Analysis
-
max time kernel
120s -
max time network
16s -
platform
windows7_x64 -
resource
win7-20241023-en -
resource tags
arch:x64arch:x86image:win7-20241023-enlocale:en-usos:windows7-x64system -
submitted
08-11-2024 20:15
Behavioral task
behavioral1
Sample
eb2815a375facd439742c7f4c3c6e578c1f74c74fbd78624f6eb07f407e3de89N.exe
Resource
win7-20241023-en
General
-
Target
eb2815a375facd439742c7f4c3c6e578c1f74c74fbd78624f6eb07f407e3de89N.exe
-
Size
576KB
-
MD5
5410d97f00390baa17c1b0bedcbff780
-
SHA1
709dc50b14f572ae7d9c9f9d7fb8cf01677f5ebc
-
SHA256
eb2815a375facd439742c7f4c3c6e578c1f74c74fbd78624f6eb07f407e3de89
-
SHA512
65275e74dbe8de6032595837b069a82a1e0e2d5308193c15e8ce4cfa8b532895fde2f240087e9f4a16281c2c1a76e8fcfd033adcb2b8de994b52dae2bd1ebfd1
-
SSDEEP
12288:+NWPkHlUkErBuxQ4uzi6d6dL/yiXLzeMdK6io8levy0FhVlpzkzDDoSO:+NWPkHlUfBgpuPdWzyuDTifgyWlP
Malware Config
Signatures
-
Darkcomet family
-
Checks BIOS information in registry 2 TTPs 1 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate mcsft.exe -
Executes dropped EXE 2 IoCs
pid Process 588 mcsft.exe 2716 mcsft.exe -
Loads dropped DLL 5 IoCs
pid Process 2536 eb2815a375facd439742c7f4c3c6e578c1f74c74fbd78624f6eb07f407e3de89N.exe 2536 eb2815a375facd439742c7f4c3c6e578c1f74c74fbd78624f6eb07f407e3de89N.exe 2536 eb2815a375facd439742c7f4c3c6e578c1f74c74fbd78624f6eb07f407e3de89N.exe 2536 eb2815a375facd439742c7f4c3c6e578c1f74c74fbd78624f6eb07f407e3de89N.exe 2536 eb2815a375facd439742c7f4c3c6e578c1f74c74fbd78624f6eb07f407e3de89N.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Windows\CurrentVersion\Run\Mcrosoft = "C:\\Users\\Admin\\AppData\\Roaming\\mcsft.exe" reg.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 588 set thread context of 2716 588 mcsft.exe 34 -
resource yara_rule behavioral1/memory/2536-0-0x0000000000400000-0x00000000007C8000-memory.dmp upx behavioral1/files/0x0009000000016c66-30.dat upx behavioral1/memory/588-47-0x0000000000400000-0x00000000007C8000-memory.dmp upx behavioral1/memory/2536-49-0x0000000000400000-0x00000000007C8000-memory.dmp upx behavioral1/memory/2716-53-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral1/memory/2716-56-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral1/memory/2716-55-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral1/memory/588-58-0x0000000000400000-0x00000000007C8000-memory.dmp upx behavioral1/memory/2716-59-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral1/memory/2716-61-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral1/memory/2716-60-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral1/memory/2716-62-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral1/memory/2716-65-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral1/memory/2716-64-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral1/memory/2716-63-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral1/memory/2716-66-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral1/memory/2716-67-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral1/memory/2716-68-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral1/memory/2716-69-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral1/memory/2716-70-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral1/memory/2716-71-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral1/memory/2716-72-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral1/memory/2716-73-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral1/memory/2716-74-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral1/memory/2716-75-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral1/memory/2716-76-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral1/memory/2716-77-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral1/memory/2716-78-0x0000000000400000-0x00000000004B5000-memory.dmp upx -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language eb2815a375facd439742c7f4c3c6e578c1f74c74fbd78624f6eb07f407e3de89N.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language mcsft.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language mcsft.exe -
Checks processor information in registry 2 TTPs 4 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 mcsft.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString mcsft.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier mcsft.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier mcsft.exe -
Enumerates system info in registry 2 TTPs 1 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier mcsft.exe -
Suspicious use of AdjustPrivilegeToken 23 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 2716 mcsft.exe Token: SeSecurityPrivilege 2716 mcsft.exe Token: SeTakeOwnershipPrivilege 2716 mcsft.exe Token: SeLoadDriverPrivilege 2716 mcsft.exe Token: SeSystemProfilePrivilege 2716 mcsft.exe Token: SeSystemtimePrivilege 2716 mcsft.exe Token: SeProfSingleProcessPrivilege 2716 mcsft.exe Token: SeIncBasePriorityPrivilege 2716 mcsft.exe Token: SeCreatePagefilePrivilege 2716 mcsft.exe Token: SeBackupPrivilege 2716 mcsft.exe Token: SeRestorePrivilege 2716 mcsft.exe Token: SeShutdownPrivilege 2716 mcsft.exe Token: SeDebugPrivilege 2716 mcsft.exe Token: SeSystemEnvironmentPrivilege 2716 mcsft.exe Token: SeChangeNotifyPrivilege 2716 mcsft.exe Token: SeRemoteShutdownPrivilege 2716 mcsft.exe Token: SeUndockPrivilege 2716 mcsft.exe Token: SeManageVolumePrivilege 2716 mcsft.exe Token: SeImpersonatePrivilege 2716 mcsft.exe Token: SeCreateGlobalPrivilege 2716 mcsft.exe Token: 33 2716 mcsft.exe Token: 34 2716 mcsft.exe Token: 35 2716 mcsft.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 2536 eb2815a375facd439742c7f4c3c6e578c1f74c74fbd78624f6eb07f407e3de89N.exe 588 mcsft.exe 2716 mcsft.exe -
Suspicious use of WriteProcessMemory 21 IoCs
description pid Process procid_target PID 2536 wrote to memory of 2532 2536 eb2815a375facd439742c7f4c3c6e578c1f74c74fbd78624f6eb07f407e3de89N.exe 30 PID 2536 wrote to memory of 2532 2536 eb2815a375facd439742c7f4c3c6e578c1f74c74fbd78624f6eb07f407e3de89N.exe 30 PID 2536 wrote to memory of 2532 2536 eb2815a375facd439742c7f4c3c6e578c1f74c74fbd78624f6eb07f407e3de89N.exe 30 PID 2536 wrote to memory of 2532 2536 eb2815a375facd439742c7f4c3c6e578c1f74c74fbd78624f6eb07f407e3de89N.exe 30 PID 2532 wrote to memory of 2272 2532 cmd.exe 32 PID 2532 wrote to memory of 2272 2532 cmd.exe 32 PID 2532 wrote to memory of 2272 2532 cmd.exe 32 PID 2532 wrote to memory of 2272 2532 cmd.exe 32 PID 2536 wrote to memory of 588 2536 eb2815a375facd439742c7f4c3c6e578c1f74c74fbd78624f6eb07f407e3de89N.exe 33 PID 2536 wrote to memory of 588 2536 eb2815a375facd439742c7f4c3c6e578c1f74c74fbd78624f6eb07f407e3de89N.exe 33 PID 2536 wrote to memory of 588 2536 eb2815a375facd439742c7f4c3c6e578c1f74c74fbd78624f6eb07f407e3de89N.exe 33 PID 2536 wrote to memory of 588 2536 eb2815a375facd439742c7f4c3c6e578c1f74c74fbd78624f6eb07f407e3de89N.exe 33 PID 588 wrote to memory of 2716 588 mcsft.exe 34 PID 588 wrote to memory of 2716 588 mcsft.exe 34 PID 588 wrote to memory of 2716 588 mcsft.exe 34 PID 588 wrote to memory of 2716 588 mcsft.exe 34 PID 588 wrote to memory of 2716 588 mcsft.exe 34 PID 588 wrote to memory of 2716 588 mcsft.exe 34 PID 588 wrote to memory of 2716 588 mcsft.exe 34 PID 588 wrote to memory of 2716 588 mcsft.exe 34 PID 588 wrote to memory of 2716 588 mcsft.exe 34
Processes
-
C:\Users\Admin\AppData\Local\Temp\eb2815a375facd439742c7f4c3c6e578c1f74c74fbd78624f6eb07f407e3de89N.exe"C:\Users\Admin\AppData\Local\Temp\eb2815a375facd439742c7f4c3c6e578c1f74c74fbd78624f6eb07f407e3de89N.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2536 -
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\RvLqj.bat" "2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2532 -
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "Mcrosoft" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\mcsft.exe" /f3⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
PID:2272
-
-
-
C:\Users\Admin\AppData\Roaming\mcsft.exe"C:\Users\Admin\AppData\Roaming\mcsft.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:588 -
C:\Users\Admin\AppData\Roaming\mcsft.exeC:\Users\Admin\AppData\Roaming\mcsft.exe3⤵
- Checks BIOS information in registry
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2716
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
135B
MD5a5feca573884d76f559b996d45e8ad9a
SHA10e81a993f3af4e31d60653dc2513186f0495f1c8
SHA256c98e20d46d6465febb5d29cfab51241521ea5d6cd621f5e18b9b7d6fbfac3f0f
SHA512a9239648b5f15eac4d4151b6e1bdc81065eeaeb101404c2a0126f03bc87f1e6a57206bfa07a44379e9d3bba889e4497a9991ff41fb109099b01512df3dc3cbda
-
Filesize
576KB
MD532e0d646236ee69b157ede717401844b
SHA1269a20e528ac521c75bceb8413ad1af1da70a9c3
SHA256677e53e24f95592ae78acc1fa7c8566ac68ce9446b7945ea59fd133d1915cdb9
SHA512e69c7ea62d4184fddf95171f954f245044dbe2986a9b2a53af32f5a46de163d58ac0978d89d1b703045377d0384a98b206060bbcb63801755506038a9bd71887