Analysis
-
max time kernel
150s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
12-04-2024 01:01
Behavioral task
behavioral1
Sample
079d1841d6f0fde132f810937d247226410bbc239141493df978da344060f030.exe
Resource
win7-20240221-en
General
-
Target
079d1841d6f0fde132f810937d247226410bbc239141493df978da344060f030.exe
-
Size
756KB
-
MD5
7f63869a181a8ebb360a89b58c739648
-
SHA1
83e0504e36530cf417aee9cf6cfac90d0f21a451
-
SHA256
079d1841d6f0fde132f810937d247226410bbc239141493df978da344060f030
-
SHA512
5c1c5aaa55c3ea87138aaca88d771abb4d80d319abce0235f9ad5d6ad63c74d082c933366c7ea927fac80ef8d0874a71e9a67bb316355a8b31fd4cd060e67b86
-
SSDEEP
12288:+9HFJ9rJxRX1uVVjoaWSoynxdO1FVBaOiRZTERfIhNkNCCLo9Ek5C/hgqMd0QZhJ:KZ1xuVVjfFoynPaVBUR8f+kN10EBqD0e
Malware Config
Extracted
darkcomet
Guest16
127.0.0.1:1604
DC_MUTEX-Z5HMAL1
-
gencode
L2p2T15qZDML
-
install
false
-
offline_keylogger
true
-
persistence
false
Signatures
-
Sets file to hidden 1 TTPs 2 IoCs
Modifies file attributes to stop it showing in Explorer etc.
Processes:
attrib.exeattrib.exepid process 3412 attrib.exe 4432 attrib.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
079d1841d6f0fde132f810937d247226410bbc239141493df978da344060f030.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000\Control Panel\International\Geo\Nation 079d1841d6f0fde132f810937d247226410bbc239141493df978da344060f030.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
079d1841d6f0fde132f810937d247226410bbc239141493df978da344060f030.exepid process 1544 079d1841d6f0fde132f810937d247226410bbc239141493df978da344060f030.exe -
Suspicious use of AdjustPrivilegeToken 24 IoCs
Processes:
079d1841d6f0fde132f810937d247226410bbc239141493df978da344060f030.exedescription pid process Token: SeIncreaseQuotaPrivilege 1544 079d1841d6f0fde132f810937d247226410bbc239141493df978da344060f030.exe Token: SeSecurityPrivilege 1544 079d1841d6f0fde132f810937d247226410bbc239141493df978da344060f030.exe Token: SeTakeOwnershipPrivilege 1544 079d1841d6f0fde132f810937d247226410bbc239141493df978da344060f030.exe Token: SeLoadDriverPrivilege 1544 079d1841d6f0fde132f810937d247226410bbc239141493df978da344060f030.exe Token: SeSystemProfilePrivilege 1544 079d1841d6f0fde132f810937d247226410bbc239141493df978da344060f030.exe Token: SeSystemtimePrivilege 1544 079d1841d6f0fde132f810937d247226410bbc239141493df978da344060f030.exe Token: SeProfSingleProcessPrivilege 1544 079d1841d6f0fde132f810937d247226410bbc239141493df978da344060f030.exe Token: SeIncBasePriorityPrivilege 1544 079d1841d6f0fde132f810937d247226410bbc239141493df978da344060f030.exe Token: SeCreatePagefilePrivilege 1544 079d1841d6f0fde132f810937d247226410bbc239141493df978da344060f030.exe Token: SeBackupPrivilege 1544 079d1841d6f0fde132f810937d247226410bbc239141493df978da344060f030.exe Token: SeRestorePrivilege 1544 079d1841d6f0fde132f810937d247226410bbc239141493df978da344060f030.exe Token: SeShutdownPrivilege 1544 079d1841d6f0fde132f810937d247226410bbc239141493df978da344060f030.exe Token: SeDebugPrivilege 1544 079d1841d6f0fde132f810937d247226410bbc239141493df978da344060f030.exe Token: SeSystemEnvironmentPrivilege 1544 079d1841d6f0fde132f810937d247226410bbc239141493df978da344060f030.exe Token: SeChangeNotifyPrivilege 1544 079d1841d6f0fde132f810937d247226410bbc239141493df978da344060f030.exe Token: SeRemoteShutdownPrivilege 1544 079d1841d6f0fde132f810937d247226410bbc239141493df978da344060f030.exe Token: SeUndockPrivilege 1544 079d1841d6f0fde132f810937d247226410bbc239141493df978da344060f030.exe Token: SeManageVolumePrivilege 1544 079d1841d6f0fde132f810937d247226410bbc239141493df978da344060f030.exe Token: SeImpersonatePrivilege 1544 079d1841d6f0fde132f810937d247226410bbc239141493df978da344060f030.exe Token: SeCreateGlobalPrivilege 1544 079d1841d6f0fde132f810937d247226410bbc239141493df978da344060f030.exe Token: 33 1544 079d1841d6f0fde132f810937d247226410bbc239141493df978da344060f030.exe Token: 34 1544 079d1841d6f0fde132f810937d247226410bbc239141493df978da344060f030.exe Token: 35 1544 079d1841d6f0fde132f810937d247226410bbc239141493df978da344060f030.exe Token: 36 1544 079d1841d6f0fde132f810937d247226410bbc239141493df978da344060f030.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
079d1841d6f0fde132f810937d247226410bbc239141493df978da344060f030.exepid process 1544 079d1841d6f0fde132f810937d247226410bbc239141493df978da344060f030.exe -
Suspicious use of WriteProcessMemory 34 IoCs
Processes:
079d1841d6f0fde132f810937d247226410bbc239141493df978da344060f030.execmd.execmd.exedescription pid process target process PID 1544 wrote to memory of 960 1544 079d1841d6f0fde132f810937d247226410bbc239141493df978da344060f030.exe cmd.exe PID 1544 wrote to memory of 960 1544 079d1841d6f0fde132f810937d247226410bbc239141493df978da344060f030.exe cmd.exe PID 1544 wrote to memory of 960 1544 079d1841d6f0fde132f810937d247226410bbc239141493df978da344060f030.exe cmd.exe PID 1544 wrote to memory of 4552 1544 079d1841d6f0fde132f810937d247226410bbc239141493df978da344060f030.exe cmd.exe PID 1544 wrote to memory of 4552 1544 079d1841d6f0fde132f810937d247226410bbc239141493df978da344060f030.exe cmd.exe PID 1544 wrote to memory of 4552 1544 079d1841d6f0fde132f810937d247226410bbc239141493df978da344060f030.exe cmd.exe PID 1544 wrote to memory of 4864 1544 079d1841d6f0fde132f810937d247226410bbc239141493df978da344060f030.exe notepad.exe PID 1544 wrote to memory of 4864 1544 079d1841d6f0fde132f810937d247226410bbc239141493df978da344060f030.exe notepad.exe PID 1544 wrote to memory of 4864 1544 079d1841d6f0fde132f810937d247226410bbc239141493df978da344060f030.exe notepad.exe PID 1544 wrote to memory of 4864 1544 079d1841d6f0fde132f810937d247226410bbc239141493df978da344060f030.exe notepad.exe PID 1544 wrote to memory of 4864 1544 079d1841d6f0fde132f810937d247226410bbc239141493df978da344060f030.exe notepad.exe PID 1544 wrote to memory of 4864 1544 079d1841d6f0fde132f810937d247226410bbc239141493df978da344060f030.exe notepad.exe PID 1544 wrote to memory of 4864 1544 079d1841d6f0fde132f810937d247226410bbc239141493df978da344060f030.exe notepad.exe PID 1544 wrote to memory of 4864 1544 079d1841d6f0fde132f810937d247226410bbc239141493df978da344060f030.exe notepad.exe PID 1544 wrote to memory of 4864 1544 079d1841d6f0fde132f810937d247226410bbc239141493df978da344060f030.exe notepad.exe PID 1544 wrote to memory of 4864 1544 079d1841d6f0fde132f810937d247226410bbc239141493df978da344060f030.exe notepad.exe PID 1544 wrote to memory of 4864 1544 079d1841d6f0fde132f810937d247226410bbc239141493df978da344060f030.exe notepad.exe PID 1544 wrote to memory of 4864 1544 079d1841d6f0fde132f810937d247226410bbc239141493df978da344060f030.exe notepad.exe PID 1544 wrote to memory of 4864 1544 079d1841d6f0fde132f810937d247226410bbc239141493df978da344060f030.exe notepad.exe PID 1544 wrote to memory of 4864 1544 079d1841d6f0fde132f810937d247226410bbc239141493df978da344060f030.exe notepad.exe PID 1544 wrote to memory of 4864 1544 079d1841d6f0fde132f810937d247226410bbc239141493df978da344060f030.exe notepad.exe PID 1544 wrote to memory of 4864 1544 079d1841d6f0fde132f810937d247226410bbc239141493df978da344060f030.exe notepad.exe PID 1544 wrote to memory of 4864 1544 079d1841d6f0fde132f810937d247226410bbc239141493df978da344060f030.exe notepad.exe PID 1544 wrote to memory of 4864 1544 079d1841d6f0fde132f810937d247226410bbc239141493df978da344060f030.exe notepad.exe PID 1544 wrote to memory of 4864 1544 079d1841d6f0fde132f810937d247226410bbc239141493df978da344060f030.exe notepad.exe PID 1544 wrote to memory of 4864 1544 079d1841d6f0fde132f810937d247226410bbc239141493df978da344060f030.exe notepad.exe PID 1544 wrote to memory of 4864 1544 079d1841d6f0fde132f810937d247226410bbc239141493df978da344060f030.exe notepad.exe PID 1544 wrote to memory of 4864 1544 079d1841d6f0fde132f810937d247226410bbc239141493df978da344060f030.exe notepad.exe PID 960 wrote to memory of 3412 960 cmd.exe attrib.exe PID 960 wrote to memory of 3412 960 cmd.exe attrib.exe PID 960 wrote to memory of 3412 960 cmd.exe attrib.exe PID 4552 wrote to memory of 4432 4552 cmd.exe attrib.exe PID 4552 wrote to memory of 4432 4552 cmd.exe attrib.exe PID 4552 wrote to memory of 4432 4552 cmd.exe attrib.exe -
Views/modifies file attributes 1 TTPs 2 IoCs
Processes:
attrib.exeattrib.exepid process 3412 attrib.exe 4432 attrib.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\079d1841d6f0fde132f810937d247226410bbc239141493df978da344060f030.exe"C:\Users\Admin\AppData\Local\Temp\079d1841d6f0fde132f810937d247226410bbc239141493df978da344060f030.exe"1⤵
- Checks computer location settings
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp\079d1841d6f0fde132f810937d247226410bbc239141493df978da344060f030.exe" +s +h2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Users\Admin\AppData\Local\Temp\079d1841d6f0fde132f810937d247226410bbc239141493df978da344060f030.exe" +s +h3⤵
- Sets file to hidden
- Views/modifies file attributes
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp" +s +h2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Users\Admin\AppData\Local\Temp" +s +h3⤵
- Sets file to hidden
- Views/modifies file attributes
-
C:\Windows\SysWOW64\notepad.exenotepad2⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1544-0-0x00000000022B0000-0x00000000022B1000-memory.dmpFilesize
4KB
-
memory/1544-2-0x0000000000400000-0x00000000004CA000-memory.dmpFilesize
808KB
-
memory/1544-4-0x00000000022B0000-0x00000000022B1000-memory.dmpFilesize
4KB
-
memory/4864-1-0x0000000001190000-0x0000000001191000-memory.dmpFilesize
4KB