Overview

overview

10

Static

static

1

RNSM00355.7z

windows7-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    RNSM00355.7z

  • Size

    8.4MB

  • Sample

    241107-1aeg4s1pfj

  • MD5

    1e27240afe6f2292ebdda2f35af1379f

  • SHA1

    f98cfd4bc31e3c07e90080df33022cb323822cf7

  • SHA256

    984ce7df6ebb527fdf397217bf2879c72dc3acca8078e64dc002b86da548efbe

  • SHA512

    e28ff232eb03d6e98503ec79bd1ad2d61a4b68f444cef0136c3ea104a1e25dba041334616355619e85b2279ab38b5a0650d67e917cee57d15ccc403787cec604

  • SSDEEP

    196608:QRAB5GdPTtXNJT3khw37TBDJAUwpFbxPm9i5TZaGMbc:QRg0RT06rtttGFbxPmgTZcbc

Score
10/10
darkcometmodiloaderdefense_evasiondiscoveryevasionexecutionimpactpersistenceransomwarerattrojanupx

Malware Config

Extracted

Family

darkcomet

C2

asftp.no-ip.org:1766

Mutex

DC_MUTEX-TNB4ASC

Attributes
  • InstallPath

    c:\Program Files\Java Runtime\Java Updater.exe

  • gencode

    XDxYlNLNS75r

  • install

    true

  • offline_keylogger

    true

  • password

    52410

  • persistence

    false

  • reg_key

    Java

Extracted

Path

C:\$Recycle.Bin\QSQZINPORQ-DECRYPT.txt

Ransom Note
---= GANDCRAB V5.0.4 =--- ***********************UNDER NO CIRCUMSTANCES DO NOT DELETE THIS FILE, UNTIL ALL YOUR DATA IS RECOVERED*********************** *****FAILING TO DO SO, WILL RESULT IN YOUR SYSTEM CORRUPTION, IF THERE ARE DECRYPTION ERRORS***** Attention! All your files, documents, photos, databases and other important files are encrypted and have the extension: .QSQZINPORQ The only method of recovering files is to purchase an unique private key. Only we can give you this key and only we can recover your files. The server with your key is in a closed network TOR. You can get there by the following ways: ---------------------------------------------------------------------------------------- | 0. Download Tor browser - https://www.torproject.org/ | 1. Install Tor browser | 2. Open Tor Browser | 3. Open link in TOR browser: http://gandcrabmfe6mnef.onion/3559b22c8b3c4d7 | 4. Follow the instructions on this page ---------------------------------------------------------------------------------------- On our page you will see instructions on payment and get the opportunity to decrypt 1 file for free. ATTENTION! IN ORDER TO PREVENT DATA DAMAGE: * DO NOT MODIFY ENCRYPTED FILES * DO NOT CHANGE DATA BELOW ---BEGIN GANDCRAB KEY--- lAQAAGFNxSRfdSGciatpWa0agm+NfQFXdv80Au4XmNj6shS2MFxI4pIXho7bUukKvsH6xWuUAefnD7F0MeD4EuzdmkLCxZDtf930DAJoY18SgPuLuvT+c4EzUachUUrNFHnw9Crz+w5aktz5/AfPDfIZWTMmob37J96RgzfWe2wX3EKixRBMj/5yIPO0pI8yXY7YLbHTtr0pn9wZ3qahS4LjhPqw2kSqXD7mkx8WYSL4MrCChBhKxGwbRC8C0/pSvku41mskNbxgUbe+H1oZiit117L69BfaGd747iDgnBRBeINe2gl2dan7UUNNBbSDwAb/zM0Yn/R/bnckESPYevNF6iYtZTrxRirh3DkzFAv5MJAj7AEpMuEfMSbn2d6vOBDdXmarBRfW1cTtsFpB0/E5QqkbqEWLvvrf4eNsOqNrMwXr1KiLYlkns7Z/lwLfYiJ4z8FvBWEnlBiksNxRkZDzxB6dyIhFnoVCij/pRIwNfLIWJTxMrZcLK/M7Io5oNYSn/o4ZPGCZawrPL8nPmPjklZZo1rImMDhpibUcplZGcGNKqIe2gRFsDoDBsPLINmhHOYcNGlY9EBmq+NQ1YFzAp2c9l6sPPGCjp5VCi35yqQxoCNiphXI4GJ+DzzPUa7I/1Qhxu5K7i43Ly3CnIZZOZHRinsWyF4hSgn5SL5OVqROA1WrDPWc1n4Omku0GYaOFNCDrT6VcILiq4RSvPiQJXINUEdsJap23tCzT92FWYXIiXecdpRtOyDrYNzbs248Z2lKcRIYhTD91uIxON3HTmFHCYdfVQEbH7mjMNKDGumA+6BpI9tUHkh3jwzjpecrtpDXGgvcAAuFwn/g1VMYlA0Uwk6akkTCsJWry58Q3RLSqBd7Cz7SHo7E0CINKcCCs3HzPAHdnapgFB1CHYUP/SVKlJKTWQt2wtXPrRd4ADnVu8k8n4FrkC4En+E0LbN3zqR+qL0HbXu9p7hUrOAQSDRzXm8jNVNziZsyEyaFtboXnl8KyZcXA1qOfR3E9ViPj/8l3T8bdj1S4SXZ9uNdj4k24nZLFBggCsLlvFFbmlfaEYwG2uywBCsdg5KzDxGzhNE2CGFGFysNyuyPIHMYL0U00it/u96053nhEzHKuP3vMu90Xe5PkXqYujWpNh0GEoRwNXkLOXuICzcj3CQdO7CzHOugHrkUp1v8SvaqOgNIkDPJUYEU0WuxwMG11PPypm2os+lc2YiKcFu22ZO8RBZln7rWFmDHECmcJtoCanTXc3fJSSERASuERPnVWEa+HEsP8nH8jSl4oVSIHhNKsbujoF8Uwe8N44iyJj7lAz1f7go+66XTBK3lF3cL1wLuMWMS+wgWBemwur3MZAWxFusVuvJFfSwmGqQXwdwLd2JgqCGmykFrI2QPrDH6+vbgUcr/ziwaJp+HFEMSnBq0GnVYHHfM06Q4HnjaxMYlKA+Qz6m/N3HcvvWCYYhQgyO+qp3ggd+NiYCOnS3antRYpCmZcAzz5uEwo+9KGM+B5UBHXpMhchBCLZeJJm0Ro3bVgk2G4eBXYhKVvoIlgnJ8JUUYhOOvNBFjpV9GO2Kni8H82x4+XvbM1hBwHJ0A+L7stQ1nZXonOb2DLalpd3kE5p9yMHuPcyUa8L6ky/lC2O23LS28PsrN55ill0BIqeZMxyW6evrdPA2CHaaLtT9hhts6D3QYsRhqVrRlgxlwFufwVrnBIyBVLhn7KMOykFf8kfxQUN6hg1eM6ljrLc6naul9UcH5x0go422LBiH2I6l/9nVobGs0whc49lRCuw8OFBumWQZZR1RnN2QTjFTJHlQ419ta5RvWExSX/hp2xJWWUajxW56DKAFAof0z1mA5IcfyrjO4s1B1gfY36G8QiDwB8AGlN4JTWFjuBRoqkFKVoordNg4WBPEVajAfmZQIASrGd8RZDwamShfelN7ttXFSBTAjdabTZlyaP7FgnP9TEfog5CW1GZw/tX/5JbCQSannkT+GJi040c0gjdMOWcXhBAaIUNESHvuhLamNmYYvLEFpet50IjyERNxGEjOCOLGvpwRd9h3tibZ/V3QzSpIJ+AJShjqeXOCLlWx+/le8kT0QDkR1UArzVbYbByCecKTmDlcPG8wdfA+MRJ7u4mWvymoZuR0vFbF2cFfZ8f3q85yabwsu6+MWjFUsWfxM0blgEyZzES+lranhSSCZA4EMPYi952F09+I0zmeiTVUxAbSaqP0XlvmsG8NqBaKwGQfZm3/E= ---END GANDCRAB KEY--- ---BEGIN PC DATA--- wfKD6iudumBkmpL8IRr4U4exEVaoOXLtwDwmOrT1y1YWvOiWMx5GYaRdvZZVTpRRpnYN7nJWo7feTGSHhh5qBJzzs9MC7736UkGSDDniUJJG8/LFF//kmGmoAZAGLo2j5/wd2UrxMJK+iqKhTkS3ArgAxrZOOOiXrbnhbWMkLHQnbYuWlMClYZxYU6SDxpopRo5r292AV1KIZBZV4APBuUHcKSIr2MWMI0O1MKIP2IpKLE2TS5wLmpQodXZhP6M/UPrO1sZzkDbgjYlAG3g8l65nVd0/CBUxKQ7KDJYrtX0vSmnFXg/ykfgtJNiwqfCnqbr85+Bi4LF3kU3B6eL2/2Q2E+t1GtNYPlqABnTtqRGCEd4btydK4o24b6bsY7hyY4zV2QKiqZRuTRsqAVO9JIcJoJFowNooAhPLnKY+DO5bAL6fi2Epg65rKw3oxAhKwg7zZifpCBFJ3vDLOOar1xoZR3QcRiOKBTm51iTgAH9imUrfmSz2QU5nmbImlsyw6XINVYbpeDfrfB0ceMBkP3JNgn9SQ3nC26ZUErrteEilBYhMZZH9HowOP7+LRYsPy4knV/fu67POzMP9PnYTh4gzvuwKRb5tB/+FbmHWs+IUXo5eM9Q19EZhLFKM2u1g1mmDLQgzxwsJfjT5T2ECiWME ---END PC DATA---
URLs

http://gandcrabmfe6mnef.onion/3559b22c8b3c4d7

Targets

    • Target

      RNSM00355.7z

    • Size

      8.4MB

    • MD5

      1e27240afe6f2292ebdda2f35af1379f

    • SHA1

      f98cfd4bc31e3c07e90080df33022cb323822cf7

    • SHA256

      984ce7df6ebb527fdf397217bf2879c72dc3acca8078e64dc002b86da548efbe

    • SHA512

      e28ff232eb03d6e98503ec79bd1ad2d61a4b68f444cef0136c3ea104a1e25dba041334616355619e85b2279ab38b5a0650d67e917cee57d15ccc403787cec604

    • SSDEEP

      196608:QRAB5GdPTtXNJT3khw37TBDJAUwpFbxPm9i5TZaGMbc:QRg0RT06rtttGFbxPmgTZcbc

    Score
    10/10
    darkcometmodiloaderdefense_evasiondiscoveryevasionexecutionimpactpersistenceransomwarerattrojanupx

    • Darkcomet

      DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

      trojanratdarkcomet

    • Darkcomet family

      darkcomet

    • ModiLoader, DBatLoader

      ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

      trojanmodiloader

    • Modifies WinLogon for persistence

      persistence

    • Modiloader family

      modiloader

    • Contacts a large (16404) amount of remote hosts

      This may indicate a network scan to discover remotely running services.

      discovery

    • Creates a large amount of network flows

      This may indicate a network scan to discover remotely running services.

      discovery

    • Deletes shadow copies

      Ransomware often targets backup files to inhibit system recovery.

      ransomwaredefense_evasionimpactexecution

    • ModiLoader Second Stage

    • Modifies boot configuration data using bcdedit

      ransomwareevasion

    • Drops file in Drivers directory

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • AutoIT Executable

      AutoIT scripts compiled to PE executables.

    • Suspicious use of SetThreadContext

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral1

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Windows Management Instrumentation

1
T1047

Persistence

Boot or Logon Autostart Execution

2
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Winlogon Helper DLL

1
T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

2
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Winlogon Helper DLL

1
T1547.004

Defense Evasion

Direct Volume Access

1
T1006

Indicator Removal

2
T1070

File Deletion

2
T1070.004

Modify Registry

2
T1112

Credential Access

Discovery

Network Service Discovery

2
T1046

Query Registry

1
T1012

Remote System Discovery

1
T1018

System Information Discovery

1
T1082

System Location Discovery

1
T1614

System Language Discovery

1
T1614.001

System Network Configuration Discovery

1
T1016

Internet Connection Discovery

1
T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Inhibit System Recovery

3
T1490

Tasks