Analysis
-
max time kernel
151s -
max time network
153s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
02-04-2024 13:53
Static task
static1
Behavioral task
behavioral1
Sample
eddb245a5dc0d8f70ffb66c033cbaa38ea4639d900739c5580bc37d86f258816.exe
Resource
win7-20240221-en
General
-
Target
eddb245a5dc0d8f70ffb66c033cbaa38ea4639d900739c5580bc37d86f258816.exe
-
Size
350KB
-
MD5
220fd88ed61a81dd7238c8385fc8c5f7
-
SHA1
b4c6ea98e705912f38816bd4aff085871b1bae80
-
SHA256
eddb245a5dc0d8f70ffb66c033cbaa38ea4639d900739c5580bc37d86f258816
-
SHA512
355aad3cc89c3d6acaf53a7091903d6b0b4092e1f4c7bc6c41255a7aafce00d3807ddad4b5c027a0437938e17278f7a8d591a085b4e014fff8d6165fdeb6838f
-
SSDEEP
6144:hSncRldcNYS996KFifeVjBpeExgVTFSXFoMc5RhCaL37wxM:Q4jcW7KEZlPzCy37
Malware Config
Extracted
darkcomet
Guest16
sussynv83dj893.duckdns.org:1604
DC_MUTEX-RU83HNV
-
InstallPath
MSDCSC\msdcsc.exe
-
gencode
MFz6heXQQ4jP
-
install
true
-
offline_keylogger
true
-
persistence
false
-
reg_key
MicroUpdate
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
Processes:
ASDKODGS.EXEdescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Users\\Admin\\Documents\\MSDCSC\\msdcsc.exe" ASDKODGS.EXE -
Sets file to hidden 1 TTPs 2 IoCs
Modifies file attributes to stop it showing in Explorer etc.
Processes:
attrib.exeattrib.exepid process 2556 attrib.exe 2524 attrib.exe -
Executes dropped EXE 3 IoCs
Processes:
ASDKODGS.EXEZBYTE2.0.EXEmsdcsc.exepid process 3048 ASDKODGS.EXE 2072 ZBYTE2.0.EXE 2608 msdcsc.exe -
Loads dropped DLL 5 IoCs
Processes:
eddb245a5dc0d8f70ffb66c033cbaa38ea4639d900739c5580bc37d86f258816.exeASDKODGS.EXEpid process 2856 eddb245a5dc0d8f70ffb66c033cbaa38ea4639d900739c5580bc37d86f258816.exe 2856 eddb245a5dc0d8f70ffb66c033cbaa38ea4639d900739c5580bc37d86f258816.exe 2856 eddb245a5dc0d8f70ffb66c033cbaa38ea4639d900739c5580bc37d86f258816.exe 3048 ASDKODGS.EXE 3048 ASDKODGS.EXE -
Processes:
resource yara_rule \Users\Admin\AppData\Local\Temp\ASDKODGS.EXE upx behavioral1/memory/2856-3-0x00000000025F0000-0x00000000026A7000-memory.dmp upx behavioral1/memory/3048-12-0x0000000000400000-0x00000000004B7000-memory.dmp upx behavioral1/memory/2608-61-0x0000000000400000-0x00000000004B7000-memory.dmp upx behavioral1/memory/3048-63-0x0000000000400000-0x00000000004B7000-memory.dmp upx behavioral1/memory/2608-66-0x0000000000400000-0x00000000004B7000-memory.dmp upx behavioral1/memory/2608-70-0x0000000000400000-0x00000000004B7000-memory.dmp upx behavioral1/memory/2608-72-0x0000000000400000-0x00000000004B7000-memory.dmp upx -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
ASDKODGS.EXEdescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Users\\Admin\\Documents\\MSDCSC\\msdcsc.exe" ASDKODGS.EXE -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
msdcsc.exepid process 2608 msdcsc.exe -
Suspicious use of AdjustPrivilegeToken 46 IoCs
Processes:
ASDKODGS.EXEmsdcsc.exedescription pid process Token: SeIncreaseQuotaPrivilege 3048 ASDKODGS.EXE Token: SeSecurityPrivilege 3048 ASDKODGS.EXE Token: SeTakeOwnershipPrivilege 3048 ASDKODGS.EXE Token: SeLoadDriverPrivilege 3048 ASDKODGS.EXE Token: SeSystemProfilePrivilege 3048 ASDKODGS.EXE Token: SeSystemtimePrivilege 3048 ASDKODGS.EXE Token: SeProfSingleProcessPrivilege 3048 ASDKODGS.EXE Token: SeIncBasePriorityPrivilege 3048 ASDKODGS.EXE Token: SeCreatePagefilePrivilege 3048 ASDKODGS.EXE Token: SeBackupPrivilege 3048 ASDKODGS.EXE Token: SeRestorePrivilege 3048 ASDKODGS.EXE Token: SeShutdownPrivilege 3048 ASDKODGS.EXE Token: SeDebugPrivilege 3048 ASDKODGS.EXE Token: SeSystemEnvironmentPrivilege 3048 ASDKODGS.EXE Token: SeChangeNotifyPrivilege 3048 ASDKODGS.EXE Token: SeRemoteShutdownPrivilege 3048 ASDKODGS.EXE Token: SeUndockPrivilege 3048 ASDKODGS.EXE Token: SeManageVolumePrivilege 3048 ASDKODGS.EXE Token: SeImpersonatePrivilege 3048 ASDKODGS.EXE Token: SeCreateGlobalPrivilege 3048 ASDKODGS.EXE Token: 33 3048 ASDKODGS.EXE Token: 34 3048 ASDKODGS.EXE Token: 35 3048 ASDKODGS.EXE Token: SeIncreaseQuotaPrivilege 2608 msdcsc.exe Token: SeSecurityPrivilege 2608 msdcsc.exe Token: SeTakeOwnershipPrivilege 2608 msdcsc.exe Token: SeLoadDriverPrivilege 2608 msdcsc.exe Token: SeSystemProfilePrivilege 2608 msdcsc.exe Token: SeSystemtimePrivilege 2608 msdcsc.exe Token: SeProfSingleProcessPrivilege 2608 msdcsc.exe Token: SeIncBasePriorityPrivilege 2608 msdcsc.exe Token: SeCreatePagefilePrivilege 2608 msdcsc.exe Token: SeBackupPrivilege 2608 msdcsc.exe Token: SeRestorePrivilege 2608 msdcsc.exe Token: SeShutdownPrivilege 2608 msdcsc.exe Token: SeDebugPrivilege 2608 msdcsc.exe Token: SeSystemEnvironmentPrivilege 2608 msdcsc.exe Token: SeChangeNotifyPrivilege 2608 msdcsc.exe Token: SeRemoteShutdownPrivilege 2608 msdcsc.exe Token: SeUndockPrivilege 2608 msdcsc.exe Token: SeManageVolumePrivilege 2608 msdcsc.exe Token: SeImpersonatePrivilege 2608 msdcsc.exe Token: SeCreateGlobalPrivilege 2608 msdcsc.exe Token: 33 2608 msdcsc.exe Token: 34 2608 msdcsc.exe Token: 35 2608 msdcsc.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
msdcsc.exepid process 2608 msdcsc.exe -
Suspicious use of WriteProcessMemory 51 IoCs
Processes:
eddb245a5dc0d8f70ffb66c033cbaa38ea4639d900739c5580bc37d86f258816.exeASDKODGS.EXEcmd.execmd.exemsdcsc.exedescription pid process target process PID 2856 wrote to memory of 3048 2856 eddb245a5dc0d8f70ffb66c033cbaa38ea4639d900739c5580bc37d86f258816.exe ASDKODGS.EXE PID 2856 wrote to memory of 3048 2856 eddb245a5dc0d8f70ffb66c033cbaa38ea4639d900739c5580bc37d86f258816.exe ASDKODGS.EXE PID 2856 wrote to memory of 3048 2856 eddb245a5dc0d8f70ffb66c033cbaa38ea4639d900739c5580bc37d86f258816.exe ASDKODGS.EXE PID 2856 wrote to memory of 3048 2856 eddb245a5dc0d8f70ffb66c033cbaa38ea4639d900739c5580bc37d86f258816.exe ASDKODGS.EXE PID 2856 wrote to memory of 2072 2856 eddb245a5dc0d8f70ffb66c033cbaa38ea4639d900739c5580bc37d86f258816.exe ZBYTE2.0.EXE PID 2856 wrote to memory of 2072 2856 eddb245a5dc0d8f70ffb66c033cbaa38ea4639d900739c5580bc37d86f258816.exe ZBYTE2.0.EXE PID 2856 wrote to memory of 2072 2856 eddb245a5dc0d8f70ffb66c033cbaa38ea4639d900739c5580bc37d86f258816.exe ZBYTE2.0.EXE PID 2856 wrote to memory of 2072 2856 eddb245a5dc0d8f70ffb66c033cbaa38ea4639d900739c5580bc37d86f258816.exe ZBYTE2.0.EXE PID 3048 wrote to memory of 1072 3048 ASDKODGS.EXE cmd.exe PID 3048 wrote to memory of 1072 3048 ASDKODGS.EXE cmd.exe PID 3048 wrote to memory of 1072 3048 ASDKODGS.EXE cmd.exe PID 3048 wrote to memory of 1072 3048 ASDKODGS.EXE cmd.exe PID 3048 wrote to memory of 2336 3048 ASDKODGS.EXE cmd.exe PID 3048 wrote to memory of 2336 3048 ASDKODGS.EXE cmd.exe PID 3048 wrote to memory of 2336 3048 ASDKODGS.EXE cmd.exe PID 3048 wrote to memory of 2336 3048 ASDKODGS.EXE cmd.exe PID 3048 wrote to memory of 2608 3048 ASDKODGS.EXE msdcsc.exe PID 3048 wrote to memory of 2608 3048 ASDKODGS.EXE msdcsc.exe PID 3048 wrote to memory of 2608 3048 ASDKODGS.EXE msdcsc.exe PID 3048 wrote to memory of 2608 3048 ASDKODGS.EXE msdcsc.exe PID 2336 wrote to memory of 2524 2336 cmd.exe attrib.exe PID 2336 wrote to memory of 2524 2336 cmd.exe attrib.exe PID 2336 wrote to memory of 2524 2336 cmd.exe attrib.exe PID 2336 wrote to memory of 2524 2336 cmd.exe attrib.exe PID 1072 wrote to memory of 2556 1072 cmd.exe attrib.exe PID 1072 wrote to memory of 2556 1072 cmd.exe attrib.exe PID 1072 wrote to memory of 2556 1072 cmd.exe attrib.exe PID 1072 wrote to memory of 2556 1072 cmd.exe attrib.exe PID 2608 wrote to memory of 2668 2608 msdcsc.exe notepad.exe PID 2608 wrote to memory of 2668 2608 msdcsc.exe notepad.exe PID 2608 wrote to memory of 2668 2608 msdcsc.exe notepad.exe PID 2608 wrote to memory of 2668 2608 msdcsc.exe notepad.exe PID 2608 wrote to memory of 2668 2608 msdcsc.exe notepad.exe PID 2608 wrote to memory of 2668 2608 msdcsc.exe notepad.exe PID 2608 wrote to memory of 2668 2608 msdcsc.exe notepad.exe PID 2608 wrote to memory of 2668 2608 msdcsc.exe notepad.exe PID 2608 wrote to memory of 2668 2608 msdcsc.exe notepad.exe PID 2608 wrote to memory of 2668 2608 msdcsc.exe notepad.exe PID 2608 wrote to memory of 2668 2608 msdcsc.exe notepad.exe PID 2608 wrote to memory of 2668 2608 msdcsc.exe notepad.exe PID 2608 wrote to memory of 2668 2608 msdcsc.exe notepad.exe PID 2608 wrote to memory of 2668 2608 msdcsc.exe notepad.exe PID 2608 wrote to memory of 2668 2608 msdcsc.exe notepad.exe PID 2608 wrote to memory of 2668 2608 msdcsc.exe notepad.exe PID 2608 wrote to memory of 2668 2608 msdcsc.exe notepad.exe PID 2608 wrote to memory of 2668 2608 msdcsc.exe notepad.exe PID 2608 wrote to memory of 2668 2608 msdcsc.exe notepad.exe PID 2608 wrote to memory of 2668 2608 msdcsc.exe notepad.exe PID 2608 wrote to memory of 2668 2608 msdcsc.exe notepad.exe PID 2608 wrote to memory of 2668 2608 msdcsc.exe notepad.exe PID 2608 wrote to memory of 2668 2608 msdcsc.exe notepad.exe -
Views/modifies file attributes 1 TTPs 2 IoCs
Processes:
attrib.exeattrib.exepid process 2556 attrib.exe 2524 attrib.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\eddb245a5dc0d8f70ffb66c033cbaa38ea4639d900739c5580bc37d86f258816.exe"C:\Users\Admin\AppData\Local\Temp\eddb245a5dc0d8f70ffb66c033cbaa38ea4639d900739c5580bc37d86f258816.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\ASDKODGS.EXE"C:\Users\Admin\AppData\Local\Temp\ASDKODGS.EXE"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp\ASDKODGS.EXE" +s +h3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Users\Admin\AppData\Local\Temp\ASDKODGS.EXE" +s +h4⤵
- Sets file to hidden
- Views/modifies file attributes
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp" +s +h3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Users\Admin\AppData\Local\Temp" +s +h4⤵
- Sets file to hidden
- Views/modifies file attributes
-
C:\Users\Admin\Documents\MSDCSC\msdcsc.exe"C:\Users\Admin\Documents\MSDCSC\msdcsc.exe"3⤵
- Executes dropped EXE
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\notepad.exenotepad4⤵
-
C:\Users\Admin\AppData\Local\Temp\ZBYTE2.0.EXE"C:\Users\Admin\AppData\Local\Temp\ZBYTE2.0.EXE"2⤵
- Executes dropped EXE
Network
MITRE ATT&CK Matrix ATT&CK v13
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Replay Monitor
Loading Replay Monitor...
Downloads
-
\Users\Admin\AppData\Local\Temp\ASDKODGS.EXEFilesize
251KB
MD50055ec3943749262735d79fcb4f04119
SHA1b2c2dce19536c945785534f9fa4b5062ec43d541
SHA25685bfcf8f009f442c997e9aa5ddb9430fd8e55b98c1c6108e248d9aa901f15c0b
SHA51272b1873565f9fe8c8ae273df2805f2f1a126581f67bdead56c6818637c9026d6ff7f36bc4280de58b18e9670b209006db404ee7122cd5fd830e6464590f3b807
-
\Users\Admin\AppData\Local\Temp\ZBYTE2.0.EXEFilesize
46KB
MD5fc90c2fb06b099a072bd23f4722c591d
SHA169c2f9af2391b3311ce344a922ac650b0f3456b9
SHA256e0df4445f3486b15b57da921ddc15b3137a5f2eb035f34130bc51f6be16d747e
SHA512c3e87df8217d421abe951492809c7a89a5aaae341242c03428731362cb4907801e21da4bc6271d455ca7280131c59f2cb0137b829556d9c2f2a944be471cd619
-
memory/2072-60-0x00000000745D0000-0x0000000074CBE000-memory.dmpFilesize
6.9MB
-
memory/2072-69-0x0000000004CD0000-0x0000000004D10000-memory.dmpFilesize
256KB
-
memory/2072-67-0x00000000745D0000-0x0000000074CBE000-memory.dmpFilesize
6.9MB
-
memory/2072-65-0x0000000004CD0000-0x0000000004D10000-memory.dmpFilesize
256KB
-
memory/2072-31-0x0000000000180000-0x0000000000194000-memory.dmpFilesize
80KB
-
memory/2072-64-0x0000000004CD0000-0x0000000004D10000-memory.dmpFilesize
256KB
-
memory/2608-66-0x0000000000400000-0x00000000004B7000-memory.dmpFilesize
732KB
-
memory/2608-61-0x0000000000400000-0x00000000004B7000-memory.dmpFilesize
732KB
-
memory/2608-62-0x0000000000240000-0x0000000000241000-memory.dmpFilesize
4KB
-
memory/2608-70-0x0000000000400000-0x00000000004B7000-memory.dmpFilesize
732KB
-
memory/2608-72-0x0000000000400000-0x00000000004B7000-memory.dmpFilesize
732KB
-
memory/2668-59-0x00000000004C0000-0x00000000004C1000-memory.dmpFilesize
4KB
-
memory/2668-33-0x0000000000080000-0x0000000000081000-memory.dmpFilesize
4KB
-
memory/2856-11-0x00000000025F0000-0x00000000026A7000-memory.dmpFilesize
732KB
-
memory/2856-3-0x00000000025F0000-0x00000000026A7000-memory.dmpFilesize
732KB
-
memory/3048-63-0x0000000000400000-0x00000000004B7000-memory.dmpFilesize
732KB
-
memory/3048-19-0x00000000001D0000-0x00000000001D1000-memory.dmpFilesize
4KB
-
memory/3048-12-0x0000000000400000-0x00000000004B7000-memory.dmpFilesize
732KB