Analysis
-
max time kernel
150s -
max time network
143s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
17-03-2024 19:12
Static task
static1
Behavioral task
behavioral1
Sample
d1a6927a0ad7b9a1eb072535aa3879ab.exe
Resource
win7-20231129-en
General
-
Target
d1a6927a0ad7b9a1eb072535aa3879ab.exe
-
Size
708KB
-
MD5
d1a6927a0ad7b9a1eb072535aa3879ab
-
SHA1
989cc5e58c7f0de80d5dfcb0468b812192c4c3ef
-
SHA256
7ddbcb26b9c3afc287c094d534ee051f311c258db1c5d2082b384de4b2207c1a
-
SHA512
8474cae8e14037913c740a52628242bf434e315139d6d23626859c96beb06b497f024cb8ba3ad689d94cc2f8a23408cf09e3c2718ab29fd0053d379ca6bb99c4
-
SSDEEP
12288:tk6zJDIYsrXd0+tMt+sH2ept70Q93Fohby5KNK5u3z9HRI0WRooTalj8:tk6zJDIYs7dKH2ecQxgbpsyHRI049TaS
Malware Config
Extracted
darkcomet
Guest16
lolscape12345.zapto.org:4444
coderscape.net84.net:4444
127.0.0.1:4444
192.168.0.3:4444
77.96.90.48:4444
DC_MUTEX-KLX6V48
-
gencode
YCMTuRTxJEkt
-
install
false
-
offline_keylogger
true
-
persistence
false
Extracted
latentbot
lolscape12345.zapto.org
Signatures
-
Sets file to hidden 1 TTPs 2 IoCs
Modifies file attributes to stop it showing in Explorer etc.
Processes:
attrib.exeattrib.exepid process 2516 attrib.exe 2532 attrib.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
d1a6927a0ad7b9a1eb072535aa3879ab.exedescription pid process target process PID 2044 set thread context of 2880 2044 d1a6927a0ad7b9a1eb072535aa3879ab.exe cvtres.exe -
Drops file in Windows directory 2 IoCs
Processes:
attrib.exeattrib.exedescription ioc process File opened for modification C:\Windows\Microsoft.NET\Framework\v2.0.50727 attrib.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe attrib.exe -
Suspicious behavior: EnumeratesProcesses 12 IoCs
Processes:
d1a6927a0ad7b9a1eb072535aa3879ab.exepid process 2044 d1a6927a0ad7b9a1eb072535aa3879ab.exe 2044 d1a6927a0ad7b9a1eb072535aa3879ab.exe 2044 d1a6927a0ad7b9a1eb072535aa3879ab.exe 2044 d1a6927a0ad7b9a1eb072535aa3879ab.exe 2044 d1a6927a0ad7b9a1eb072535aa3879ab.exe 2044 d1a6927a0ad7b9a1eb072535aa3879ab.exe 2044 d1a6927a0ad7b9a1eb072535aa3879ab.exe 2044 d1a6927a0ad7b9a1eb072535aa3879ab.exe 2044 d1a6927a0ad7b9a1eb072535aa3879ab.exe 2044 d1a6927a0ad7b9a1eb072535aa3879ab.exe 2044 d1a6927a0ad7b9a1eb072535aa3879ab.exe 2044 d1a6927a0ad7b9a1eb072535aa3879ab.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
cvtres.exepid process 2880 cvtres.exe -
Suspicious use of AdjustPrivilegeToken 24 IoCs
Processes:
d1a6927a0ad7b9a1eb072535aa3879ab.execvtres.exedescription pid process Token: SeDebugPrivilege 2044 d1a6927a0ad7b9a1eb072535aa3879ab.exe Token: SeIncreaseQuotaPrivilege 2880 cvtres.exe Token: SeSecurityPrivilege 2880 cvtres.exe Token: SeTakeOwnershipPrivilege 2880 cvtres.exe Token: SeLoadDriverPrivilege 2880 cvtres.exe Token: SeSystemProfilePrivilege 2880 cvtres.exe Token: SeSystemtimePrivilege 2880 cvtres.exe Token: SeProfSingleProcessPrivilege 2880 cvtres.exe Token: SeIncBasePriorityPrivilege 2880 cvtres.exe Token: SeCreatePagefilePrivilege 2880 cvtres.exe Token: SeBackupPrivilege 2880 cvtres.exe Token: SeRestorePrivilege 2880 cvtres.exe Token: SeShutdownPrivilege 2880 cvtres.exe Token: SeDebugPrivilege 2880 cvtres.exe Token: SeSystemEnvironmentPrivilege 2880 cvtres.exe Token: SeChangeNotifyPrivilege 2880 cvtres.exe Token: SeRemoteShutdownPrivilege 2880 cvtres.exe Token: SeUndockPrivilege 2880 cvtres.exe Token: SeManageVolumePrivilege 2880 cvtres.exe Token: SeImpersonatePrivilege 2880 cvtres.exe Token: SeCreateGlobalPrivilege 2880 cvtres.exe Token: 33 2880 cvtres.exe Token: 34 2880 cvtres.exe Token: 35 2880 cvtres.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
cvtres.exepid process 2880 cvtres.exe -
Suspicious use of WriteProcessMemory 52 IoCs
Processes:
d1a6927a0ad7b9a1eb072535aa3879ab.execvtres.execmd.execmd.exedescription pid process target process PID 2044 wrote to memory of 2880 2044 d1a6927a0ad7b9a1eb072535aa3879ab.exe cvtres.exe PID 2044 wrote to memory of 2880 2044 d1a6927a0ad7b9a1eb072535aa3879ab.exe cvtres.exe PID 2044 wrote to memory of 2880 2044 d1a6927a0ad7b9a1eb072535aa3879ab.exe cvtres.exe PID 2044 wrote to memory of 2880 2044 d1a6927a0ad7b9a1eb072535aa3879ab.exe cvtres.exe PID 2044 wrote to memory of 2880 2044 d1a6927a0ad7b9a1eb072535aa3879ab.exe cvtres.exe PID 2044 wrote to memory of 2880 2044 d1a6927a0ad7b9a1eb072535aa3879ab.exe cvtres.exe PID 2044 wrote to memory of 2880 2044 d1a6927a0ad7b9a1eb072535aa3879ab.exe cvtres.exe PID 2044 wrote to memory of 2880 2044 d1a6927a0ad7b9a1eb072535aa3879ab.exe cvtres.exe PID 2044 wrote to memory of 2880 2044 d1a6927a0ad7b9a1eb072535aa3879ab.exe cvtres.exe PID 2044 wrote to memory of 2880 2044 d1a6927a0ad7b9a1eb072535aa3879ab.exe cvtres.exe PID 2044 wrote to memory of 2880 2044 d1a6927a0ad7b9a1eb072535aa3879ab.exe cvtres.exe PID 2044 wrote to memory of 2880 2044 d1a6927a0ad7b9a1eb072535aa3879ab.exe cvtres.exe PID 2044 wrote to memory of 2880 2044 d1a6927a0ad7b9a1eb072535aa3879ab.exe cvtres.exe PID 2880 wrote to memory of 2676 2880 cvtres.exe cmd.exe PID 2880 wrote to memory of 2676 2880 cvtres.exe cmd.exe PID 2880 wrote to memory of 2676 2880 cvtres.exe cmd.exe PID 2880 wrote to memory of 2676 2880 cvtres.exe cmd.exe PID 2880 wrote to memory of 2600 2880 cvtres.exe cmd.exe PID 2880 wrote to memory of 2600 2880 cvtres.exe cmd.exe PID 2880 wrote to memory of 2600 2880 cvtres.exe cmd.exe PID 2880 wrote to memory of 2600 2880 cvtres.exe cmd.exe PID 2880 wrote to memory of 2968 2880 cvtres.exe notepad.exe PID 2880 wrote to memory of 2968 2880 cvtres.exe notepad.exe PID 2880 wrote to memory of 2968 2880 cvtres.exe notepad.exe PID 2880 wrote to memory of 2968 2880 cvtres.exe notepad.exe PID 2880 wrote to memory of 2968 2880 cvtres.exe notepad.exe PID 2880 wrote to memory of 2968 2880 cvtres.exe notepad.exe PID 2880 wrote to memory of 2968 2880 cvtres.exe notepad.exe PID 2880 wrote to memory of 2968 2880 cvtres.exe notepad.exe PID 2880 wrote to memory of 2968 2880 cvtres.exe notepad.exe PID 2880 wrote to memory of 2968 2880 cvtres.exe notepad.exe PID 2880 wrote to memory of 2968 2880 cvtres.exe notepad.exe PID 2880 wrote to memory of 2968 2880 cvtres.exe notepad.exe PID 2880 wrote to memory of 2968 2880 cvtres.exe notepad.exe PID 2880 wrote to memory of 2968 2880 cvtres.exe notepad.exe PID 2880 wrote to memory of 2968 2880 cvtres.exe notepad.exe PID 2880 wrote to memory of 2968 2880 cvtres.exe notepad.exe PID 2880 wrote to memory of 2968 2880 cvtres.exe notepad.exe PID 2880 wrote to memory of 2968 2880 cvtres.exe notepad.exe PID 2880 wrote to memory of 2968 2880 cvtres.exe notepad.exe PID 2880 wrote to memory of 2968 2880 cvtres.exe notepad.exe PID 2880 wrote to memory of 2968 2880 cvtres.exe notepad.exe PID 2880 wrote to memory of 2968 2880 cvtres.exe notepad.exe PID 2880 wrote to memory of 2968 2880 cvtres.exe notepad.exe PID 2676 wrote to memory of 2516 2676 cmd.exe attrib.exe PID 2676 wrote to memory of 2516 2676 cmd.exe attrib.exe PID 2676 wrote to memory of 2516 2676 cmd.exe attrib.exe PID 2676 wrote to memory of 2516 2676 cmd.exe attrib.exe PID 2600 wrote to memory of 2532 2600 cmd.exe attrib.exe PID 2600 wrote to memory of 2532 2600 cmd.exe attrib.exe PID 2600 wrote to memory of 2532 2600 cmd.exe attrib.exe PID 2600 wrote to memory of 2532 2600 cmd.exe attrib.exe -
Views/modifies file attributes 1 TTPs 2 IoCs
Processes:
attrib.exeattrib.exepid process 2532 attrib.exe 2516 attrib.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\d1a6927a0ad7b9a1eb072535aa3879ab.exe"C:\Users\Admin\AppData\Local\Temp\d1a6927a0ad7b9a1eb072535aa3879ab.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exeC:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe2⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe" +s +h3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe" +s +h4⤵
- Sets file to hidden
- Drops file in Windows directory
- Views/modifies file attributes
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\Microsoft.NET\Framework\v2.0.50727" +s +h3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\Microsoft.NET\Framework\v2.0.50727" +s +h4⤵
- Sets file to hidden
- Drops file in Windows directory
- Views/modifies file attributes
-
C:\Windows\SysWOW64\notepad.exenotepad3⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2044-0-0x00000000747D0000-0x0000000074D7B000-memory.dmpFilesize
5.7MB
-
memory/2044-1-0x00000000747D0000-0x0000000074D7B000-memory.dmpFilesize
5.7MB
-
memory/2044-2-0x0000000002190000-0x00000000021D0000-memory.dmpFilesize
256KB
-
memory/2044-24-0x00000000747D0000-0x0000000074D7B000-memory.dmpFilesize
5.7MB
-
memory/2880-11-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/2880-26-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/2880-9-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/2880-5-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/2880-13-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/2880-15-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/2880-17-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/2880-21-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/2880-19-0x000000007EFDE000-0x000000007EFDF000-memory.dmpFilesize
4KB
-
memory/2880-22-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/2880-3-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/2880-23-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/2880-25-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/2880-7-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/2880-27-0x00000000002F0000-0x00000000002F1000-memory.dmpFilesize
4KB
-
memory/2880-28-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/2880-70-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/2880-57-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/2880-58-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/2880-67-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/2880-59-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/2880-61-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/2880-63-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/2880-65-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/2968-56-0x00000000002A0000-0x00000000002A1000-memory.dmpFilesize
4KB
-
memory/2968-29-0x00000000000C0000-0x00000000000C1000-memory.dmpFilesize
4KB