Analysis
- max time kernel
152s - max time network
158s - platform
windows10-2004_x64 - resource
win10v2004-20240226-en - resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system - submitted
14/03/2024, 11:48
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
c88aa7a95432159ea819744b6cff03a3.exe
Resource
win7-20240220-en
windows7-x64
12 signatures
150 seconds
General
- Target c88aa7a95432159ea819744b6cff03a3.exe
- Size 745KB
- Sample240314-nymgeade37
- SHA256 c997880b5f4706aab0197d8e1f0ee50f5ff7ab5628709db1c53b21e8e99d9c00
- MD5 c88aa7a95432159ea819744b6cff03a3
- SHA1 b3a9b6fc20ecf849e585d13f5395e4ebe38fea73
- SHA512 5f78fad03005402cfa08aeaf23f9e68d2ec1f9887d088579d8191095d5135d6b22ad90cacb69e8be6e04c1f2caaab3577790a7e4d4f7917d512c588fa475bf22
- SSDEEP 12288:OzxzTDWikLSb4NS7n3NJXL1RR0PjQwOI/YsXMq/rjXYghC7WbbilZvYqlv9dTFe:oDWHSb4Nq9NnR0P8wOI/YBLJrAm9dZe
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Extracted
Family
-
darkcomet
Botnet
-
0
C2
-
2.tcp.ngrok.io:19484
Mutex
-
DC_MUTEX-D4GXYWX
Attributes
-
InstallPath
MSDCSC\msdcsc.exe
-
gencode
vsQCj7esHvsd
-
install
true
-
offline_keylogger
true
-
persistence
true
-
reg_key
MicroUpdate
Signatures
- Modifies WinLogon for persistence 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe" cheat.exe - Modifies firewall policy service 2 TTPs 6 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" iexplore.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "0" iexplore.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile msdcsc.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" msdcsc.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "0" msdcsc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile iexplore.exe - Modifies security service 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wscsvc\Start = "4" msdcsc.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wscsvc\Start = "4" iexplore.exe -
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" iexplore.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" iexplore.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" msdcsc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" msdcsc.exe - Disables RegEdit via registry modification 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-609813121-2907144057-1731107329-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" msdcsc.exe Set value (int) \REGISTRY\USER\S-1-5-21-609813121-2907144057-1731107329-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" iexplore.exe - Disables Task Manager via registry modification
- Sets file to hidden 1 TTPs 2 IoCs
Modifies file attributes to stop it showing in Explorer etc.
pid Process 4584 attrib.exe 4940 attrib.exe - Checks computer location settings 2 TTPs 3 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-609813121-2907144057-1731107329-1000\Control Panel\International\Geo\Nation c88aa7a95432159ea819744b6cff03a3.exe Key value queried \REGISTRY\USER\S-1-5-21-609813121-2907144057-1731107329-1000\Control Panel\International\Geo\Nation cheat.sfx.exe Key value queried \REGISTRY\USER\S-1-5-21-609813121-2907144057-1731107329-1000\Control Panel\International\Geo\Nation cheat.exe - Executes dropped EXE 3 IoCs
pid Process 4000 cheat.sfx.exe 3460 cheat.exe 4636 msdcsc.exe -
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" msdcsc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" msdcsc.exe - Adds Run key to start application 2 TTPs 3 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-609813121-2907144057-1731107329-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Windows\\system32\\MSDCSC\\msdcsc.exe" cheat.exe Set value (str) \REGISTRY\USER\S-1-5-21-609813121-2907144057-1731107329-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Windows\\system32\\MSDCSC\\msdcsc.exe" msdcsc.exe Set value (str) \REGISTRY\USER\S-1-5-21-609813121-2907144057-1731107329-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Windows\\system32\\MSDCSC\\msdcsc.exe" iexplore.exe - Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs
flow ioc 34 2.tcp.ngrok.io 67 2.tcp.ngrok.io 88 2.tcp.ngrok.io - Drops file in System32 directory 3 IoCs
description ioc Process File created C:\Windows\SysWOW64\MSDCSC\msdcsc.exe cheat.exe File opened for modification C:\Windows\SysWOW64\MSDCSC\msdcsc.exe cheat.exe File opened for modification C:\Windows\SysWOW64\MSDCSC\ cheat.exe - Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 4636 set thread context of 4448 4636 msdcsc.exe 104 - Drops file in Windows directory 5 IoCs
description ioc Process File created C:\Windows\cheat.sfx.exe c88aa7a95432159ea819744b6cff03a3.exe File opened for modification C:\Windows\cheat.sfx.exe c88aa7a95432159ea819744b6cff03a3.exe File created C:\Windows\__tmp_rar_sfx_access_check_240616437 c88aa7a95432159ea819744b6cff03a3.exe File created C:\Windows\cheat.bat c88aa7a95432159ea819744b6cff03a3.exe File opened for modification C:\Windows\cheat.bat c88aa7a95432159ea819744b6cff03a3.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ cheat.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 4448 iexplore.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 3460 cheat.exe Token: SeSecurityPrivilege 3460 cheat.exe Token: SeTakeOwnershipPrivilege 3460 cheat.exe Token: SeLoadDriverPrivilege 3460 cheat.exe Token: SeSystemProfilePrivilege 3460 cheat.exe Token: SeSystemtimePrivilege 3460 cheat.exe Token: SeProfSingleProcessPrivilege 3460 cheat.exe Token: SeIncBasePriorityPrivilege 3460 cheat.exe Token: SeCreatePagefilePrivilege 3460 cheat.exe Token: SeBackupPrivilege 3460 cheat.exe Token: SeRestorePrivilege 3460 cheat.exe Token: SeShutdownPrivilege 3460 cheat.exe Token: SeDebugPrivilege 3460 cheat.exe Token: SeSystemEnvironmentPrivilege 3460 cheat.exe Token: SeChangeNotifyPrivilege 3460 cheat.exe Token: SeRemoteShutdownPrivilege 3460 cheat.exe Token: SeUndockPrivilege 3460 cheat.exe Token: SeManageVolumePrivilege 3460 cheat.exe Token: SeImpersonatePrivilege 3460 cheat.exe Token: SeCreateGlobalPrivilege 3460 cheat.exe Token: 33 3460 cheat.exe Token: 34 3460 cheat.exe Token: 35 3460 cheat.exe Token: 36 3460 cheat.exe Token: SeIncreaseQuotaPrivilege 4636 msdcsc.exe Token: SeSecurityPrivilege 4636 msdcsc.exe Token: SeTakeOwnershipPrivilege 4636 msdcsc.exe Token: SeLoadDriverPrivilege 4636 msdcsc.exe Token: SeSystemProfilePrivilege 4636 msdcsc.exe Token: SeSystemtimePrivilege 4636 msdcsc.exe Token: SeProfSingleProcessPrivilege 4636 msdcsc.exe Token: SeIncBasePriorityPrivilege 4636 msdcsc.exe Token: SeCreatePagefilePrivilege 4636 msdcsc.exe Token: SeBackupPrivilege 4636 msdcsc.exe Token: SeRestorePrivilege 4636 msdcsc.exe Token: SeShutdownPrivilege 4636 msdcsc.exe Token: SeDebugPrivilege 4636 msdcsc.exe Token: SeSystemEnvironmentPrivilege 4636 msdcsc.exe Token: SeChangeNotifyPrivilege 4636 msdcsc.exe Token: SeRemoteShutdownPrivilege 4636 msdcsc.exe Token: SeUndockPrivilege 4636 msdcsc.exe Token: SeManageVolumePrivilege 4636 msdcsc.exe Token: SeImpersonatePrivilege 4636 msdcsc.exe Token: SeCreateGlobalPrivilege 4636 msdcsc.exe Token: 33 4636 msdcsc.exe Token: 34 4636 msdcsc.exe Token: 35 4636 msdcsc.exe Token: 36 4636 msdcsc.exe Token: SeIncreaseQuotaPrivilege 4448 iexplore.exe Token: SeSecurityPrivilege 4448 iexplore.exe Token: SeTakeOwnershipPrivilege 4448 iexplore.exe Token: SeLoadDriverPrivilege 4448 iexplore.exe Token: SeSystemProfilePrivilege 4448 iexplore.exe Token: SeSystemtimePrivilege 4448 iexplore.exe Token: SeProfSingleProcessPrivilege 4448 iexplore.exe Token: SeIncBasePriorityPrivilege 4448 iexplore.exe Token: SeCreatePagefilePrivilege 4448 iexplore.exe Token: SeBackupPrivilege 4448 iexplore.exe Token: SeRestorePrivilege 4448 iexplore.exe Token: SeShutdownPrivilege 4448 iexplore.exe Token: SeDebugPrivilege 4448 iexplore.exe Token: SeSystemEnvironmentPrivilege 4448 iexplore.exe Token: SeChangeNotifyPrivilege 4448 iexplore.exe Token: SeRemoteShutdownPrivilege 4448 iexplore.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 4448 iexplore.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2348 wrote to memory of 5028 2348 c88aa7a95432159ea819744b6cff03a3.exe 90 PID 2348 wrote to memory of 5028 2348 c88aa7a95432159ea819744b6cff03a3.exe 90 PID 2348 wrote to memory of 5028 2348 c88aa7a95432159ea819744b6cff03a3.exe 90 PID 5028 wrote to memory of 4000 5028 cmd.exe 93 PID 5028 wrote to memory of 4000 5028 cmd.exe 93 PID 5028 wrote to memory of 4000 5028 cmd.exe 93 PID 4000 wrote to memory of 3460 4000 cheat.sfx.exe 94 PID 4000 wrote to memory of 3460 4000 cheat.sfx.exe 94 PID 4000 wrote to memory of 3460 4000 cheat.sfx.exe 94 PID 3460 wrote to memory of 4056 3460 cheat.exe 95 PID 3460 wrote to memory of 4056 3460 cheat.exe 95 PID 3460 wrote to memory of 4056 3460 cheat.exe 95 PID 3460 wrote to memory of 1144 3460 cheat.exe 96 PID 3460 wrote to memory of 1144 3460 cheat.exe 96 PID 3460 wrote to memory of 1144 3460 cheat.exe 96 PID 3460 wrote to memory of 3232 3460 cheat.exe 97 PID 3460 wrote to memory of 3232 3460 cheat.exe 97 PID 3460 wrote to memory of 3232 3460 cheat.exe 97 PID 3460 wrote to memory of 3232 3460 cheat.exe 97 PID 3460 wrote to memory of 3232 3460 cheat.exe 97 PID 3460 wrote to memory of 3232 3460 cheat.exe 97 PID 3460 wrote to memory of 3232 3460 cheat.exe 97 PID 3460 wrote to memory of 3232 3460 cheat.exe 97 PID 3460 wrote to memory of 3232 3460 cheat.exe 97 PID 3460 wrote to memory of 3232 3460 cheat.exe 97 PID 3460 wrote to memory of 3232 3460 cheat.exe 97 PID 3460 wrote to memory of 3232 3460 cheat.exe 97 PID 3460 wrote to memory of 3232 3460 cheat.exe 97 PID 3460 wrote to memory of 3232 3460 cheat.exe 97 PID 3460 wrote to memory of 3232 3460 cheat.exe 97 PID 3460 wrote to memory of 3232 3460 cheat.exe 97 PID 3460 wrote to memory of 3232 3460 cheat.exe 97 PID 4056 wrote to memory of 4584 4056 cmd.exe 100 PID 4056 wrote to memory of 4584 4056 cmd.exe 100 PID 4056 wrote to memory of 4584 4056 cmd.exe 100 PID 1144 wrote to memory of 4940 1144 cmd.exe 101 PID 1144 wrote to memory of 4940 1144 cmd.exe 101 PID 1144 wrote to memory of 4940 1144 cmd.exe 101 PID 3460 wrote to memory of 4636 3460 cheat.exe 103 PID 3460 wrote to memory of 4636 3460 cheat.exe 103 PID 3460 wrote to memory of 4636 3460 cheat.exe 103 PID 4636 wrote to memory of 4448 4636 msdcsc.exe 104 PID 4636 wrote to memory of 4448 4636 msdcsc.exe 104 PID 4636 wrote to memory of 4448 4636 msdcsc.exe 104 PID 4636 wrote to memory of 4448 4636 msdcsc.exe 104 PID 4636 wrote to memory of 4448 4636 msdcsc.exe 104 PID 4448 wrote to memory of 3960 4448 iexplore.exe 105 PID 4448 wrote to memory of 3960 4448 iexplore.exe 105 PID 4448 wrote to memory of 3960 4448 iexplore.exe 105 PID 4448 wrote to memory of 3960 4448 iexplore.exe 105 PID 4448 wrote to memory of 3960 4448 iexplore.exe 105 PID 4448 wrote to memory of 3960 4448 iexplore.exe 105 PID 4448 wrote to memory of 3960 4448 iexplore.exe 105 PID 4448 wrote to memory of 3960 4448 iexplore.exe 105 PID 4448 wrote to memory of 3960 4448 iexplore.exe 105 PID 4448 wrote to memory of 3960 4448 iexplore.exe 105 PID 4448 wrote to memory of 3960 4448 iexplore.exe 105 PID 4448 wrote to memory of 3960 4448 iexplore.exe 105 PID 4448 wrote to memory of 3960 4448 iexplore.exe 105 PID 4448 wrote to memory of 3960 4448 iexplore.exe 105 PID 4448 wrote to memory of 3960 4448 iexplore.exe 105 PID 4448 wrote to memory of 3960 4448 iexplore.exe 105 PID 4448 wrote to memory of 3960 4448 iexplore.exe 105 PID 4448 wrote to memory of 3960 4448 iexplore.exe 105 - System policy modification 1 TTPs 3 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\CurrentVersion\Explorern msdcsc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\CurrentVersion\Explorern\NoControlPanel = "1" msdcsc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\CurrentVersion msdcsc.exe - Views/modifies file attributes 1 TTPs 2 IoCs
pid Process 4940 attrib.exe 4584 attrib.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\c88aa7a95432159ea819744b6cff03a3.exe"C:\Users\Admin\AppData\Local\Temp\c88aa7a95432159ea819744b6cff03a3.exe"1⤵
- Checks computer location settings
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2348 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Windows\cheat.bat" "2⤵
- Suspicious use of WriteProcessMemory
PID:5028 -
C:\Windows\cheat.sfx.execheat.sfx.exe -p123 dC:\Users\Admin\AppData\Local\Temp3⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4000 -
C:\Users\Admin\AppData\Local\Temp\cheat.exe"C:\Users\Admin\AppData\Local\Temp\cheat.exe"4⤵
- Modifies WinLogon for persistence
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3460 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp\cheat.exe" +s +h5⤵
- Suspicious use of WriteProcessMemory
PID:4056 -
C:\Windows\SysWOW64\attrib.exeattrib "C:\Users\Admin\AppData\Local\Temp\cheat.exe" +s +h6⤵
- Sets file to hidden
- Views/modifies file attributes
PID:4584
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp" +s +h5⤵
- Suspicious use of WriteProcessMemory
PID:1144 -
C:\Windows\SysWOW64\attrib.exeattrib "C:\Users\Admin\AppData\Local\Temp" +s +h6⤵
- Sets file to hidden
- Views/modifies file attributes
PID:4940
-
-
-
C:\Windows\SysWOW64\notepad.exenotepad5⤵PID:3232
-
-
C:\Windows\SysWOW64\MSDCSC\msdcsc.exe"C:\Windows\system32\MSDCSC\msdcsc.exe"5⤵
- Modifies firewall policy service
- Modifies security service
- Windows security bypass
- Disables RegEdit via registry modification
- Executes dropped EXE
- Windows security modification
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:4636 -
C:\Program Files (x86)\Internet Explorer\iexplore.exe"C:\Program Files (x86)\Internet Explorer\iexplore.exe"6⤵
- Modifies firewall policy service
- Modifies security service
- Windows security bypass
- Disables RegEdit via registry modification
- Adds Run key to start application
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4448 -
C:\Windows\SysWOW64\notepad.exenotepad7⤵PID:3960
-
-
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Create or Modify System Process
2Windows Service
2Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Create or Modify System Process
2Windows Service
2Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\cheat.exe
- Size 659KB
- SHA256 8fd050778ca88e05381ec1f757cf0764a570b9c1eb98a9dde644e21a6ba53df7
- MD5 9978c5805a4eb9bc9099ba0274236cb9
- SHA1 4c70c4b36870e2675947369d723e6a284a60be92
- SHA512 49d9f8aa8f583bf4abe522e06099de6c375d38f6dd8b0d5bef1bb0418d97f314e07b273fd10acff45f37aa18b98e2c3f492af0c982a1f6146cd05c4f1aebf3dd
- SSDEEP 12288:C9HFJ9rJxRX1uVVjoaWSoynxdO1FVBaOiRZTERfIhNkNCCLo9Ek5C/h2:uZ1xuVVjfFoynPaVBUR8f+kN10EBs
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\cheat.bat
- Size 44B
- SHA256 89b095cf70aa20ed1796f2fbda57d4e3cc7f938c06cf8b71edcae5f7aba61648
- MD5 900e93361ea1ec836f0e1e2f1b6ff060
- SHA1 405780e59ef121ba4a0fe5254e955fb572bda832
- SHA512 63db943f9694dcf01cbec9e9d882c25f269fc6ef798e2595cb941ef1812e57b5a636289f8b479ab82fcbed0179038707d26fa80de30f1344f57f667af4014385
- MD5 SHA1 SHA512
- Path C:\Windows\cheat.sfx.exe
- Size 574KB
- SHA256 f30e348c446e2f0ad3f13cbbc7e79160d3321826413a6fd61e97359b47d7a0d8
- MD5 95923343623385f83e041beac216f862
- SHA1 003a0b70af1858c125f7ee168c9f5f82099dbb89
- SHA512 13e786f3a92baff6edb8b52fc9ade8fb6a3b0ef3edf04d6fb76af407c317960ac945fffbed29ff7c31274d057bda98adbd5487fedc8fed73cd9806e1d9e5cbba
- SSDEEP 12288:IzxzTDWikLSb4NS7t2X+t40XS+pPl27wduuKBmqYC0K0IJ7Rwk:+DWHSb4Nc0n+nOwdyBOCVP
- MD5 SHA1 SHA512 SSDEEP