Analysis
-
max time kernel
18s -
max time network
20s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
07-04-2024 09:03
Behavioral task
behavioral1
Sample
fdie.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
fdie.exe
Resource
win10-20240404-en
Behavioral task
behavioral3
Sample
fdie.exe
Resource
win10v2004-20240226-en
General
-
Target
fdie.exe
-
Size
349KB
-
MD5
16fc0818c01b213c1dda3e2c6500b2b5
-
SHA1
41782495122094490f024cfc7de8f75c4ea366a1
-
SHA256
16c8b807fb271c9fa9257adecc6fedb9b43a7b3ca7e2bce2c5797a68f3895a75
-
SHA512
1a373a5b02eb6389310240a2c51e64f084ba087f2628653806f70da726767a2ce9d6d57c23638825d082027369fc837cbacfa98531b5bbfac355034ab2e0bbf0
-
SSDEEP
6144:FcNYS996KFifeVjBpeExgVTFSXFoMc5RhCaL37NRI2RwplSZkOiu9PZ/p:FcW7KEZlPzCy37NxRPNVR
Malware Config
Extracted
darkcomet
Guest16
127.0.0.1:1604
DC_MUTEX-Z0Y353G
-
gencode
TrmiFnKugxo0
-
install
false
-
offline_keylogger
true
-
persistence
false
Signatures
-
Modifies firewall policy service 2 TTPs 3 IoCs
Processes:
fdie.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "0" fdie.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile fdie.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" fdie.exe -
Modifies security service 2 TTPs 1 IoCs
Processes:
fdie.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wscsvc\Start = "4" fdie.exe -
Processes:
fdie.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" fdie.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" fdie.exe -
Disables RegEdit via registry modification 1 IoCs
Processes:
fdie.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" fdie.exe -
Disables Task Manager via registry modification
-
Drops file in Drivers directory 1 IoCs
Processes:
fdie.exedescription ioc process File opened for modification C:\Windows\system32\drivers\etc\hosts fdie.exe -
Processes:
resource yara_rule behavioral3/memory/2572-0-0x0000000000400000-0x00000000004E8000-memory.dmp upx behavioral3/memory/2572-3-0x0000000000400000-0x00000000004E8000-memory.dmp upx -
Processes:
fdie.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" fdie.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" fdie.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of AdjustPrivilegeToken 24 IoCs
Processes:
fdie.exedescription pid process Token: SeIncreaseQuotaPrivilege 2572 fdie.exe Token: SeSecurityPrivilege 2572 fdie.exe Token: SeTakeOwnershipPrivilege 2572 fdie.exe Token: SeLoadDriverPrivilege 2572 fdie.exe Token: SeSystemProfilePrivilege 2572 fdie.exe Token: SeSystemtimePrivilege 2572 fdie.exe Token: SeProfSingleProcessPrivilege 2572 fdie.exe Token: SeIncBasePriorityPrivilege 2572 fdie.exe Token: SeCreatePagefilePrivilege 2572 fdie.exe Token: SeBackupPrivilege 2572 fdie.exe Token: SeRestorePrivilege 2572 fdie.exe Token: SeShutdownPrivilege 2572 fdie.exe Token: SeDebugPrivilege 2572 fdie.exe Token: SeSystemEnvironmentPrivilege 2572 fdie.exe Token: SeChangeNotifyPrivilege 2572 fdie.exe Token: SeRemoteShutdownPrivilege 2572 fdie.exe Token: SeUndockPrivilege 2572 fdie.exe Token: SeManageVolumePrivilege 2572 fdie.exe Token: SeImpersonatePrivilege 2572 fdie.exe Token: SeCreateGlobalPrivilege 2572 fdie.exe Token: 33 2572 fdie.exe Token: 34 2572 fdie.exe Token: 35 2572 fdie.exe Token: 36 2572 fdie.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
fdie.exepid process 2572 fdie.exe -
System policy modification 1 TTPs 3 IoCs
Processes:
fdie.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\CurrentVersion\Explorern fdie.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\CurrentVersion\Explorern\NoControlPanel = "1" fdie.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\CurrentVersion fdie.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\fdie.exe"C:\Users\Admin\AppData\Local\Temp\fdie.exe"1⤵
- Modifies firewall policy service
- Modifies security service
- Windows security bypass
- Disables RegEdit via registry modification
- Drops file in Drivers directory
- Windows security modification
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:2572