Analysis
-
max time kernel
120s -
max time network
117s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
08-12-2024 05:00
Static task
static1
Behavioral task
behavioral1
Sample
7834fcbf6afbd23b8c94d2374b1ff4f07576110f5a06ee62c96b9c745df3dbedN.exe
Resource
win7-20240903-en
General
-
Target
7834fcbf6afbd23b8c94d2374b1ff4f07576110f5a06ee62c96b9c745df3dbedN.exe
-
Size
621KB
-
MD5
c940561721d0f3ba4ecdc6f75254d860
-
SHA1
e76448bc9374bca193ce44e7c8b45a97f99c586b
-
SHA256
7834fcbf6afbd23b8c94d2374b1ff4f07576110f5a06ee62c96b9c745df3dbed
-
SHA512
1a513a17810602990dc1f84e51958cdb874450b889343c5f2a5a0a643ccd0e198cf1a22aaebf99b9b83a49295cbf7164023bb305979280b32245d53af0a51d4b
-
SSDEEP
12288:fYQTKiAEfn2fQ2xDtiKU/MZEfzadOh0LvxZYDiI5tYMgz2R:VO4Yi6EfzaYh0Twj5ufzG
Malware Config
Extracted
darkcomet
Guest16
davaydavay123.no-ip.org:1610
DC_MUTEX-JZVHV5Z
-
InstallPath
MSDCSC\msdcsc.exe
-
gencode
lV69QiAKlk5T
-
install
true
-
offline_keylogger
true
-
persistence
false
-
reg_key
MicroUpdate
Signatures
-
Darkcomet family
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Users\\Admin\\AppData\\Local\\Temp\\MSDCSC\\msdcsc.exe" EEL HD.exe -
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation 7834fcbf6afbd23b8c94d2374b1ff4f07576110f5a06ee62c96b9c745df3dbedN.exe Key value queried \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation EEL HD.exe -
Executes dropped EXE 2 IoCs
pid Process 3424 EEL HD.exe 3168 msdcsc.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Users\\Admin\\AppData\\Local\\Temp\\MSDCSC\\msdcsc.exe" EEL HD.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EEL HD.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language msdcsc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7834fcbf6afbd23b8c94d2374b1ff4f07576110f5a06ee62c96b9c745df3dbedN.exe -
Suspicious use of AdjustPrivilegeToken 48 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 3424 EEL HD.exe Token: SeSecurityPrivilege 3424 EEL HD.exe Token: SeTakeOwnershipPrivilege 3424 EEL HD.exe Token: SeLoadDriverPrivilege 3424 EEL HD.exe Token: SeSystemProfilePrivilege 3424 EEL HD.exe Token: SeSystemtimePrivilege 3424 EEL HD.exe Token: SeProfSingleProcessPrivilege 3424 EEL HD.exe Token: SeIncBasePriorityPrivilege 3424 EEL HD.exe Token: SeCreatePagefilePrivilege 3424 EEL HD.exe Token: SeBackupPrivilege 3424 EEL HD.exe Token: SeRestorePrivilege 3424 EEL HD.exe Token: SeShutdownPrivilege 3424 EEL HD.exe Token: SeDebugPrivilege 3424 EEL HD.exe Token: SeSystemEnvironmentPrivilege 3424 EEL HD.exe Token: SeChangeNotifyPrivilege 3424 EEL HD.exe Token: SeRemoteShutdownPrivilege 3424 EEL HD.exe Token: SeUndockPrivilege 3424 EEL HD.exe Token: SeManageVolumePrivilege 3424 EEL HD.exe Token: SeImpersonatePrivilege 3424 EEL HD.exe Token: SeCreateGlobalPrivilege 3424 EEL HD.exe Token: 33 3424 EEL HD.exe Token: 34 3424 EEL HD.exe Token: 35 3424 EEL HD.exe Token: 36 3424 EEL HD.exe Token: SeIncreaseQuotaPrivilege 3168 msdcsc.exe Token: SeSecurityPrivilege 3168 msdcsc.exe Token: SeTakeOwnershipPrivilege 3168 msdcsc.exe Token: SeLoadDriverPrivilege 3168 msdcsc.exe Token: SeSystemProfilePrivilege 3168 msdcsc.exe Token: SeSystemtimePrivilege 3168 msdcsc.exe Token: SeProfSingleProcessPrivilege 3168 msdcsc.exe Token: SeIncBasePriorityPrivilege 3168 msdcsc.exe Token: SeCreatePagefilePrivilege 3168 msdcsc.exe Token: SeBackupPrivilege 3168 msdcsc.exe Token: SeRestorePrivilege 3168 msdcsc.exe Token: SeShutdownPrivilege 3168 msdcsc.exe Token: SeDebugPrivilege 3168 msdcsc.exe Token: SeSystemEnvironmentPrivilege 3168 msdcsc.exe Token: SeChangeNotifyPrivilege 3168 msdcsc.exe Token: SeRemoteShutdownPrivilege 3168 msdcsc.exe Token: SeUndockPrivilege 3168 msdcsc.exe Token: SeManageVolumePrivilege 3168 msdcsc.exe Token: SeImpersonatePrivilege 3168 msdcsc.exe Token: SeCreateGlobalPrivilege 3168 msdcsc.exe Token: 33 3168 msdcsc.exe Token: 34 3168 msdcsc.exe Token: 35 3168 msdcsc.exe Token: 36 3168 msdcsc.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 3168 msdcsc.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 2480 wrote to memory of 3424 2480 7834fcbf6afbd23b8c94d2374b1ff4f07576110f5a06ee62c96b9c745df3dbedN.exe 83 PID 2480 wrote to memory of 3424 2480 7834fcbf6afbd23b8c94d2374b1ff4f07576110f5a06ee62c96b9c745df3dbedN.exe 83 PID 2480 wrote to memory of 3424 2480 7834fcbf6afbd23b8c94d2374b1ff4f07576110f5a06ee62c96b9c745df3dbedN.exe 83 PID 3424 wrote to memory of 3168 3424 EEL HD.exe 84 PID 3424 wrote to memory of 3168 3424 EEL HD.exe 84 PID 3424 wrote to memory of 3168 3424 EEL HD.exe 84
Processes
-
C:\Users\Admin\AppData\Local\Temp\7834fcbf6afbd23b8c94d2374b1ff4f07576110f5a06ee62c96b9c745df3dbedN.exe"C:\Users\Admin\AppData\Local\Temp\7834fcbf6afbd23b8c94d2374b1ff4f07576110f5a06ee62c96b9c745df3dbedN.exe"1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2480 -
C:\Users\Admin\AppData\Local\Temp\EEL HD.exe"C:\Users\Admin\AppData\Local\Temp\EEL HD.exe"2⤵
- Modifies WinLogon for persistence
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3424 -
C:\Users\Admin\AppData\Local\Temp\MSDCSC\msdcsc.exe"C:\Users\Admin\AppData\Local\Temp\MSDCSC\msdcsc.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:3168
-
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
690KB
MD53216822dade31e777ac71c9a70d3a0b6
SHA15324d604ab4b91469dd83fc2f938aa82a28206a9
SHA256a477829c4b60e0472a8a273aae0a2a2cc7d1905c209f901e92d87c71a3f9da7f
SHA5122f0de9ab263f6592c1c54b58580598a5232c2716c164f099828acdd37debafa60989022bdce3083e35c4ea1418562f9295772917fb8d249cc99835ff83c912fc