Analysis
-
max time kernel
145s -
max time network
153s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
13-04-2024 01:47
Behavioral task
behavioral1
Sample
97e952e79c07ce103290267a4209cadcb96b010ea18d4d7932d4649eb242afc8.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
97e952e79c07ce103290267a4209cadcb96b010ea18d4d7932d4649eb242afc8.exe
Resource
win10v2004-20240412-en
General
-
Target
97e952e79c07ce103290267a4209cadcb96b010ea18d4d7932d4649eb242afc8.exe
-
Size
663KB
-
MD5
c4633cedf3f1b0c1527012a4f67d9a01
-
SHA1
221067b2868decbddcaf4e1758dfd9c1e7fced94
-
SHA256
97e952e79c07ce103290267a4209cadcb96b010ea18d4d7932d4649eb242afc8
-
SHA512
87c107bf0c04b2ffc94fe1f2dd9df5b3e19fee67e15620dab90fa8abac90002f62178ca5fd2d3994b76a156c9b7ae690cf76cc7397c915e75aa445aa60b7c2a4
-
SSDEEP
12288:O9HFJ9rJxRX1uVVjoaWSoynxdO1FVBaOiRZTERfIhNkNCCLo9EkNC/:aZ1xuVVjfFoynPaVBUR8f+kN10Ed
Malware Config
Extracted
darkcomet
Sazan
0.tcp.eu.ngrok.io:19165:19165
DC_MUTEX-AZWBJ2E
-
InstallPath
MSDCSC\msdcsc.exe
-
gencode
Py8v2wbhf6PU
-
install
true
-
offline_keylogger
true
-
persistence
true
-
reg_key
MicroUpdate
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
Processes:
97e952e79c07ce103290267a4209cadcb96b010ea18d4d7932d4649eb242afc8.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Users\\Admin\\Documents\\MSDCSC\\msdcsc.exe" 97e952e79c07ce103290267a4209cadcb96b010ea18d4d7932d4649eb242afc8.exe -
Deletes itself 1 IoCs
Processes:
notepad.exepid process 2508 notepad.exe -
Executes dropped EXE 1 IoCs
Processes:
msdcsc.exepid process 2656 msdcsc.exe -
Loads dropped DLL 2 IoCs
Processes:
97e952e79c07ce103290267a4209cadcb96b010ea18d4d7932d4649eb242afc8.exepid process 1964 97e952e79c07ce103290267a4209cadcb96b010ea18d4d7932d4649eb242afc8.exe 1964 97e952e79c07ce103290267a4209cadcb96b010ea18d4d7932d4649eb242afc8.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
97e952e79c07ce103290267a4209cadcb96b010ea18d4d7932d4649eb242afc8.exemsdcsc.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Users\\Admin\\Documents\\MSDCSC\\msdcsc.exe" 97e952e79c07ce103290267a4209cadcb96b010ea18d4d7932d4649eb242afc8.exe Set value (str) \REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Users\\Admin\\Documents\\MSDCSC\\msdcsc.exe" msdcsc.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of AdjustPrivilegeToken 46 IoCs
Processes:
97e952e79c07ce103290267a4209cadcb96b010ea18d4d7932d4649eb242afc8.exemsdcsc.exedescription pid process Token: SeIncreaseQuotaPrivilege 1964 97e952e79c07ce103290267a4209cadcb96b010ea18d4d7932d4649eb242afc8.exe Token: SeSecurityPrivilege 1964 97e952e79c07ce103290267a4209cadcb96b010ea18d4d7932d4649eb242afc8.exe Token: SeTakeOwnershipPrivilege 1964 97e952e79c07ce103290267a4209cadcb96b010ea18d4d7932d4649eb242afc8.exe Token: SeLoadDriverPrivilege 1964 97e952e79c07ce103290267a4209cadcb96b010ea18d4d7932d4649eb242afc8.exe Token: SeSystemProfilePrivilege 1964 97e952e79c07ce103290267a4209cadcb96b010ea18d4d7932d4649eb242afc8.exe Token: SeSystemtimePrivilege 1964 97e952e79c07ce103290267a4209cadcb96b010ea18d4d7932d4649eb242afc8.exe Token: SeProfSingleProcessPrivilege 1964 97e952e79c07ce103290267a4209cadcb96b010ea18d4d7932d4649eb242afc8.exe Token: SeIncBasePriorityPrivilege 1964 97e952e79c07ce103290267a4209cadcb96b010ea18d4d7932d4649eb242afc8.exe Token: SeCreatePagefilePrivilege 1964 97e952e79c07ce103290267a4209cadcb96b010ea18d4d7932d4649eb242afc8.exe Token: SeBackupPrivilege 1964 97e952e79c07ce103290267a4209cadcb96b010ea18d4d7932d4649eb242afc8.exe Token: SeRestorePrivilege 1964 97e952e79c07ce103290267a4209cadcb96b010ea18d4d7932d4649eb242afc8.exe Token: SeShutdownPrivilege 1964 97e952e79c07ce103290267a4209cadcb96b010ea18d4d7932d4649eb242afc8.exe Token: SeDebugPrivilege 1964 97e952e79c07ce103290267a4209cadcb96b010ea18d4d7932d4649eb242afc8.exe Token: SeSystemEnvironmentPrivilege 1964 97e952e79c07ce103290267a4209cadcb96b010ea18d4d7932d4649eb242afc8.exe Token: SeChangeNotifyPrivilege 1964 97e952e79c07ce103290267a4209cadcb96b010ea18d4d7932d4649eb242afc8.exe Token: SeRemoteShutdownPrivilege 1964 97e952e79c07ce103290267a4209cadcb96b010ea18d4d7932d4649eb242afc8.exe Token: SeUndockPrivilege 1964 97e952e79c07ce103290267a4209cadcb96b010ea18d4d7932d4649eb242afc8.exe Token: SeManageVolumePrivilege 1964 97e952e79c07ce103290267a4209cadcb96b010ea18d4d7932d4649eb242afc8.exe Token: SeImpersonatePrivilege 1964 97e952e79c07ce103290267a4209cadcb96b010ea18d4d7932d4649eb242afc8.exe Token: SeCreateGlobalPrivilege 1964 97e952e79c07ce103290267a4209cadcb96b010ea18d4d7932d4649eb242afc8.exe Token: 33 1964 97e952e79c07ce103290267a4209cadcb96b010ea18d4d7932d4649eb242afc8.exe Token: 34 1964 97e952e79c07ce103290267a4209cadcb96b010ea18d4d7932d4649eb242afc8.exe Token: 35 1964 97e952e79c07ce103290267a4209cadcb96b010ea18d4d7932d4649eb242afc8.exe Token: SeIncreaseQuotaPrivilege 2656 msdcsc.exe Token: SeSecurityPrivilege 2656 msdcsc.exe Token: SeTakeOwnershipPrivilege 2656 msdcsc.exe Token: SeLoadDriverPrivilege 2656 msdcsc.exe Token: SeSystemProfilePrivilege 2656 msdcsc.exe Token: SeSystemtimePrivilege 2656 msdcsc.exe Token: SeProfSingleProcessPrivilege 2656 msdcsc.exe Token: SeIncBasePriorityPrivilege 2656 msdcsc.exe Token: SeCreatePagefilePrivilege 2656 msdcsc.exe Token: SeBackupPrivilege 2656 msdcsc.exe Token: SeRestorePrivilege 2656 msdcsc.exe Token: SeShutdownPrivilege 2656 msdcsc.exe Token: SeDebugPrivilege 2656 msdcsc.exe Token: SeSystemEnvironmentPrivilege 2656 msdcsc.exe Token: SeChangeNotifyPrivilege 2656 msdcsc.exe Token: SeRemoteShutdownPrivilege 2656 msdcsc.exe Token: SeUndockPrivilege 2656 msdcsc.exe Token: SeManageVolumePrivilege 2656 msdcsc.exe Token: SeImpersonatePrivilege 2656 msdcsc.exe Token: SeCreateGlobalPrivilege 2656 msdcsc.exe Token: 33 2656 msdcsc.exe Token: 34 2656 msdcsc.exe Token: 35 2656 msdcsc.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
msdcsc.exepid process 2656 msdcsc.exe -
Suspicious use of WriteProcessMemory 22 IoCs
Processes:
97e952e79c07ce103290267a4209cadcb96b010ea18d4d7932d4649eb242afc8.exedescription pid process target process PID 1964 wrote to memory of 2508 1964 97e952e79c07ce103290267a4209cadcb96b010ea18d4d7932d4649eb242afc8.exe notepad.exe PID 1964 wrote to memory of 2508 1964 97e952e79c07ce103290267a4209cadcb96b010ea18d4d7932d4649eb242afc8.exe notepad.exe PID 1964 wrote to memory of 2508 1964 97e952e79c07ce103290267a4209cadcb96b010ea18d4d7932d4649eb242afc8.exe notepad.exe PID 1964 wrote to memory of 2508 1964 97e952e79c07ce103290267a4209cadcb96b010ea18d4d7932d4649eb242afc8.exe notepad.exe PID 1964 wrote to memory of 2508 1964 97e952e79c07ce103290267a4209cadcb96b010ea18d4d7932d4649eb242afc8.exe notepad.exe PID 1964 wrote to memory of 2508 1964 97e952e79c07ce103290267a4209cadcb96b010ea18d4d7932d4649eb242afc8.exe notepad.exe PID 1964 wrote to memory of 2508 1964 97e952e79c07ce103290267a4209cadcb96b010ea18d4d7932d4649eb242afc8.exe notepad.exe PID 1964 wrote to memory of 2508 1964 97e952e79c07ce103290267a4209cadcb96b010ea18d4d7932d4649eb242afc8.exe notepad.exe PID 1964 wrote to memory of 2508 1964 97e952e79c07ce103290267a4209cadcb96b010ea18d4d7932d4649eb242afc8.exe notepad.exe PID 1964 wrote to memory of 2508 1964 97e952e79c07ce103290267a4209cadcb96b010ea18d4d7932d4649eb242afc8.exe notepad.exe PID 1964 wrote to memory of 2508 1964 97e952e79c07ce103290267a4209cadcb96b010ea18d4d7932d4649eb242afc8.exe notepad.exe PID 1964 wrote to memory of 2508 1964 97e952e79c07ce103290267a4209cadcb96b010ea18d4d7932d4649eb242afc8.exe notepad.exe PID 1964 wrote to memory of 2508 1964 97e952e79c07ce103290267a4209cadcb96b010ea18d4d7932d4649eb242afc8.exe notepad.exe PID 1964 wrote to memory of 2508 1964 97e952e79c07ce103290267a4209cadcb96b010ea18d4d7932d4649eb242afc8.exe notepad.exe PID 1964 wrote to memory of 2508 1964 97e952e79c07ce103290267a4209cadcb96b010ea18d4d7932d4649eb242afc8.exe notepad.exe PID 1964 wrote to memory of 2508 1964 97e952e79c07ce103290267a4209cadcb96b010ea18d4d7932d4649eb242afc8.exe notepad.exe PID 1964 wrote to memory of 2508 1964 97e952e79c07ce103290267a4209cadcb96b010ea18d4d7932d4649eb242afc8.exe notepad.exe PID 1964 wrote to memory of 2508 1964 97e952e79c07ce103290267a4209cadcb96b010ea18d4d7932d4649eb242afc8.exe notepad.exe PID 1964 wrote to memory of 2656 1964 97e952e79c07ce103290267a4209cadcb96b010ea18d4d7932d4649eb242afc8.exe msdcsc.exe PID 1964 wrote to memory of 2656 1964 97e952e79c07ce103290267a4209cadcb96b010ea18d4d7932d4649eb242afc8.exe msdcsc.exe PID 1964 wrote to memory of 2656 1964 97e952e79c07ce103290267a4209cadcb96b010ea18d4d7932d4649eb242afc8.exe msdcsc.exe PID 1964 wrote to memory of 2656 1964 97e952e79c07ce103290267a4209cadcb96b010ea18d4d7932d4649eb242afc8.exe msdcsc.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\97e952e79c07ce103290267a4209cadcb96b010ea18d4d7932d4649eb242afc8.exe"C:\Users\Admin\AppData\Local\Temp\97e952e79c07ce103290267a4209cadcb96b010ea18d4d7932d4649eb242afc8.exe"1⤵
- Modifies WinLogon for persistence
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1964 -
C:\Windows\SysWOW64\notepad.exenotepad2⤵
- Deletes itself
PID:2508 -
C:\Users\Admin\Documents\MSDCSC\msdcsc.exe"C:\Users\Admin\Documents\MSDCSC\msdcsc.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2656
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
663KB
MD5c4633cedf3f1b0c1527012a4f67d9a01
SHA1221067b2868decbddcaf4e1758dfd9c1e7fced94
SHA25697e952e79c07ce103290267a4209cadcb96b010ea18d4d7932d4649eb242afc8
SHA51287c107bf0c04b2ffc94fe1f2dd9df5b3e19fee67e15620dab90fa8abac90002f62178ca5fd2d3994b76a156c9b7ae690cf76cc7397c915e75aa445aa60b7c2a4