Analysis
-
max time kernel
149s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
29-10-2024 04:43
Behavioral task
behavioral1
Sample
c0d05ffb5f48fb2dc50ca22aa8e664c5b3f8eaf9b14575d9990953e4c3129b44.exe
Resource
win7-20240708-en
General
-
Target
c0d05ffb5f48fb2dc50ca22aa8e664c5b3f8eaf9b14575d9990953e4c3129b44.exe
-
Size
3.9MB
-
MD5
62ac9c1d7c6486c065f8d5a486efd755
-
SHA1
65a5445a571e4d5791e51dd8778beac1f97014c0
-
SHA256
c0d05ffb5f48fb2dc50ca22aa8e664c5b3f8eaf9b14575d9990953e4c3129b44
-
SHA512
f58d7767b8ce535d542804fb81f6a516fc5055cea294c3c0cd0c4b74f60d87133a2ad4a6d9e1b5b6ba448a2bc92558a810c93e532ca9b943e54e711f2a24b1ad
-
SSDEEP
98304:alX3KMj7yBNUVPhd5G0Z5DxdM3hZpmBAlB6D4tyX6kuT4IkQApCgvms0Cv05J5Cq:alX3KMj7yBNUVPhd5G0Z5DxdM3hZpmBq
Malware Config
Signatures
-
Darkcomet family
-
Checks BIOS information in registry 2 TTPs 1 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
Soundcrd.exedescription ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate Soundcrd.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
c0d05ffb5f48fb2dc50ca22aa8e664c5b3f8eaf9b14575d9990953e4c3129b44.exedescription ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\International\Geo\Nation c0d05ffb5f48fb2dc50ca22aa8e664c5b3f8eaf9b14575d9990953e4c3129b44.exe -
Executes dropped EXE 3 IoCs
Processes:
Soundcrd.exeSoundcrd.exeSoundcrd.exepid Process 5032 Soundcrd.exe 3596 Soundcrd.exe 4544 Soundcrd.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
reg.exedescription ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Mcrosoftt = "C:\\Users\\Admin\\AppData\\Roaming\\Soundcrd.exe" reg.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
Soundcrd.exedescription pid Process procid_target PID 5032 set thread context of 3596 5032 Soundcrd.exe 92 PID 5032 set thread context of 4544 5032 Soundcrd.exe 93 -
Processes:
resource yara_rule behavioral2/memory/4520-0-0x0000000000400000-0x00000000007EC000-memory.dmp upx behavioral2/files/0x000d000000023b6c-16.dat upx behavioral2/memory/4520-30-0x0000000000400000-0x00000000007EC000-memory.dmp upx behavioral2/memory/3596-35-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral2/memory/4544-39-0x0000000000400000-0x0000000000409000-memory.dmp upx behavioral2/memory/3596-43-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral2/memory/5032-46-0x0000000000400000-0x00000000007EC000-memory.dmp upx behavioral2/memory/3596-47-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral2/memory/3596-45-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral2/memory/4544-41-0x0000000000400000-0x0000000000409000-memory.dmp upx behavioral2/memory/4544-36-0x0000000000400000-0x0000000000409000-memory.dmp upx behavioral2/memory/3596-34-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral2/memory/3596-31-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral2/memory/3596-49-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral2/memory/3596-48-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral2/memory/3596-50-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral2/memory/4544-51-0x0000000000400000-0x0000000000409000-memory.dmp upx behavioral2/memory/3596-56-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral2/memory/3596-60-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral2/memory/3596-64-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral2/memory/3596-68-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral2/memory/3596-72-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral2/memory/3596-76-0x0000000000400000-0x00000000004B5000-memory.dmp upx -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 6 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
c0d05ffb5f48fb2dc50ca22aa8e664c5b3f8eaf9b14575d9990953e4c3129b44.execmd.exereg.exeSoundcrd.exeSoundcrd.exeSoundcrd.exedescription ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language c0d05ffb5f48fb2dc50ca22aa8e664c5b3f8eaf9b14575d9990953e4c3129b44.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Soundcrd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Soundcrd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Soundcrd.exe -
Checks processor information in registry 2 TTPs 4 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
Soundcrd.exedescription ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 Soundcrd.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString Soundcrd.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier Soundcrd.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier Soundcrd.exe -
Enumerates system info in registry 2 TTPs 1 IoCs
Processes:
Soundcrd.exedescription ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier Soundcrd.exe -
Suspicious use of AdjustPrivilegeToken 25 IoCs
Processes:
Soundcrd.exeSoundcrd.exedescription pid Process Token: SeDebugPrivilege 4544 Soundcrd.exe Token: SeIncreaseQuotaPrivilege 3596 Soundcrd.exe Token: SeSecurityPrivilege 3596 Soundcrd.exe Token: SeTakeOwnershipPrivilege 3596 Soundcrd.exe Token: SeLoadDriverPrivilege 3596 Soundcrd.exe Token: SeSystemProfilePrivilege 3596 Soundcrd.exe Token: SeSystemtimePrivilege 3596 Soundcrd.exe Token: SeProfSingleProcessPrivilege 3596 Soundcrd.exe Token: SeIncBasePriorityPrivilege 3596 Soundcrd.exe Token: SeCreatePagefilePrivilege 3596 Soundcrd.exe Token: SeBackupPrivilege 3596 Soundcrd.exe Token: SeRestorePrivilege 3596 Soundcrd.exe Token: SeShutdownPrivilege 3596 Soundcrd.exe Token: SeDebugPrivilege 3596 Soundcrd.exe Token: SeSystemEnvironmentPrivilege 3596 Soundcrd.exe Token: SeChangeNotifyPrivilege 3596 Soundcrd.exe Token: SeRemoteShutdownPrivilege 3596 Soundcrd.exe Token: SeUndockPrivilege 3596 Soundcrd.exe Token: SeManageVolumePrivilege 3596 Soundcrd.exe Token: SeImpersonatePrivilege 3596 Soundcrd.exe Token: SeCreateGlobalPrivilege 3596 Soundcrd.exe Token: 33 3596 Soundcrd.exe Token: 34 3596 Soundcrd.exe Token: 35 3596 Soundcrd.exe Token: 36 3596 Soundcrd.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
Processes:
c0d05ffb5f48fb2dc50ca22aa8e664c5b3f8eaf9b14575d9990953e4c3129b44.exeSoundcrd.exeSoundcrd.exepid Process 4520 c0d05ffb5f48fb2dc50ca22aa8e664c5b3f8eaf9b14575d9990953e4c3129b44.exe 5032 Soundcrd.exe 4544 Soundcrd.exe -
Suspicious use of WriteProcessMemory 25 IoCs
Processes:
c0d05ffb5f48fb2dc50ca22aa8e664c5b3f8eaf9b14575d9990953e4c3129b44.execmd.exeSoundcrd.exedescription pid Process procid_target PID 4520 wrote to memory of 5036 4520 c0d05ffb5f48fb2dc50ca22aa8e664c5b3f8eaf9b14575d9990953e4c3129b44.exe 86 PID 4520 wrote to memory of 5036 4520 c0d05ffb5f48fb2dc50ca22aa8e664c5b3f8eaf9b14575d9990953e4c3129b44.exe 86 PID 4520 wrote to memory of 5036 4520 c0d05ffb5f48fb2dc50ca22aa8e664c5b3f8eaf9b14575d9990953e4c3129b44.exe 86 PID 5036 wrote to memory of 3636 5036 cmd.exe 90 PID 5036 wrote to memory of 3636 5036 cmd.exe 90 PID 5036 wrote to memory of 3636 5036 cmd.exe 90 PID 4520 wrote to memory of 5032 4520 c0d05ffb5f48fb2dc50ca22aa8e664c5b3f8eaf9b14575d9990953e4c3129b44.exe 91 PID 4520 wrote to memory of 5032 4520 c0d05ffb5f48fb2dc50ca22aa8e664c5b3f8eaf9b14575d9990953e4c3129b44.exe 91 PID 4520 wrote to memory of 5032 4520 c0d05ffb5f48fb2dc50ca22aa8e664c5b3f8eaf9b14575d9990953e4c3129b44.exe 91 PID 5032 wrote to memory of 3596 5032 Soundcrd.exe 92 PID 5032 wrote to memory of 3596 5032 Soundcrd.exe 92 PID 5032 wrote to memory of 3596 5032 Soundcrd.exe 92 PID 5032 wrote to memory of 3596 5032 Soundcrd.exe 92 PID 5032 wrote to memory of 3596 5032 Soundcrd.exe 92 PID 5032 wrote to memory of 3596 5032 Soundcrd.exe 92 PID 5032 wrote to memory of 3596 5032 Soundcrd.exe 92 PID 5032 wrote to memory of 3596 5032 Soundcrd.exe 92 PID 5032 wrote to memory of 4544 5032 Soundcrd.exe 93 PID 5032 wrote to memory of 4544 5032 Soundcrd.exe 93 PID 5032 wrote to memory of 4544 5032 Soundcrd.exe 93 PID 5032 wrote to memory of 4544 5032 Soundcrd.exe 93 PID 5032 wrote to memory of 4544 5032 Soundcrd.exe 93 PID 5032 wrote to memory of 4544 5032 Soundcrd.exe 93 PID 5032 wrote to memory of 4544 5032 Soundcrd.exe 93 PID 5032 wrote to memory of 4544 5032 Soundcrd.exe 93
Processes
-
C:\Users\Admin\AppData\Local\Temp\c0d05ffb5f48fb2dc50ca22aa8e664c5b3f8eaf9b14575d9990953e4c3129b44.exe"C:\Users\Admin\AppData\Local\Temp\c0d05ffb5f48fb2dc50ca22aa8e664c5b3f8eaf9b14575d9990953e4c3129b44.exe"1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4520 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\QAKJp.bat" "2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5036 -
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "Mcrosoftt" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Soundcrd.exe" /f3⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
PID:3636
-
-
-
C:\Users\Admin\AppData\Roaming\Soundcrd.exe"C:\Users\Admin\AppData\Roaming\Soundcrd.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5032 -
C:\Users\Admin\AppData\Roaming\Soundcrd.exeC:\Users\Admin\AppData\Roaming\Soundcrd.exe3⤵
- Checks BIOS information in registry
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious use of AdjustPrivilegeToken
PID:3596
-
-
C:\Users\Admin\AppData\Roaming\Soundcrd.exeC:\Users\Admin\AppData\Roaming\Soundcrd.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:4544
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
139B
MD5173bcce4810d4901872d0ef4f0bfea4e
SHA1561b03fdfe68b6419fddf57f32e1aab9a6126a2f
SHA25610ea37eceabbe80fe9814280b66b957636951dbeeed18a9b4d50a1d24a6f1d1d
SHA5122401e0a5e3f7bf590a0767449da2249d09717e8c1cb71a7475e81d9615580001cfc38705cd1a5b4edc33f7df043bf195e28e4a5442a32bc879dffc6473bd545e
-
Filesize
3.9MB
MD5678404b6d07a278b63858bd3aa2beed8
SHA1733e265065b71c0810f33c8523442100fea4daf4
SHA256441237fb9e213c0c0f2448d9baa6d0f09f0757b5254d7de0461c801d184dc3e2
SHA5128cb6f60c2b9212b1972e1b1926b026cfec98068154b681c7b31d57b1e1c7edca76fd7eb8c7754ea2fafa71cbc0e8f217f7e530defa41b73ff1064c8a820c6e92