Analysis
-
max time kernel
150s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
17-03-2024 19:12
Static task
static1
Behavioral task
behavioral1
Sample
d1a6927a0ad7b9a1eb072535aa3879ab.exe
Resource
win7-20231129-en
General
-
Target
d1a6927a0ad7b9a1eb072535aa3879ab.exe
-
Size
708KB
-
MD5
d1a6927a0ad7b9a1eb072535aa3879ab
-
SHA1
989cc5e58c7f0de80d5dfcb0468b812192c4c3ef
-
SHA256
7ddbcb26b9c3afc287c094d534ee051f311c258db1c5d2082b384de4b2207c1a
-
SHA512
8474cae8e14037913c740a52628242bf434e315139d6d23626859c96beb06b497f024cb8ba3ad689d94cc2f8a23408cf09e3c2718ab29fd0053d379ca6bb99c4
-
SSDEEP
12288:tk6zJDIYsrXd0+tMt+sH2ept70Q93Fohby5KNK5u3z9HRI0WRooTalj8:tk6zJDIYs7dKH2ecQxgbpsyHRI049TaS
Malware Config
Extracted
darkcomet
Guest16
lolscape12345.zapto.org:4444
coderscape.net84.net:4444
127.0.0.1:4444
192.168.0.3:4444
77.96.90.48:4444
DC_MUTEX-KLX6V48
-
gencode
YCMTuRTxJEkt
-
install
false
-
offline_keylogger
true
-
persistence
false
Extracted
latentbot
lolscape12345.zapto.org
Signatures
-
Sets file to hidden 1 TTPs 2 IoCs
Modifies file attributes to stop it showing in Explorer etc.
Processes:
attrib.exeattrib.exepid process 4288 attrib.exe 2228 attrib.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
d1a6927a0ad7b9a1eb072535aa3879ab.exedescription pid process target process PID 3720 set thread context of 1720 3720 d1a6927a0ad7b9a1eb072535aa3879ab.exe cvtres.exe -
Drops file in Windows directory 2 IoCs
Processes:
attrib.exeattrib.exedescription ioc process File opened for modification C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe attrib.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v2.0.50727 attrib.exe -
Suspicious behavior: EnumeratesProcesses 12 IoCs
Processes:
d1a6927a0ad7b9a1eb072535aa3879ab.exepid process 3720 d1a6927a0ad7b9a1eb072535aa3879ab.exe 3720 d1a6927a0ad7b9a1eb072535aa3879ab.exe 3720 d1a6927a0ad7b9a1eb072535aa3879ab.exe 3720 d1a6927a0ad7b9a1eb072535aa3879ab.exe 3720 d1a6927a0ad7b9a1eb072535aa3879ab.exe 3720 d1a6927a0ad7b9a1eb072535aa3879ab.exe 3720 d1a6927a0ad7b9a1eb072535aa3879ab.exe 3720 d1a6927a0ad7b9a1eb072535aa3879ab.exe 3720 d1a6927a0ad7b9a1eb072535aa3879ab.exe 3720 d1a6927a0ad7b9a1eb072535aa3879ab.exe 3720 d1a6927a0ad7b9a1eb072535aa3879ab.exe 3720 d1a6927a0ad7b9a1eb072535aa3879ab.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
cvtres.exepid process 1720 cvtres.exe -
Suspicious use of AdjustPrivilegeToken 25 IoCs
Processes:
d1a6927a0ad7b9a1eb072535aa3879ab.execvtres.exedescription pid process Token: SeDebugPrivilege 3720 d1a6927a0ad7b9a1eb072535aa3879ab.exe Token: SeIncreaseQuotaPrivilege 1720 cvtres.exe Token: SeSecurityPrivilege 1720 cvtres.exe Token: SeTakeOwnershipPrivilege 1720 cvtres.exe Token: SeLoadDriverPrivilege 1720 cvtres.exe Token: SeSystemProfilePrivilege 1720 cvtres.exe Token: SeSystemtimePrivilege 1720 cvtres.exe Token: SeProfSingleProcessPrivilege 1720 cvtres.exe Token: SeIncBasePriorityPrivilege 1720 cvtres.exe Token: SeCreatePagefilePrivilege 1720 cvtres.exe Token: SeBackupPrivilege 1720 cvtres.exe Token: SeRestorePrivilege 1720 cvtres.exe Token: SeShutdownPrivilege 1720 cvtres.exe Token: SeDebugPrivilege 1720 cvtres.exe Token: SeSystemEnvironmentPrivilege 1720 cvtres.exe Token: SeChangeNotifyPrivilege 1720 cvtres.exe Token: SeRemoteShutdownPrivilege 1720 cvtres.exe Token: SeUndockPrivilege 1720 cvtres.exe Token: SeManageVolumePrivilege 1720 cvtres.exe Token: SeImpersonatePrivilege 1720 cvtres.exe Token: SeCreateGlobalPrivilege 1720 cvtres.exe Token: 33 1720 cvtres.exe Token: 34 1720 cvtres.exe Token: 35 1720 cvtres.exe Token: 36 1720 cvtres.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
cvtres.exepid process 1720 cvtres.exe -
Suspicious use of WriteProcessMemory 48 IoCs
Processes:
d1a6927a0ad7b9a1eb072535aa3879ab.execvtres.execmd.execmd.exedescription pid process target process PID 3720 wrote to memory of 1720 3720 d1a6927a0ad7b9a1eb072535aa3879ab.exe cvtres.exe PID 3720 wrote to memory of 1720 3720 d1a6927a0ad7b9a1eb072535aa3879ab.exe cvtres.exe PID 3720 wrote to memory of 1720 3720 d1a6927a0ad7b9a1eb072535aa3879ab.exe cvtres.exe PID 3720 wrote to memory of 1720 3720 d1a6927a0ad7b9a1eb072535aa3879ab.exe cvtres.exe PID 3720 wrote to memory of 1720 3720 d1a6927a0ad7b9a1eb072535aa3879ab.exe cvtres.exe PID 3720 wrote to memory of 1720 3720 d1a6927a0ad7b9a1eb072535aa3879ab.exe cvtres.exe PID 3720 wrote to memory of 1720 3720 d1a6927a0ad7b9a1eb072535aa3879ab.exe cvtres.exe PID 3720 wrote to memory of 1720 3720 d1a6927a0ad7b9a1eb072535aa3879ab.exe cvtres.exe PID 3720 wrote to memory of 1720 3720 d1a6927a0ad7b9a1eb072535aa3879ab.exe cvtres.exe PID 3720 wrote to memory of 1720 3720 d1a6927a0ad7b9a1eb072535aa3879ab.exe cvtres.exe PID 3720 wrote to memory of 1720 3720 d1a6927a0ad7b9a1eb072535aa3879ab.exe cvtres.exe PID 3720 wrote to memory of 1720 3720 d1a6927a0ad7b9a1eb072535aa3879ab.exe cvtres.exe PID 3720 wrote to memory of 1720 3720 d1a6927a0ad7b9a1eb072535aa3879ab.exe cvtres.exe PID 3720 wrote to memory of 1720 3720 d1a6927a0ad7b9a1eb072535aa3879ab.exe cvtres.exe PID 1720 wrote to memory of 4732 1720 cvtres.exe cmd.exe PID 1720 wrote to memory of 4732 1720 cvtres.exe cmd.exe PID 1720 wrote to memory of 4732 1720 cvtres.exe cmd.exe PID 1720 wrote to memory of 3096 1720 cvtres.exe cmd.exe PID 1720 wrote to memory of 3096 1720 cvtres.exe cmd.exe PID 1720 wrote to memory of 3096 1720 cvtres.exe cmd.exe PID 1720 wrote to memory of 3764 1720 cvtres.exe notepad.exe PID 1720 wrote to memory of 3764 1720 cvtres.exe notepad.exe PID 1720 wrote to memory of 3764 1720 cvtres.exe notepad.exe PID 1720 wrote to memory of 3764 1720 cvtres.exe notepad.exe PID 1720 wrote to memory of 3764 1720 cvtres.exe notepad.exe PID 1720 wrote to memory of 3764 1720 cvtres.exe notepad.exe PID 1720 wrote to memory of 3764 1720 cvtres.exe notepad.exe PID 1720 wrote to memory of 3764 1720 cvtres.exe notepad.exe PID 1720 wrote to memory of 3764 1720 cvtres.exe notepad.exe PID 1720 wrote to memory of 3764 1720 cvtres.exe notepad.exe PID 1720 wrote to memory of 3764 1720 cvtres.exe notepad.exe PID 1720 wrote to memory of 3764 1720 cvtres.exe notepad.exe PID 1720 wrote to memory of 3764 1720 cvtres.exe notepad.exe PID 1720 wrote to memory of 3764 1720 cvtres.exe notepad.exe PID 1720 wrote to memory of 3764 1720 cvtres.exe notepad.exe PID 1720 wrote to memory of 3764 1720 cvtres.exe notepad.exe PID 1720 wrote to memory of 3764 1720 cvtres.exe notepad.exe PID 1720 wrote to memory of 3764 1720 cvtres.exe notepad.exe PID 1720 wrote to memory of 3764 1720 cvtres.exe notepad.exe PID 1720 wrote to memory of 3764 1720 cvtres.exe notepad.exe PID 1720 wrote to memory of 3764 1720 cvtres.exe notepad.exe PID 1720 wrote to memory of 3764 1720 cvtres.exe notepad.exe PID 4732 wrote to memory of 2228 4732 cmd.exe attrib.exe PID 4732 wrote to memory of 2228 4732 cmd.exe attrib.exe PID 4732 wrote to memory of 2228 4732 cmd.exe attrib.exe PID 3096 wrote to memory of 4288 3096 cmd.exe attrib.exe PID 3096 wrote to memory of 4288 3096 cmd.exe attrib.exe PID 3096 wrote to memory of 4288 3096 cmd.exe attrib.exe -
Views/modifies file attributes 1 TTPs 2 IoCs
Processes:
attrib.exeattrib.exepid process 2228 attrib.exe 4288 attrib.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\d1a6927a0ad7b9a1eb072535aa3879ab.exe"C:\Users\Admin\AppData\Local\Temp\d1a6927a0ad7b9a1eb072535aa3879ab.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exeC:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe2⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe" +s +h3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe" +s +h4⤵
- Sets file to hidden
- Drops file in Windows directory
- Views/modifies file attributes
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\Microsoft.NET\Framework\v2.0.50727" +s +h3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\Microsoft.NET\Framework\v2.0.50727" +s +h4⤵
- Sets file to hidden
- Drops file in Windows directory
- Views/modifies file attributes
-
C:\Windows\SysWOW64\notepad.exenotepad3⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1720-9-0x0000000002420000-0x0000000002421000-memory.dmpFilesize
4KB
-
memory/1720-27-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/1720-10-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/1720-4-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/1720-3-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/1720-6-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/1720-22-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/1720-8-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/1720-20-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/1720-18-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/1720-12-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/1720-16-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/1720-13-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/1720-14-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/3720-1-0x0000000075470000-0x0000000075A21000-memory.dmpFilesize
5.7MB
-
memory/3720-2-0x0000000000DA0000-0x0000000000DB0000-memory.dmpFilesize
64KB
-
memory/3720-7-0x0000000075470000-0x0000000075A21000-memory.dmpFilesize
5.7MB
-
memory/3720-0-0x0000000075470000-0x0000000075A21000-memory.dmpFilesize
5.7MB
-
memory/3764-11-0x00000000007C0000-0x00000000007C1000-memory.dmpFilesize
4KB