Analysis
-
max time kernel
149s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-en -
resource tags
arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system -
submitted
13-04-2024 01:27
Behavioral task
behavioral1
Sample
079d1841d6f0fde132f810937d247226410bbc239141493df978da344060f030.exe
Resource
win7-20240221-en
General
-
Target
079d1841d6f0fde132f810937d247226410bbc239141493df978da344060f030.exe
-
Size
756KB
-
MD5
7f63869a181a8ebb360a89b58c739648
-
SHA1
83e0504e36530cf417aee9cf6cfac90d0f21a451
-
SHA256
079d1841d6f0fde132f810937d247226410bbc239141493df978da344060f030
-
SHA512
5c1c5aaa55c3ea87138aaca88d771abb4d80d319abce0235f9ad5d6ad63c74d082c933366c7ea927fac80ef8d0874a71e9a67bb316355a8b31fd4cd060e67b86
-
SSDEEP
12288:+9HFJ9rJxRX1uVVjoaWSoynxdO1FVBaOiRZTERfIhNkNCCLo9Ek5C/hgqMd0QZhJ:KZ1xuVVjfFoynPaVBUR8f+kN10EBqD0e
Malware Config
Extracted
darkcomet
Guest16
127.0.0.1:1604
DC_MUTEX-Z5HMAL1
-
gencode
L2p2T15qZDML
-
install
false
-
offline_keylogger
true
-
persistence
false
Signatures
-
Sets file to hidden 1 TTPs 2 IoCs
Modifies file attributes to stop it showing in Explorer etc.
Processes:
attrib.exeattrib.exepid process 2604 attrib.exe 4800 attrib.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
079d1841d6f0fde132f810937d247226410bbc239141493df978da344060f030.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\Control Panel\International\Geo\Nation 079d1841d6f0fde132f810937d247226410bbc239141493df978da344060f030.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
079d1841d6f0fde132f810937d247226410bbc239141493df978da344060f030.exepid process 1136 079d1841d6f0fde132f810937d247226410bbc239141493df978da344060f030.exe -
Suspicious use of AdjustPrivilegeToken 24 IoCs
Processes:
079d1841d6f0fde132f810937d247226410bbc239141493df978da344060f030.exedescription pid process Token: SeIncreaseQuotaPrivilege 1136 079d1841d6f0fde132f810937d247226410bbc239141493df978da344060f030.exe Token: SeSecurityPrivilege 1136 079d1841d6f0fde132f810937d247226410bbc239141493df978da344060f030.exe Token: SeTakeOwnershipPrivilege 1136 079d1841d6f0fde132f810937d247226410bbc239141493df978da344060f030.exe Token: SeLoadDriverPrivilege 1136 079d1841d6f0fde132f810937d247226410bbc239141493df978da344060f030.exe Token: SeSystemProfilePrivilege 1136 079d1841d6f0fde132f810937d247226410bbc239141493df978da344060f030.exe Token: SeSystemtimePrivilege 1136 079d1841d6f0fde132f810937d247226410bbc239141493df978da344060f030.exe Token: SeProfSingleProcessPrivilege 1136 079d1841d6f0fde132f810937d247226410bbc239141493df978da344060f030.exe Token: SeIncBasePriorityPrivilege 1136 079d1841d6f0fde132f810937d247226410bbc239141493df978da344060f030.exe Token: SeCreatePagefilePrivilege 1136 079d1841d6f0fde132f810937d247226410bbc239141493df978da344060f030.exe Token: SeBackupPrivilege 1136 079d1841d6f0fde132f810937d247226410bbc239141493df978da344060f030.exe Token: SeRestorePrivilege 1136 079d1841d6f0fde132f810937d247226410bbc239141493df978da344060f030.exe Token: SeShutdownPrivilege 1136 079d1841d6f0fde132f810937d247226410bbc239141493df978da344060f030.exe Token: SeDebugPrivilege 1136 079d1841d6f0fde132f810937d247226410bbc239141493df978da344060f030.exe Token: SeSystemEnvironmentPrivilege 1136 079d1841d6f0fde132f810937d247226410bbc239141493df978da344060f030.exe Token: SeChangeNotifyPrivilege 1136 079d1841d6f0fde132f810937d247226410bbc239141493df978da344060f030.exe Token: SeRemoteShutdownPrivilege 1136 079d1841d6f0fde132f810937d247226410bbc239141493df978da344060f030.exe Token: SeUndockPrivilege 1136 079d1841d6f0fde132f810937d247226410bbc239141493df978da344060f030.exe Token: SeManageVolumePrivilege 1136 079d1841d6f0fde132f810937d247226410bbc239141493df978da344060f030.exe Token: SeImpersonatePrivilege 1136 079d1841d6f0fde132f810937d247226410bbc239141493df978da344060f030.exe Token: SeCreateGlobalPrivilege 1136 079d1841d6f0fde132f810937d247226410bbc239141493df978da344060f030.exe Token: 33 1136 079d1841d6f0fde132f810937d247226410bbc239141493df978da344060f030.exe Token: 34 1136 079d1841d6f0fde132f810937d247226410bbc239141493df978da344060f030.exe Token: 35 1136 079d1841d6f0fde132f810937d247226410bbc239141493df978da344060f030.exe Token: 36 1136 079d1841d6f0fde132f810937d247226410bbc239141493df978da344060f030.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
079d1841d6f0fde132f810937d247226410bbc239141493df978da344060f030.exepid process 1136 079d1841d6f0fde132f810937d247226410bbc239141493df978da344060f030.exe -
Suspicious use of WriteProcessMemory 34 IoCs
Processes:
079d1841d6f0fde132f810937d247226410bbc239141493df978da344060f030.execmd.execmd.exedescription pid process target process PID 1136 wrote to memory of 2224 1136 079d1841d6f0fde132f810937d247226410bbc239141493df978da344060f030.exe cmd.exe PID 1136 wrote to memory of 2224 1136 079d1841d6f0fde132f810937d247226410bbc239141493df978da344060f030.exe cmd.exe PID 1136 wrote to memory of 2224 1136 079d1841d6f0fde132f810937d247226410bbc239141493df978da344060f030.exe cmd.exe PID 1136 wrote to memory of 1256 1136 079d1841d6f0fde132f810937d247226410bbc239141493df978da344060f030.exe cmd.exe PID 1136 wrote to memory of 1256 1136 079d1841d6f0fde132f810937d247226410bbc239141493df978da344060f030.exe cmd.exe PID 1136 wrote to memory of 1256 1136 079d1841d6f0fde132f810937d247226410bbc239141493df978da344060f030.exe cmd.exe PID 1136 wrote to memory of 1664 1136 079d1841d6f0fde132f810937d247226410bbc239141493df978da344060f030.exe notepad.exe PID 1136 wrote to memory of 1664 1136 079d1841d6f0fde132f810937d247226410bbc239141493df978da344060f030.exe notepad.exe PID 1136 wrote to memory of 1664 1136 079d1841d6f0fde132f810937d247226410bbc239141493df978da344060f030.exe notepad.exe PID 1136 wrote to memory of 1664 1136 079d1841d6f0fde132f810937d247226410bbc239141493df978da344060f030.exe notepad.exe PID 1136 wrote to memory of 1664 1136 079d1841d6f0fde132f810937d247226410bbc239141493df978da344060f030.exe notepad.exe PID 1136 wrote to memory of 1664 1136 079d1841d6f0fde132f810937d247226410bbc239141493df978da344060f030.exe notepad.exe PID 1136 wrote to memory of 1664 1136 079d1841d6f0fde132f810937d247226410bbc239141493df978da344060f030.exe notepad.exe PID 1136 wrote to memory of 1664 1136 079d1841d6f0fde132f810937d247226410bbc239141493df978da344060f030.exe notepad.exe PID 1136 wrote to memory of 1664 1136 079d1841d6f0fde132f810937d247226410bbc239141493df978da344060f030.exe notepad.exe PID 1136 wrote to memory of 1664 1136 079d1841d6f0fde132f810937d247226410bbc239141493df978da344060f030.exe notepad.exe PID 1136 wrote to memory of 1664 1136 079d1841d6f0fde132f810937d247226410bbc239141493df978da344060f030.exe notepad.exe PID 1136 wrote to memory of 1664 1136 079d1841d6f0fde132f810937d247226410bbc239141493df978da344060f030.exe notepad.exe PID 1136 wrote to memory of 1664 1136 079d1841d6f0fde132f810937d247226410bbc239141493df978da344060f030.exe notepad.exe PID 1136 wrote to memory of 1664 1136 079d1841d6f0fde132f810937d247226410bbc239141493df978da344060f030.exe notepad.exe PID 1136 wrote to memory of 1664 1136 079d1841d6f0fde132f810937d247226410bbc239141493df978da344060f030.exe notepad.exe PID 1136 wrote to memory of 1664 1136 079d1841d6f0fde132f810937d247226410bbc239141493df978da344060f030.exe notepad.exe PID 1136 wrote to memory of 1664 1136 079d1841d6f0fde132f810937d247226410bbc239141493df978da344060f030.exe notepad.exe PID 1136 wrote to memory of 1664 1136 079d1841d6f0fde132f810937d247226410bbc239141493df978da344060f030.exe notepad.exe PID 1136 wrote to memory of 1664 1136 079d1841d6f0fde132f810937d247226410bbc239141493df978da344060f030.exe notepad.exe PID 1136 wrote to memory of 1664 1136 079d1841d6f0fde132f810937d247226410bbc239141493df978da344060f030.exe notepad.exe PID 1136 wrote to memory of 1664 1136 079d1841d6f0fde132f810937d247226410bbc239141493df978da344060f030.exe notepad.exe PID 1136 wrote to memory of 1664 1136 079d1841d6f0fde132f810937d247226410bbc239141493df978da344060f030.exe notepad.exe PID 2224 wrote to memory of 2604 2224 cmd.exe attrib.exe PID 2224 wrote to memory of 2604 2224 cmd.exe attrib.exe PID 2224 wrote to memory of 2604 2224 cmd.exe attrib.exe PID 1256 wrote to memory of 4800 1256 cmd.exe attrib.exe PID 1256 wrote to memory of 4800 1256 cmd.exe attrib.exe PID 1256 wrote to memory of 4800 1256 cmd.exe attrib.exe -
Views/modifies file attributes 1 TTPs 2 IoCs
Processes:
attrib.exeattrib.exepid process 2604 attrib.exe 4800 attrib.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\079d1841d6f0fde132f810937d247226410bbc239141493df978da344060f030.exe"C:\Users\Admin\AppData\Local\Temp\079d1841d6f0fde132f810937d247226410bbc239141493df978da344060f030.exe"1⤵
- Checks computer location settings
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp\079d1841d6f0fde132f810937d247226410bbc239141493df978da344060f030.exe" +s +h2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Users\Admin\AppData\Local\Temp\079d1841d6f0fde132f810937d247226410bbc239141493df978da344060f030.exe" +s +h3⤵
- Sets file to hidden
- Views/modifies file attributes
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp" +s +h2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Users\Admin\AppData\Local\Temp" +s +h3⤵
- Sets file to hidden
- Views/modifies file attributes
-
C:\Windows\SysWOW64\notepad.exenotepad2⤵