Analysis
-
max time kernel
144s -
max time network
154s -
platform
windows11-21h2_x64 -
resource
win11-20240412-en -
resource tags
arch:x64arch:x86image:win11-20240412-enlocale:en-usos:windows11-21h2-x64system -
submitted
13-04-2024 20:39
General
-
Target
prevmkali.exe
-
Size
251KB
-
MD5
e556b66a52ae28b3c877a9f3c419c5e3
-
SHA1
3a71dfde7b64c92cca1a023d0c807364d7d4cc1f
-
SHA256
1993dacf9211a1dab3c7cca176add0714f3061a7c9cb2edaacd31448c16c746a
-
SHA512
cd8b4a5ba819848cf48b8e59da0099324b06c54bb913381720e612e003a47cef583b4f96947d70a40e41445a802d4368835d339c0a2a2b5c7b91bfbd604df277
-
SSDEEP
6144:TdcNYS996KFifeVjBpeExgVTFSXFoMc5RhCaL37k1:TdcW7KEZlPzCy37
Malware Config
Extracted
Family
darkcomet
Botnet
Guest16
C2
6.tcp.us-cal-1.ngrok.io:12638
127.0.0.1:1337
Mutex
DC_MUTEX-RSWN5YL
Attributes
-
gencode
7gEewe3dp4fF
-
install
false
-
offline_keylogger
true
-
persistence
false
Signatures
-
Modifies security service 2 TTPs 1 IoCs
Processes:
prevmkali.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wscsvc\Start = "4" prevmkali.exe -
Processes:
prevmkali.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" prevmkali.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" prevmkali.exe -
Processes:
resource yara_rule behavioral1/memory/3468-0-0x0000000000400000-0x00000000004B7000-memory.dmp upx behavioral1/memory/3468-2-0x0000000000400000-0x00000000004B7000-memory.dmp upx behavioral1/memory/3468-5-0x0000000000400000-0x00000000004B7000-memory.dmp upx -
Processes:
prevmkali.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" prevmkali.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" prevmkali.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of AdjustPrivilegeToken 24 IoCs
Processes:
prevmkali.exedescription pid process Token: SeIncreaseQuotaPrivilege 3468 prevmkali.exe Token: SeSecurityPrivilege 3468 prevmkali.exe Token: SeTakeOwnershipPrivilege 3468 prevmkali.exe Token: SeLoadDriverPrivilege 3468 prevmkali.exe Token: SeSystemProfilePrivilege 3468 prevmkali.exe Token: SeSystemtimePrivilege 3468 prevmkali.exe Token: SeProfSingleProcessPrivilege 3468 prevmkali.exe Token: SeIncBasePriorityPrivilege 3468 prevmkali.exe Token: SeCreatePagefilePrivilege 3468 prevmkali.exe Token: SeBackupPrivilege 3468 prevmkali.exe Token: SeRestorePrivilege 3468 prevmkali.exe Token: SeShutdownPrivilege 3468 prevmkali.exe Token: SeDebugPrivilege 3468 prevmkali.exe Token: SeSystemEnvironmentPrivilege 3468 prevmkali.exe Token: SeChangeNotifyPrivilege 3468 prevmkali.exe Token: SeRemoteShutdownPrivilege 3468 prevmkali.exe Token: SeUndockPrivilege 3468 prevmkali.exe Token: SeManageVolumePrivilege 3468 prevmkali.exe Token: SeImpersonatePrivilege 3468 prevmkali.exe Token: SeCreateGlobalPrivilege 3468 prevmkali.exe Token: 33 3468 prevmkali.exe Token: 34 3468 prevmkali.exe Token: 35 3468 prevmkali.exe Token: 36 3468 prevmkali.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
prevmkali.exepid process 3468 prevmkali.exe -
System policy modification 1 TTPs 3 IoCs
Processes:
prevmkali.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\CurrentVersion prevmkali.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\CurrentVersion\Explorern prevmkali.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\CurrentVersion\Explorern\NoControlPanel = "1" prevmkali.exe
Processes
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/3468-0-0x0000000000400000-0x00000000004B7000-memory.dmpFilesize
732KB
-
memory/3468-1-0x0000000000BD0000-0x0000000000BD1000-memory.dmpFilesize
4KB
-
memory/3468-2-0x0000000000400000-0x00000000004B7000-memory.dmpFilesize
732KB
-
memory/3468-4-0x0000000000BD0000-0x0000000000BD1000-memory.dmpFilesize
4KB
-
memory/3468-5-0x0000000000400000-0x00000000004B7000-memory.dmpFilesize
732KB