Analysis
-
max time kernel
141s -
max time network
141s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system -
submitted
02-11-2024 06:42
Behavioral task
behavioral1
Sample
e61e9f9a51f15cc31070bbf1f374891d988ca01209418f504c490743572acf1f.exe
Resource
win7-20240729-en
General
-
Target
e61e9f9a51f15cc31070bbf1f374891d988ca01209418f504c490743572acf1f.exe
-
Size
559KB
-
MD5
c08faa536e3ca0b511c0ed78966c4f07
-
SHA1
10d9edde4ef90ce7fd7a050882e99de982396d46
-
SHA256
e61e9f9a51f15cc31070bbf1f374891d988ca01209418f504c490743572acf1f
-
SHA512
e4802cd0e6b174d45d2baff7497fdd49ba3c6d4d6ff10a5b747525870fe2127f90f912e6812d6a245c742af29b4a33492ddd8fb4319e5f7684ecc020554dfa5d
-
SSDEEP
12288:x+xOrozCCYaCphtIYJb6lzOqPpFOblme0pLLsbii9cWDeO7HtoNmKzoSo:COEzCFaCpAYJbwzOqPUlvOsmi9c8Sle
Malware Config
Signatures
-
Darkcomet family
-
Checks BIOS information in registry 2 TTPs 1 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate mcsft.exe -
Executes dropped EXE 2 IoCs
pid Process 3036 mcsft.exe 2644 mcsft.exe -
Loads dropped DLL 6 IoCs
pid Process 2552 e61e9f9a51f15cc31070bbf1f374891d988ca01209418f504c490743572acf1f.exe 2552 e61e9f9a51f15cc31070bbf1f374891d988ca01209418f504c490743572acf1f.exe 2552 e61e9f9a51f15cc31070bbf1f374891d988ca01209418f504c490743572acf1f.exe 2552 e61e9f9a51f15cc31070bbf1f374891d988ca01209418f504c490743572acf1f.exe 2552 e61e9f9a51f15cc31070bbf1f374891d988ca01209418f504c490743572acf1f.exe 3036 mcsft.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Run\Mcrosoft = "C:\\Users\\Admin\\AppData\\Roaming\\mcsft.exe" reg.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 3036 set thread context of 2644 3036 mcsft.exe 33 -
resource yara_rule behavioral1/memory/2552-0-0x0000000000400000-0x00000000007C8000-memory.dmp upx behavioral1/files/0x000800000001933b-30.dat upx behavioral1/memory/2552-47-0x0000000000400000-0x00000000007C8000-memory.dmp upx behavioral1/memory/2644-55-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral1/memory/3036-57-0x0000000000400000-0x00000000007C8000-memory.dmp upx behavioral1/memory/2644-52-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral1/memory/2644-58-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral1/memory/2644-60-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral1/memory/2644-61-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral1/memory/2644-59-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral1/memory/2644-64-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral1/memory/2644-63-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral1/memory/2644-62-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral1/memory/2644-65-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral1/memory/2644-68-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral1/memory/2644-70-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral1/memory/2644-72-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral1/memory/2644-74-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral1/memory/2644-76-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral1/memory/2644-78-0x0000000000400000-0x00000000004B5000-memory.dmp upx -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language e61e9f9a51f15cc31070bbf1f374891d988ca01209418f504c490743572acf1f.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language mcsft.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language mcsft.exe -
Checks processor information in registry 2 TTPs 4 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier mcsft.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 mcsft.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString mcsft.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier mcsft.exe -
Enumerates system info in registry 2 TTPs 1 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier mcsft.exe -
Suspicious use of AdjustPrivilegeToken 23 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 2644 mcsft.exe Token: SeSecurityPrivilege 2644 mcsft.exe Token: SeTakeOwnershipPrivilege 2644 mcsft.exe Token: SeLoadDriverPrivilege 2644 mcsft.exe Token: SeSystemProfilePrivilege 2644 mcsft.exe Token: SeSystemtimePrivilege 2644 mcsft.exe Token: SeProfSingleProcessPrivilege 2644 mcsft.exe Token: SeIncBasePriorityPrivilege 2644 mcsft.exe Token: SeCreatePagefilePrivilege 2644 mcsft.exe Token: SeBackupPrivilege 2644 mcsft.exe Token: SeRestorePrivilege 2644 mcsft.exe Token: SeShutdownPrivilege 2644 mcsft.exe Token: SeDebugPrivilege 2644 mcsft.exe Token: SeSystemEnvironmentPrivilege 2644 mcsft.exe Token: SeChangeNotifyPrivilege 2644 mcsft.exe Token: SeRemoteShutdownPrivilege 2644 mcsft.exe Token: SeUndockPrivilege 2644 mcsft.exe Token: SeManageVolumePrivilege 2644 mcsft.exe Token: SeImpersonatePrivilege 2644 mcsft.exe Token: SeCreateGlobalPrivilege 2644 mcsft.exe Token: 33 2644 mcsft.exe Token: 34 2644 mcsft.exe Token: 35 2644 mcsft.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 2552 e61e9f9a51f15cc31070bbf1f374891d988ca01209418f504c490743572acf1f.exe 3036 mcsft.exe 2644 mcsft.exe -
Suspicious use of WriteProcessMemory 21 IoCs
description pid Process procid_target PID 2552 wrote to memory of 2712 2552 e61e9f9a51f15cc31070bbf1f374891d988ca01209418f504c490743572acf1f.exe 29 PID 2552 wrote to memory of 2712 2552 e61e9f9a51f15cc31070bbf1f374891d988ca01209418f504c490743572acf1f.exe 29 PID 2552 wrote to memory of 2712 2552 e61e9f9a51f15cc31070bbf1f374891d988ca01209418f504c490743572acf1f.exe 29 PID 2552 wrote to memory of 2712 2552 e61e9f9a51f15cc31070bbf1f374891d988ca01209418f504c490743572acf1f.exe 29 PID 2712 wrote to memory of 2812 2712 cmd.exe 31 PID 2712 wrote to memory of 2812 2712 cmd.exe 31 PID 2712 wrote to memory of 2812 2712 cmd.exe 31 PID 2712 wrote to memory of 2812 2712 cmd.exe 31 PID 2552 wrote to memory of 3036 2552 e61e9f9a51f15cc31070bbf1f374891d988ca01209418f504c490743572acf1f.exe 32 PID 2552 wrote to memory of 3036 2552 e61e9f9a51f15cc31070bbf1f374891d988ca01209418f504c490743572acf1f.exe 32 PID 2552 wrote to memory of 3036 2552 e61e9f9a51f15cc31070bbf1f374891d988ca01209418f504c490743572acf1f.exe 32 PID 2552 wrote to memory of 3036 2552 e61e9f9a51f15cc31070bbf1f374891d988ca01209418f504c490743572acf1f.exe 32 PID 3036 wrote to memory of 2644 3036 mcsft.exe 33 PID 3036 wrote to memory of 2644 3036 mcsft.exe 33 PID 3036 wrote to memory of 2644 3036 mcsft.exe 33 PID 3036 wrote to memory of 2644 3036 mcsft.exe 33 PID 3036 wrote to memory of 2644 3036 mcsft.exe 33 PID 3036 wrote to memory of 2644 3036 mcsft.exe 33 PID 3036 wrote to memory of 2644 3036 mcsft.exe 33 PID 3036 wrote to memory of 2644 3036 mcsft.exe 33 PID 3036 wrote to memory of 2644 3036 mcsft.exe 33
Processes
-
C:\Users\Admin\AppData\Local\Temp\e61e9f9a51f15cc31070bbf1f374891d988ca01209418f504c490743572acf1f.exe"C:\Users\Admin\AppData\Local\Temp\e61e9f9a51f15cc31070bbf1f374891d988ca01209418f504c490743572acf1f.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2552 -
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\hFUaE.bat" "2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2712 -
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "Mcrosoft" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\mcsft.exe" /f3⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
PID:2812
-
-
-
C:\Users\Admin\AppData\Roaming\mcsft.exe"C:\Users\Admin\AppData\Roaming\mcsft.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3036 -
C:\Users\Admin\AppData\Roaming\mcsft.exeC:\Users\Admin\AppData\Roaming\mcsft.exe3⤵
- Checks BIOS information in registry
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2644
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
135B
MD5a5feca573884d76f559b996d45e8ad9a
SHA10e81a993f3af4e31d60653dc2513186f0495f1c8
SHA256c98e20d46d6465febb5d29cfab51241521ea5d6cd621f5e18b9b7d6fbfac3f0f
SHA512a9239648b5f15eac4d4151b6e1bdc81065eeaeb101404c2a0126f03bc87f1e6a57206bfa07a44379e9d3bba889e4497a9991ff41fb109099b01512df3dc3cbda
-
Filesize
559KB
MD5dfa547e5555b69f8adacef4504984b86
SHA12d487a40c72ad2dd58905052682792783716b29a
SHA256cf6d68193b8ba7c908def096144748601a3bb5e8f58e2802bcf8ec35be3d2cf1
SHA512cfd442862e0c427782fa6b8411345b7e4162acb084f17b5ff3d67000f83c4f5432f6f7d82eaf4cc91082b267019e884008a9857c20292da13988eb060426fd25