Analysis
-
max time kernel
149s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
02-11-2024 11:26
Static task
static1
Behavioral task
behavioral1
Sample
d8f9321b26f86c6a510521a184b1fbfd4db8ffc5f097f4ba3830e84a9f59f3b9N.exe
Resource
win7-20240903-en
General
-
Target
d8f9321b26f86c6a510521a184b1fbfd4db8ffc5f097f4ba3830e84a9f59f3b9N.exe
-
Size
3.9MB
-
MD5
c6def3cd8d68ad0f26661c40cc759340
-
SHA1
9bed9bb22b12f2845ff0710c1c479e6a5fbb8f35
-
SHA256
d8f9321b26f86c6a510521a184b1fbfd4db8ffc5f097f4ba3830e84a9f59f3b9
-
SHA512
fee9ae064bcc59cd12566683512bd0d2110bba707c1bd0b9996a2a10a541132ce11c715f43d306fc9bf5cf2957538e2d8bb868fbd0411ad38a642b81dbe3150d
-
SSDEEP
98304:IlX3KMj7yBNUVPhd5G0Z5DxdM3hZpmBAlB6D4tyX6kuT4IkQApCgvms0Cv05J5CQ:IlX3KMj7yBNUVPhd5G0Z5DxdM3hZpmBQ
Malware Config
Signatures
-
Darkcomet family
-
Checks BIOS information in registry 2 TTPs 1 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate Soundcrd.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation d8f9321b26f86c6a510521a184b1fbfd4db8ffc5f097f4ba3830e84a9f59f3b9N.exe -
Executes dropped EXE 3 IoCs
pid Process 2404 Soundcrd.exe 3216 Soundcrd.exe 3344 Soundcrd.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Mcrosoftt = "C:\\Users\\Admin\\AppData\\Roaming\\Soundcrd.exe" reg.exe -
Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 2404 set thread context of 3216 2404 Soundcrd.exe 94 PID 2404 set thread context of 3344 2404 Soundcrd.exe 95 -
resource yara_rule behavioral2/memory/3216-34-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral2/memory/3216-37-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral2/memory/3216-35-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral2/memory/3216-40-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral2/memory/3216-42-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral2/memory/3216-41-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral2/memory/3216-39-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral2/memory/3216-38-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral2/memory/3216-31-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral2/memory/3344-47-0x0000000000400000-0x0000000000409000-memory.dmp upx behavioral2/memory/3344-43-0x0000000000400000-0x0000000000409000-memory.dmp upx behavioral2/memory/3344-48-0x0000000000400000-0x0000000000409000-memory.dmp upx behavioral2/memory/3216-52-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral2/memory/3344-54-0x0000000000400000-0x0000000000409000-memory.dmp upx behavioral2/memory/3216-57-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral2/memory/3216-61-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral2/memory/3216-65-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral2/memory/3216-69-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral2/memory/3216-73-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral2/memory/3216-77-0x0000000000400000-0x00000000004B5000-memory.dmp upx -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 6 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Soundcrd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Soundcrd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Soundcrd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language d8f9321b26f86c6a510521a184b1fbfd4db8ffc5f097f4ba3830e84a9f59f3b9N.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe -
Checks processor information in registry 2 TTPs 4 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 Soundcrd.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString Soundcrd.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier Soundcrd.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier Soundcrd.exe -
Enumerates system info in registry 2 TTPs 1 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier Soundcrd.exe -
Suspicious use of AdjustPrivilegeToken 25 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 3216 Soundcrd.exe Token: SeSecurityPrivilege 3216 Soundcrd.exe Token: SeTakeOwnershipPrivilege 3216 Soundcrd.exe Token: SeLoadDriverPrivilege 3216 Soundcrd.exe Token: SeSystemProfilePrivilege 3216 Soundcrd.exe Token: SeSystemtimePrivilege 3216 Soundcrd.exe Token: SeProfSingleProcessPrivilege 3216 Soundcrd.exe Token: SeIncBasePriorityPrivilege 3216 Soundcrd.exe Token: SeCreatePagefilePrivilege 3216 Soundcrd.exe Token: SeBackupPrivilege 3216 Soundcrd.exe Token: SeRestorePrivilege 3216 Soundcrd.exe Token: SeShutdownPrivilege 3216 Soundcrd.exe Token: SeDebugPrivilege 3216 Soundcrd.exe Token: SeSystemEnvironmentPrivilege 3216 Soundcrd.exe Token: SeChangeNotifyPrivilege 3216 Soundcrd.exe Token: SeRemoteShutdownPrivilege 3216 Soundcrd.exe Token: SeUndockPrivilege 3216 Soundcrd.exe Token: SeManageVolumePrivilege 3216 Soundcrd.exe Token: SeImpersonatePrivilege 3216 Soundcrd.exe Token: SeCreateGlobalPrivilege 3216 Soundcrd.exe Token: 33 3216 Soundcrd.exe Token: 34 3216 Soundcrd.exe Token: 35 3216 Soundcrd.exe Token: 36 3216 Soundcrd.exe Token: SeDebugPrivilege 3344 Soundcrd.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 3748 d8f9321b26f86c6a510521a184b1fbfd4db8ffc5f097f4ba3830e84a9f59f3b9N.exe 2404 Soundcrd.exe 3344 Soundcrd.exe -
Suspicious use of WriteProcessMemory 25 IoCs
description pid Process procid_target PID 3748 wrote to memory of 4852 3748 d8f9321b26f86c6a510521a184b1fbfd4db8ffc5f097f4ba3830e84a9f59f3b9N.exe 89 PID 3748 wrote to memory of 4852 3748 d8f9321b26f86c6a510521a184b1fbfd4db8ffc5f097f4ba3830e84a9f59f3b9N.exe 89 PID 3748 wrote to memory of 4852 3748 d8f9321b26f86c6a510521a184b1fbfd4db8ffc5f097f4ba3830e84a9f59f3b9N.exe 89 PID 4852 wrote to memory of 1920 4852 cmd.exe 92 PID 4852 wrote to memory of 1920 4852 cmd.exe 92 PID 4852 wrote to memory of 1920 4852 cmd.exe 92 PID 3748 wrote to memory of 2404 3748 d8f9321b26f86c6a510521a184b1fbfd4db8ffc5f097f4ba3830e84a9f59f3b9N.exe 93 PID 3748 wrote to memory of 2404 3748 d8f9321b26f86c6a510521a184b1fbfd4db8ffc5f097f4ba3830e84a9f59f3b9N.exe 93 PID 3748 wrote to memory of 2404 3748 d8f9321b26f86c6a510521a184b1fbfd4db8ffc5f097f4ba3830e84a9f59f3b9N.exe 93 PID 2404 wrote to memory of 3216 2404 Soundcrd.exe 94 PID 2404 wrote to memory of 3216 2404 Soundcrd.exe 94 PID 2404 wrote to memory of 3216 2404 Soundcrd.exe 94 PID 2404 wrote to memory of 3216 2404 Soundcrd.exe 94 PID 2404 wrote to memory of 3216 2404 Soundcrd.exe 94 PID 2404 wrote to memory of 3216 2404 Soundcrd.exe 94 PID 2404 wrote to memory of 3216 2404 Soundcrd.exe 94 PID 2404 wrote to memory of 3216 2404 Soundcrd.exe 94 PID 2404 wrote to memory of 3344 2404 Soundcrd.exe 95 PID 2404 wrote to memory of 3344 2404 Soundcrd.exe 95 PID 2404 wrote to memory of 3344 2404 Soundcrd.exe 95 PID 2404 wrote to memory of 3344 2404 Soundcrd.exe 95 PID 2404 wrote to memory of 3344 2404 Soundcrd.exe 95 PID 2404 wrote to memory of 3344 2404 Soundcrd.exe 95 PID 2404 wrote to memory of 3344 2404 Soundcrd.exe 95 PID 2404 wrote to memory of 3344 2404 Soundcrd.exe 95
Processes
-
C:\Users\Admin\AppData\Local\Temp\d8f9321b26f86c6a510521a184b1fbfd4db8ffc5f097f4ba3830e84a9f59f3b9N.exe"C:\Users\Admin\AppData\Local\Temp\d8f9321b26f86c6a510521a184b1fbfd4db8ffc5f097f4ba3830e84a9f59f3b9N.exe"1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3748 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\Xsuyh.bat" "2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4852 -
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "Mcrosoftt" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Soundcrd.exe" /f3⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
PID:1920
-
-
-
C:\Users\Admin\AppData\Roaming\Soundcrd.exe"C:\Users\Admin\AppData\Roaming\Soundcrd.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2404 -
C:\Users\Admin\AppData\Roaming\Soundcrd.exeC:\Users\Admin\AppData\Roaming\Soundcrd.exe3⤵
- Checks BIOS information in registry
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious use of AdjustPrivilegeToken
PID:3216
-
-
C:\Users\Admin\AppData\Roaming\Soundcrd.exeC:\Users\Admin\AppData\Roaming\Soundcrd.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:3344
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
139B
MD5173bcce4810d4901872d0ef4f0bfea4e
SHA1561b03fdfe68b6419fddf57f32e1aab9a6126a2f
SHA25610ea37eceabbe80fe9814280b66b957636951dbeeed18a9b4d50a1d24a6f1d1d
SHA5122401e0a5e3f7bf590a0767449da2249d09717e8c1cb71a7475e81d9615580001cfc38705cd1a5b4edc33f7df043bf195e28e4a5442a32bc879dffc6473bd545e
-
Filesize
3.9MB
MD54079843aecbb95fd0fc9b7c5442397d8
SHA15d73a67302baf5aab83315c30b12e96d9cae8242
SHA256d166eb869b1f9ecfaaff8fefd6d3e6a6f2ea20a87bd795fa01494fd3da2ce1b0
SHA5128aa91cd21388999e852ddde48192acf7743278521e3bf41bfb2e51c42b25d50197068b36778a05c450cfb604e59b3b9417ffc86fbe4086d29f6aef302e252131