Analysis
-
max time kernel
142s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
14-04-2024 02:45
Static task
static1
Behavioral task
behavioral1
Sample
e78da21d88d678da382cf9f10be55d75ce6f5d438fc2bb6471f82a51575ae1ca.exe
Resource
win7-20240221-en
General
-
Target
e78da21d88d678da382cf9f10be55d75ce6f5d438fc2bb6471f82a51575ae1ca.exe
-
Size
1.1MB
-
MD5
e88bab5d7caf5f30f87e56fce21b8eb4
-
SHA1
32bf71fcec9a64e9d8adf36201b15803a9d5812d
-
SHA256
e78da21d88d678da382cf9f10be55d75ce6f5d438fc2bb6471f82a51575ae1ca
-
SHA512
7cff1f10c83247257d30508ac9d8aa6a12bd1f536bcc3aee95b61144584d839e350d38f3fc1cf11b4b1da6530e5191291af1bfdbf8c906e124b7abcf14e5f3e1
-
SSDEEP
24576:mJwXnr79xF09allHpm/rhUZqACJy5aGU:mu3rl7PmThVAOycGU
Malware Config
Extracted
darkcomet
crypter
184.144.223.8:51800
overcrash.no-ip.biz:51800
DC_MUTEX-E5P79CY
-
InstallPath
MSDCSC\msdcsc.exe
-
gencode
7LSrP3sXvcog
-
install
true
-
offline_keylogger
true
-
persistence
true
-
reg_key
MicroUpdate
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
Processes:
vbc.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Users\\Admin\\Documents\\MSDCSC\\msdcsc.exe" vbc.exe -
Sets file to hidden 1 TTPs 2 IoCs
Modifies file attributes to stop it showing in Explorer etc.
Processes:
attrib.exeattrib.exepid process 2616 attrib.exe 2104 attrib.exe -
Executes dropped EXE 1 IoCs
Processes:
vbc.exepid process 2144 vbc.exe -
Loads dropped DLL 1 IoCs
Processes:
e78da21d88d678da382cf9f10be55d75ce6f5d438fc2bb6471f82a51575ae1ca.exepid process 1712 e78da21d88d678da382cf9f10be55d75ce6f5d438fc2bb6471f82a51575ae1ca.exe -
Uses the VBS compiler for execution 1 TTPs
-
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
vbc.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Users\\Admin\\Documents\\MSDCSC\\msdcsc.exe" vbc.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
e78da21d88d678da382cf9f10be55d75ce6f5d438fc2bb6471f82a51575ae1ca.exedescription pid process target process PID 1712 set thread context of 2144 1712 e78da21d88d678da382cf9f10be55d75ce6f5d438fc2bb6471f82a51575ae1ca.exe vbc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of AdjustPrivilegeToken 23 IoCs
Processes:
vbc.exedescription pid process Token: SeIncreaseQuotaPrivilege 2144 vbc.exe Token: SeSecurityPrivilege 2144 vbc.exe Token: SeTakeOwnershipPrivilege 2144 vbc.exe Token: SeLoadDriverPrivilege 2144 vbc.exe Token: SeSystemProfilePrivilege 2144 vbc.exe Token: SeSystemtimePrivilege 2144 vbc.exe Token: SeProfSingleProcessPrivilege 2144 vbc.exe Token: SeIncBasePriorityPrivilege 2144 vbc.exe Token: SeCreatePagefilePrivilege 2144 vbc.exe Token: SeBackupPrivilege 2144 vbc.exe Token: SeRestorePrivilege 2144 vbc.exe Token: SeShutdownPrivilege 2144 vbc.exe Token: SeDebugPrivilege 2144 vbc.exe Token: SeSystemEnvironmentPrivilege 2144 vbc.exe Token: SeChangeNotifyPrivilege 2144 vbc.exe Token: SeRemoteShutdownPrivilege 2144 vbc.exe Token: SeUndockPrivilege 2144 vbc.exe Token: SeManageVolumePrivilege 2144 vbc.exe Token: SeImpersonatePrivilege 2144 vbc.exe Token: SeCreateGlobalPrivilege 2144 vbc.exe Token: 33 2144 vbc.exe Token: 34 2144 vbc.exe Token: 35 2144 vbc.exe -
Suspicious use of WriteProcessMemory 36 IoCs
Processes:
e78da21d88d678da382cf9f10be55d75ce6f5d438fc2bb6471f82a51575ae1ca.exevbc.execmd.execmd.exedescription pid process target process PID 1712 wrote to memory of 2144 1712 e78da21d88d678da382cf9f10be55d75ce6f5d438fc2bb6471f82a51575ae1ca.exe vbc.exe PID 1712 wrote to memory of 2144 1712 e78da21d88d678da382cf9f10be55d75ce6f5d438fc2bb6471f82a51575ae1ca.exe vbc.exe PID 1712 wrote to memory of 2144 1712 e78da21d88d678da382cf9f10be55d75ce6f5d438fc2bb6471f82a51575ae1ca.exe vbc.exe PID 1712 wrote to memory of 2144 1712 e78da21d88d678da382cf9f10be55d75ce6f5d438fc2bb6471f82a51575ae1ca.exe vbc.exe PID 1712 wrote to memory of 2144 1712 e78da21d88d678da382cf9f10be55d75ce6f5d438fc2bb6471f82a51575ae1ca.exe vbc.exe PID 1712 wrote to memory of 2144 1712 e78da21d88d678da382cf9f10be55d75ce6f5d438fc2bb6471f82a51575ae1ca.exe vbc.exe PID 1712 wrote to memory of 2144 1712 e78da21d88d678da382cf9f10be55d75ce6f5d438fc2bb6471f82a51575ae1ca.exe vbc.exe PID 1712 wrote to memory of 2144 1712 e78da21d88d678da382cf9f10be55d75ce6f5d438fc2bb6471f82a51575ae1ca.exe vbc.exe PID 1712 wrote to memory of 2144 1712 e78da21d88d678da382cf9f10be55d75ce6f5d438fc2bb6471f82a51575ae1ca.exe vbc.exe PID 1712 wrote to memory of 2144 1712 e78da21d88d678da382cf9f10be55d75ce6f5d438fc2bb6471f82a51575ae1ca.exe vbc.exe PID 1712 wrote to memory of 2144 1712 e78da21d88d678da382cf9f10be55d75ce6f5d438fc2bb6471f82a51575ae1ca.exe vbc.exe PID 1712 wrote to memory of 2144 1712 e78da21d88d678da382cf9f10be55d75ce6f5d438fc2bb6471f82a51575ae1ca.exe vbc.exe PID 1712 wrote to memory of 2144 1712 e78da21d88d678da382cf9f10be55d75ce6f5d438fc2bb6471f82a51575ae1ca.exe vbc.exe PID 1712 wrote to memory of 2144 1712 e78da21d88d678da382cf9f10be55d75ce6f5d438fc2bb6471f82a51575ae1ca.exe vbc.exe PID 1712 wrote to memory of 2144 1712 e78da21d88d678da382cf9f10be55d75ce6f5d438fc2bb6471f82a51575ae1ca.exe vbc.exe PID 2144 wrote to memory of 2552 2144 vbc.exe cmd.exe PID 2144 wrote to memory of 2552 2144 vbc.exe cmd.exe PID 2144 wrote to memory of 2552 2144 vbc.exe cmd.exe PID 2144 wrote to memory of 2552 2144 vbc.exe cmd.exe PID 2144 wrote to memory of 2740 2144 vbc.exe cmd.exe PID 2144 wrote to memory of 2740 2144 vbc.exe cmd.exe PID 2144 wrote to memory of 2740 2144 vbc.exe cmd.exe PID 2144 wrote to memory of 2740 2144 vbc.exe cmd.exe PID 2144 wrote to memory of 2528 2144 vbc.exe notepad.exe PID 2144 wrote to memory of 2528 2144 vbc.exe notepad.exe PID 2144 wrote to memory of 2528 2144 vbc.exe notepad.exe PID 2144 wrote to memory of 2528 2144 vbc.exe notepad.exe PID 2144 wrote to memory of 2528 2144 vbc.exe notepad.exe PID 2740 wrote to memory of 2616 2740 cmd.exe attrib.exe PID 2740 wrote to memory of 2616 2740 cmd.exe attrib.exe PID 2740 wrote to memory of 2616 2740 cmd.exe attrib.exe PID 2740 wrote to memory of 2616 2740 cmd.exe attrib.exe PID 2552 wrote to memory of 2104 2552 cmd.exe attrib.exe PID 2552 wrote to memory of 2104 2552 cmd.exe attrib.exe PID 2552 wrote to memory of 2104 2552 cmd.exe attrib.exe PID 2552 wrote to memory of 2104 2552 cmd.exe attrib.exe -
Views/modifies file attributes 1 TTPs 2 IoCs
Processes:
attrib.exeattrib.exepid process 2616 attrib.exe 2104 attrib.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\e78da21d88d678da382cf9f10be55d75ce6f5d438fc2bb6471f82a51575ae1ca.exe"C:\Users\Admin\AppData\Local\Temp\e78da21d88d678da382cf9f10be55d75ce6f5d438fc2bb6471f82a51575ae1ca.exe"1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1712 -
C:\Users\Admin\AppData\Local\Temp\vbc.exeC:\Users\Admin\AppData\Local\Temp\vbc.exe2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2144 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp\e78da21d88d678da382cf9f10be55d75ce6f5d438fc2bb6471f82a51575ae1ca.exe" +s +h3⤵
- Suspicious use of WriteProcessMemory
PID:2552 -
C:\Windows\SysWOW64\attrib.exeattrib "C:\Users\Admin\AppData\Local\Temp\e78da21d88d678da382cf9f10be55d75ce6f5d438fc2bb6471f82a51575ae1ca.exe" +s +h4⤵
- Sets file to hidden
- Views/modifies file attributes
PID:2104 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp" +s +h3⤵
- Suspicious use of WriteProcessMemory
PID:2740 -
C:\Windows\SysWOW64\attrib.exeattrib "C:\Users\Admin\AppData\Local\Temp" +s +h4⤵
- Sets file to hidden
- Views/modifies file attributes
PID:2616 -
C:\Windows\SysWOW64\notepad.exenotepad3⤵PID:2528
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.1MB
MD534aa912defa18c2c129f1e09d75c1d7e
SHA19c3046324657505a30ecd9b1fdb46c05bde7d470
SHA2566df94b7fa33f1b87142adc39b3db0613fc520d9e7a5fd6a5301dd7f51f8d0386
SHA512d1ea9368f5d7166180612fd763c87afb647d088498887961f5e7fb0a10f4a808bd5928e8a3666d70ff794093c51ecca8816f75dd47652fd4eb23dce7f9aa1f98