrote to memory of 2332 1736 c799cd2ae469bbf3de57eb92f53cbb9d.exe vbc.exe PID 1736 wrote to memory of 2940 1736 c799cd2ae469bbf3de57eb92f53cbb9d.exe c799cd2ae469bbf3de57eb92f53cbb9d.exe PID 1736 wrote to memory of 2940 1736 c799cd2ae469bbf3de57eb92f53cbb9d.exe c799cd2ae469bbf3de57eb92f53cbb9d.exe PID 1736 wrote to memory of 2940 1736 c799cd2ae469bbf3de57eb92f53cbb9d.exe c799cd2ae469bbf3de57eb92f53cbb9d.exe PID 1736 wrote to memory of 2940 1736 c799cd2ae469bbf3de57eb92f53cbb9d.exe c799cd2ae469bbf3de57eb92f53cbb9d.exe PID 1736 wrote to memory of 2940 1736 c799cd2ae469bbf3de57eb92f53cbb9d.exe c799cd2ae469bbf3de57eb92f53cbb9d.exe PID 1736 wrote to memory of 2940 1736 c799cd2ae469bbf3de57eb92f53cbb9d.exe c799cd2ae469bbf3de57eb92f53cbb9d.exe PID 1736 wrote to memory of 2940 1736 c799cd2ae469bbf3de57eb92f53cbb9d.exe c799cd2ae469bbf3de57eb92f53cbb9d.exe PID 2940 wrote to memory of 2576 2940 c799cd2ae469bbf3de57eb92f53cbb9d.exe vbc.exe PID 2940 wrote to memory of 2576 2940 c799cd2ae469bbf3de57eb92f53cbb9d.exe vbc.exe PID 2940 wrote to memory of 2576 2940 c799cd2ae469bbf3de57eb92f53cbb9d.exe vbc.exe PID 2940 wrote to memory of 2576 2940 c799cd2ae469bbf3de57eb92f53cbb9d.exe vbc.exe PID 2940 wrote to memory of 2576 2940 c799cd2ae469bbf3de57eb92f53cbb9d.exe vbc.exe PID 2940 wrote to memory of 2576 2940 c799cd2ae469bbf3de57eb92f53cbb9d.exe vbc.exe PID 2940 wrote to memory of 2576 2940 c799cd2ae469bbf3de57eb92f53cbb9d.exe vbc.exe PID 2940 wrote to memory of 2576 2940 c799cd2ae469bbf3de57eb92f53cbb9d.exe vbc.exe PID 2940 wrote to memory of 2576 2940 c799cd2ae469bbf3de57eb92f53cbb9d.exe vbc.exe PID 2940 wrote to memory of 2576 2940 c799cd2ae469bbf3de57eb92f53cbb9d.exe vbc.exe PID 2940 wrote to memory of 2576 2940 c799cd2ae469bbf3de57eb92f53cbb9d.exe vbc.exe PID 2940 wrote to memory of 2576 2940 c799cd2ae469bbf3de57eb92f53cbb9d.exe vbc.exe PID 2940 wrote to memory of 2576 2940 c799cd2ae469bbf3de57eb92f53cbb9d.exe vbc.exe PID 2940 wrote to memory of 2576 2940 c799cd2ae469bbf3de57eb92f53cbb9d.exe vbc.exe PID 2940 wrote to memory of 2576 2940 c799cd2ae469bbf3de57eb92f53cbb9d.exe vbc.exe PID 2940 wrote to memory of 2576 2940 c799cd2ae469bbf3de57eb92f53cbb9d.exe vbc.exe PID 2940 wrote to memory of 2576 2940 c799cd2ae469bbf3de57eb92f53cbb9d.exe vbc.exe PID 2940 wrote to memory of 2576 2940 c799cd2ae469bbf3de57eb92f53cbb9d.exe vbc.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\c799cd2ae469bbf3de57eb92f53cbb9d.exe"C:\Users\Admin\AppData\Local\Temp\c799cd2ae469bbf3de57eb92f53cbb9d.exe"1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeC:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe2⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\c799cd2ae469bbf3de57eb92f53cbb9d.exe"C:\Users\Admin\AppData\Local\Temp\c799cd2ae469bbf3de57eb92f53cbb9d.exe"2⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeC:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe3⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1736-0-0x0000000074960000-0x0000000074F0B000-memory.dmpFilesize
5.7MB
-
memory/1736-18-0x0000000074960000-0x0000000074F0B000-memory.dmpFilesize
5.7MB
-
memory/2332-2-0x0000000000400000-0x00000000004B5000-memory.dmpFilesize
724KB
-
memory/2332-3-0x0000000000400000-0x00000000004B5000-memory.dmpFilesize
724KB
-
memory/2332-4-0x0000000000400000-0x00000000004B5000-memory.dmpFilesize
724KB
-
memory/2332-6-0x0000000000400000-0x00000000004B5000-memory.dmpFilesize
724KB
-
memory/2332-13-0x0000000000400000-0x00000000004B5000-memory.dmpFilesize
724KB
-
memory/2332-16-0x0000000000400000-0x00000000004B5000-memory.dmpFilesize
724KB
-
memory/2332-20-0x0000000000400000-0x00000000004B5000-memory.dmpFilesize
724KB
-
memory/2576-14-0x0000000000400000-0x00000000004B5000-memory.dmpFilesize
724KB
-
memory/2940-7-0x0000000074960000-0x0000000074F0B000-memory.dmpFilesize
5.7MB
-
memory/2940-19-0x0000000074960000-0x0000000074F0B000-memory.dmpFilesize
5.7MB