Analysis
-
max time kernel
120s -
max time network
119s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
18-11-2024 01:37
Behavioral task
behavioral1
Sample
6c1415a50022429cfd6f556e388ed02dafad0da3b62a0410c7415f9e12c788b7.exe
Resource
win7-20240903-en
General
-
Target
6c1415a50022429cfd6f556e388ed02dafad0da3b62a0410c7415f9e12c788b7.exe
-
Size
3.8MB
-
MD5
3e88b0e5b68aa272b984a52cc1e7d728
-
SHA1
70ba6e881e63cb609c189e2a54408ee52612fcff
-
SHA256
6c1415a50022429cfd6f556e388ed02dafad0da3b62a0410c7415f9e12c788b7
-
SHA512
ab3eca26be48b5fc46eb599c889593652b70aaf05da9cd4f8349e1d8914222d88caf3c7d3c4d4f3818630ddbf68bc8b96c10bb721b141ee37082155ce0484ca0
-
SSDEEP
98304:3i4hTLOMtHDMlANqnfVGPyhcMYg4lSiSLCQrdGLcjFjj/eWKS5h7EleIljztU/q5:3i4hTLOMtHDMlANqnfVGPyhcMYg4lSi7
Malware Config
Signatures
-
Darkcomet family
-
Checks BIOS information in registry 2 TTPs 1 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate mcsft.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation 6c1415a50022429cfd6f556e388ed02dafad0da3b62a0410c7415f9e12c788b7.exe -
Executes dropped EXE 2 IoCs
pid Process 3840 mcsft.exe 1476 mcsft.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Mcrosoft = "C:\\Users\\Admin\\AppData\\Roaming\\mcsft.exe" reg.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 3840 set thread context of 1476 3840 mcsft.exe 93 -
resource yara_rule behavioral2/memory/3020-0-0x0000000000400000-0x00000000007C9000-memory.dmp upx behavioral2/files/0x0008000000023c94-16.dat upx behavioral2/memory/3020-30-0x0000000000400000-0x00000000007C9000-memory.dmp upx behavioral2/memory/1476-31-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral2/memory/1476-34-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral2/memory/1476-35-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral2/memory/1476-37-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral2/memory/3840-40-0x0000000000400000-0x00000000007C9000-memory.dmp upx behavioral2/memory/1476-41-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral2/memory/1476-44-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral2/memory/1476-43-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral2/memory/1476-42-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral2/memory/1476-39-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral2/memory/1476-38-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral2/memory/1476-45-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral2/memory/1476-46-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral2/memory/1476-47-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral2/memory/1476-48-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral2/memory/1476-49-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral2/memory/1476-50-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral2/memory/1476-51-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral2/memory/1476-52-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral2/memory/1476-53-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral2/memory/1476-54-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral2/memory/1476-55-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral2/memory/1476-56-0x0000000000400000-0x00000000004B5000-memory.dmp upx -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6c1415a50022429cfd6f556e388ed02dafad0da3b62a0410c7415f9e12c788b7.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language mcsft.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language mcsft.exe -
Checks processor information in registry 2 TTPs 4 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 mcsft.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString mcsft.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier mcsft.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier mcsft.exe -
Enumerates system info in registry 2 TTPs 1 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier mcsft.exe -
Suspicious use of AdjustPrivilegeToken 24 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 1476 mcsft.exe Token: SeSecurityPrivilege 1476 mcsft.exe Token: SeTakeOwnershipPrivilege 1476 mcsft.exe Token: SeLoadDriverPrivilege 1476 mcsft.exe Token: SeSystemProfilePrivilege 1476 mcsft.exe Token: SeSystemtimePrivilege 1476 mcsft.exe Token: SeProfSingleProcessPrivilege 1476 mcsft.exe Token: SeIncBasePriorityPrivilege 1476 mcsft.exe Token: SeCreatePagefilePrivilege 1476 mcsft.exe Token: SeBackupPrivilege 1476 mcsft.exe Token: SeRestorePrivilege 1476 mcsft.exe Token: SeShutdownPrivilege 1476 mcsft.exe Token: SeDebugPrivilege 1476 mcsft.exe Token: SeSystemEnvironmentPrivilege 1476 mcsft.exe Token: SeChangeNotifyPrivilege 1476 mcsft.exe Token: SeRemoteShutdownPrivilege 1476 mcsft.exe Token: SeUndockPrivilege 1476 mcsft.exe Token: SeManageVolumePrivilege 1476 mcsft.exe Token: SeImpersonatePrivilege 1476 mcsft.exe Token: SeCreateGlobalPrivilege 1476 mcsft.exe Token: 33 1476 mcsft.exe Token: 34 1476 mcsft.exe Token: 35 1476 mcsft.exe Token: 36 1476 mcsft.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 3020 6c1415a50022429cfd6f556e388ed02dafad0da3b62a0410c7415f9e12c788b7.exe 3840 mcsft.exe 1476 mcsft.exe -
Suspicious use of WriteProcessMemory 17 IoCs
description pid Process procid_target PID 3020 wrote to memory of 1604 3020 6c1415a50022429cfd6f556e388ed02dafad0da3b62a0410c7415f9e12c788b7.exe 88 PID 3020 wrote to memory of 1604 3020 6c1415a50022429cfd6f556e388ed02dafad0da3b62a0410c7415f9e12c788b7.exe 88 PID 3020 wrote to memory of 1604 3020 6c1415a50022429cfd6f556e388ed02dafad0da3b62a0410c7415f9e12c788b7.exe 88 PID 1604 wrote to memory of 3688 1604 cmd.exe 91 PID 1604 wrote to memory of 3688 1604 cmd.exe 91 PID 1604 wrote to memory of 3688 1604 cmd.exe 91 PID 3020 wrote to memory of 3840 3020 6c1415a50022429cfd6f556e388ed02dafad0da3b62a0410c7415f9e12c788b7.exe 92 PID 3020 wrote to memory of 3840 3020 6c1415a50022429cfd6f556e388ed02dafad0da3b62a0410c7415f9e12c788b7.exe 92 PID 3020 wrote to memory of 3840 3020 6c1415a50022429cfd6f556e388ed02dafad0da3b62a0410c7415f9e12c788b7.exe 92 PID 3840 wrote to memory of 1476 3840 mcsft.exe 93 PID 3840 wrote to memory of 1476 3840 mcsft.exe 93 PID 3840 wrote to memory of 1476 3840 mcsft.exe 93 PID 3840 wrote to memory of 1476 3840 mcsft.exe 93 PID 3840 wrote to memory of 1476 3840 mcsft.exe 93 PID 3840 wrote to memory of 1476 3840 mcsft.exe 93 PID 3840 wrote to memory of 1476 3840 mcsft.exe 93 PID 3840 wrote to memory of 1476 3840 mcsft.exe 93
Processes
-
C:\Users\Admin\AppData\Local\Temp\6c1415a50022429cfd6f556e388ed02dafad0da3b62a0410c7415f9e12c788b7.exe"C:\Users\Admin\AppData\Local\Temp\6c1415a50022429cfd6f556e388ed02dafad0da3b62a0410c7415f9e12c788b7.exe"1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3020 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\DorMH.bat" "2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1604 -
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "Mcrosoft" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\mcsft.exe" /f3⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
PID:3688
-
-
-
C:\Users\Admin\AppData\Roaming\mcsft.exe"C:\Users\Admin\AppData\Roaming\mcsft.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3840 -
C:\Users\Admin\AppData\Roaming\mcsft.exeC:\Users\Admin\AppData\Roaming\mcsft.exe3⤵
- Checks BIOS information in registry
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1476
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
135B
MD5a5feca573884d76f559b996d45e8ad9a
SHA10e81a993f3af4e31d60653dc2513186f0495f1c8
SHA256c98e20d46d6465febb5d29cfab51241521ea5d6cd621f5e18b9b7d6fbfac3f0f
SHA512a9239648b5f15eac4d4151b6e1bdc81065eeaeb101404c2a0126f03bc87f1e6a57206bfa07a44379e9d3bba889e4497a9991ff41fb109099b01512df3dc3cbda
-
Filesize
3.8MB
MD5e27bd115488e0e93e8324365ea557394
SHA101562bee55354ceb60252ea8f8b365eefa424e31
SHA256911cbba24a3ebc4cb70c34215d56bbdffb622c3e341fe76fac0045653131bb17
SHA512e0e97cce3dbec89ce7899a8d627aa3cb9c1fba356eedeeffd97085d671088d32bafd2a7e900f70e78fe0e7c390fc5cb2c065b3de7aa94662cdc07b9a5f878ccb