Analysis
-
max time kernel
150s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
13-11-2024 02:42
Static task
static1
Behavioral task
behavioral1
Sample
c7d4c1c411927c1392f0793ee02108c86f134b90075ee2574fd0864657725d74.exe
Resource
win7-20240903-en
General
-
Target
c7d4c1c411927c1392f0793ee02108c86f134b90075ee2574fd0864657725d74.exe
-
Size
520KB
-
MD5
8bd5bac79fc049aebe1db767c7f4e8a2
-
SHA1
0566f6b910c319b8e0cf4783596832ab6855286f
-
SHA256
c7d4c1c411927c1392f0793ee02108c86f134b90075ee2574fd0864657725d74
-
SHA512
16b5dd41b9578b276f5b1231860fe2b779c30252399cf1cc23ae2b0785bdfee989c5ce9b67e9f734723353fbba8d79ddc69b7409ae07001639d2c8a0f37836d9
-
SSDEEP
6144:f9GGo2CwtGg6eeihEfph2CMvvqqSaYwpncOeC66AOa0aFtVEQfTo1ozVqMbd:f9fC3hh29Ya77A90aFtDfT5IMbd
Malware Config
Extracted
darkcomet
PrivateEye
ratblackshades.no-ip.biz:1604
DC_MUTEX-ACC1R98
-
gencode
8GG5LVVGljSF
-
install
false
-
offline_keylogger
true
-
persistence
false
Signatures
-
Darkcomet family
-
Executes dropped EXE 3 IoCs
pid Process 4544 winupd.exe 4904 winupd.exe 4960 winupd.exe -
Suspicious use of SetThreadContext 3 IoCs
description pid Process procid_target PID 4956 set thread context of 2164 4956 c7d4c1c411927c1392f0793ee02108c86f134b90075ee2574fd0864657725d74.exe 97 PID 4544 set thread context of 4904 4544 winupd.exe 101 PID 4544 set thread context of 4960 4544 winupd.exe 102 -
resource yara_rule behavioral2/memory/4960-32-0x0000000000400000-0x00000000004B7000-memory.dmp upx behavioral2/memory/4960-35-0x0000000000400000-0x00000000004B7000-memory.dmp upx behavioral2/memory/4960-38-0x0000000000400000-0x00000000004B7000-memory.dmp upx behavioral2/memory/4960-40-0x0000000000400000-0x00000000004B7000-memory.dmp upx behavioral2/memory/4960-42-0x0000000000400000-0x00000000004B7000-memory.dmp upx behavioral2/memory/4960-41-0x0000000000400000-0x00000000004B7000-memory.dmp upx behavioral2/memory/4960-39-0x0000000000400000-0x00000000004B7000-memory.dmp upx behavioral2/memory/4960-46-0x0000000000400000-0x00000000004B7000-memory.dmp upx behavioral2/memory/4960-47-0x0000000000400000-0x00000000004B7000-memory.dmp upx behavioral2/memory/4960-48-0x0000000000400000-0x00000000004B7000-memory.dmp upx behavioral2/memory/4960-49-0x0000000000400000-0x00000000004B7000-memory.dmp upx behavioral2/memory/4960-50-0x0000000000400000-0x00000000004B7000-memory.dmp upx behavioral2/memory/4960-52-0x0000000000400000-0x00000000004B7000-memory.dmp upx behavioral2/memory/4960-53-0x0000000000400000-0x00000000004B7000-memory.dmp upx behavioral2/memory/4960-54-0x0000000000400000-0x00000000004B7000-memory.dmp upx behavioral2/memory/4960-55-0x0000000000400000-0x00000000004B7000-memory.dmp upx behavioral2/memory/4960-56-0x0000000000400000-0x00000000004B7000-memory.dmp upx behavioral2/memory/4960-57-0x0000000000400000-0x00000000004B7000-memory.dmp upx behavioral2/memory/4960-58-0x0000000000400000-0x00000000004B7000-memory.dmp upx -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 1 IoCs
pid pid_target Process procid_target 4416 2372 WerFault.exe 103 -
System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language c7d4c1c411927c1392f0793ee02108c86f134b90075ee2574fd0864657725d74.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language c7d4c1c411927c1392f0793ee02108c86f134b90075ee2574fd0864657725d74.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language winupd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language winupd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language winupd.exe -
Gathers network information 2 TTPs 1 IoCs
Uses commandline utility to view network configuration.
pid Process 2372 ipconfig.exe -
Suspicious use of AdjustPrivilegeToken 24 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 4960 winupd.exe Token: SeSecurityPrivilege 4960 winupd.exe Token: SeTakeOwnershipPrivilege 4960 winupd.exe Token: SeLoadDriverPrivilege 4960 winupd.exe Token: SeSystemProfilePrivilege 4960 winupd.exe Token: SeSystemtimePrivilege 4960 winupd.exe Token: SeProfSingleProcessPrivilege 4960 winupd.exe Token: SeIncBasePriorityPrivilege 4960 winupd.exe Token: SeCreatePagefilePrivilege 4960 winupd.exe Token: SeBackupPrivilege 4960 winupd.exe Token: SeRestorePrivilege 4960 winupd.exe Token: SeShutdownPrivilege 4960 winupd.exe Token: SeDebugPrivilege 4960 winupd.exe Token: SeSystemEnvironmentPrivilege 4960 winupd.exe Token: SeChangeNotifyPrivilege 4960 winupd.exe Token: SeRemoteShutdownPrivilege 4960 winupd.exe Token: SeUndockPrivilege 4960 winupd.exe Token: SeManageVolumePrivilege 4960 winupd.exe Token: SeImpersonatePrivilege 4960 winupd.exe Token: SeCreateGlobalPrivilege 4960 winupd.exe Token: 33 4960 winupd.exe Token: 34 4960 winupd.exe Token: 35 4960 winupd.exe Token: 36 4960 winupd.exe -
Suspicious use of SetWindowsHookEx 5 IoCs
pid Process 4956 c7d4c1c411927c1392f0793ee02108c86f134b90075ee2574fd0864657725d74.exe 2164 c7d4c1c411927c1392f0793ee02108c86f134b90075ee2574fd0864657725d74.exe 4544 winupd.exe 4904 winupd.exe 4960 winupd.exe -
Suspicious use of WriteProcessMemory 32 IoCs
description pid Process procid_target PID 4956 wrote to memory of 2164 4956 c7d4c1c411927c1392f0793ee02108c86f134b90075ee2574fd0864657725d74.exe 97 PID 4956 wrote to memory of 2164 4956 c7d4c1c411927c1392f0793ee02108c86f134b90075ee2574fd0864657725d74.exe 97 PID 4956 wrote to memory of 2164 4956 c7d4c1c411927c1392f0793ee02108c86f134b90075ee2574fd0864657725d74.exe 97 PID 4956 wrote to memory of 2164 4956 c7d4c1c411927c1392f0793ee02108c86f134b90075ee2574fd0864657725d74.exe 97 PID 4956 wrote to memory of 2164 4956 c7d4c1c411927c1392f0793ee02108c86f134b90075ee2574fd0864657725d74.exe 97 PID 4956 wrote to memory of 2164 4956 c7d4c1c411927c1392f0793ee02108c86f134b90075ee2574fd0864657725d74.exe 97 PID 4956 wrote to memory of 2164 4956 c7d4c1c411927c1392f0793ee02108c86f134b90075ee2574fd0864657725d74.exe 97 PID 4956 wrote to memory of 2164 4956 c7d4c1c411927c1392f0793ee02108c86f134b90075ee2574fd0864657725d74.exe 97 PID 2164 wrote to memory of 4544 2164 c7d4c1c411927c1392f0793ee02108c86f134b90075ee2574fd0864657725d74.exe 98 PID 2164 wrote to memory of 4544 2164 c7d4c1c411927c1392f0793ee02108c86f134b90075ee2574fd0864657725d74.exe 98 PID 2164 wrote to memory of 4544 2164 c7d4c1c411927c1392f0793ee02108c86f134b90075ee2574fd0864657725d74.exe 98 PID 4544 wrote to memory of 4904 4544 winupd.exe 101 PID 4544 wrote to memory of 4904 4544 winupd.exe 101 PID 4544 wrote to memory of 4904 4544 winupd.exe 101 PID 4544 wrote to memory of 4904 4544 winupd.exe 101 PID 4544 wrote to memory of 4904 4544 winupd.exe 101 PID 4544 wrote to memory of 4904 4544 winupd.exe 101 PID 4544 wrote to memory of 4904 4544 winupd.exe 101 PID 4544 wrote to memory of 4904 4544 winupd.exe 101 PID 4544 wrote to memory of 4960 4544 winupd.exe 102 PID 4544 wrote to memory of 4960 4544 winupd.exe 102 PID 4544 wrote to memory of 4960 4544 winupd.exe 102 PID 4544 wrote to memory of 4960 4544 winupd.exe 102 PID 4544 wrote to memory of 4960 4544 winupd.exe 102 PID 4544 wrote to memory of 4960 4544 winupd.exe 102 PID 4544 wrote to memory of 4960 4544 winupd.exe 102 PID 4544 wrote to memory of 4960 4544 winupd.exe 102 PID 4904 wrote to memory of 2372 4904 winupd.exe 103 PID 4904 wrote to memory of 2372 4904 winupd.exe 103 PID 4904 wrote to memory of 2372 4904 winupd.exe 103 PID 4904 wrote to memory of 2372 4904 winupd.exe 103 PID 4904 wrote to memory of 2372 4904 winupd.exe 103
Processes
-
C:\Users\Admin\AppData\Local\Temp\c7d4c1c411927c1392f0793ee02108c86f134b90075ee2574fd0864657725d74.exe"C:\Users\Admin\AppData\Local\Temp\c7d4c1c411927c1392f0793ee02108c86f134b90075ee2574fd0864657725d74.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4956 -
C:\Users\Admin\AppData\Local\Temp\c7d4c1c411927c1392f0793ee02108c86f134b90075ee2574fd0864657725d74.exe"C:\Users\Admin\AppData\Local\Temp\c7d4c1c411927c1392f0793ee02108c86f134b90075ee2574fd0864657725d74.exe"2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2164 -
C:\Users\Admin\AppData\Roaming\Microsoft\winupd.exeC:\Users\Admin\AppData\Roaming\Microsoft\winupd.exe -notray3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4544 -
C:\Users\Admin\AppData\Roaming\Microsoft\winupd.exe"C:\Users\Admin\AppData\Roaming\Microsoft\winupd.exe"4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4904 -
C:\Windows\SysWOW64\ipconfig.exe"C:\Windows\system32\ipconfig.exe"5⤵
- Gathers network information
PID:2372 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2372 -s 2726⤵
- Program crash
PID:4416
-
-
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\winupd.exe"C:\Users\Admin\AppData\Roaming\Microsoft\winupd.exe"4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:4960
-
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2372 -ip 23721⤵PID:3364
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
520KB
MD52695ced887d528bb492e3e33ef0698e8
SHA178305e18b56e35a1decb8f76bc3ba637ebeda17d
SHA256b613fb963fb6bc9fcddbb02b734aec93e27dbc9174ecf27c845b011956cafba0
SHA512673bb6195683e156f3a98294cc407010aefaeb4fc218b7bf21069dc16a8e961359b81b70ed9fcbdd65ce110a81d9214f57169c2cb8520ac835da88c2b076264a