Analysis
-
max time kernel
119s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
10-12-2024 15:16
Static task
static1
Behavioral task
behavioral1
Sample
e8412105090ad0e9d7d905b811afd4c055f69ed631b0b6de8fe34ffac23de890.exe
Resource
win7-20240903-en
General
-
Target
e8412105090ad0e9d7d905b811afd4c055f69ed631b0b6de8fe34ffac23de890.exe
-
Size
718KB
-
MD5
7a59e4b586b19bb7e57799e71831bf30
-
SHA1
260639259b3781deaed92c9c63e196a3b9c100be
-
SHA256
e8412105090ad0e9d7d905b811afd4c055f69ed631b0b6de8fe34ffac23de890
-
SHA512
e233cf418db931990a8671b6e1c7e52dc2a7595cb77e913e98c9f2c2150e6b713012cd19f2487761a8e364e320af47741cf7ab53142fe9305d7491a8b76d747c
-
SSDEEP
12288:QL88mbu2rpKomPPijFbJ34tEZCgWSZkK5VdKbggPdOXwx6vwGpy30Yw6W:b8p2goysF4taCgVRdiNlOQF30V
Malware Config
Extracted
darkcomet
fo
127.0.0.1:1010
46.39.230.61:1010
DC_MUTEX-PR2UBLF
-
gencode
ovcHaFsW9bRT
-
install
false
-
offline_keylogger
true
-
persistence
false
Signatures
-
Darkcomet family
-
Modifies security service 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wscsvc\Start = "4" ror.exe -
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" ror.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" ror.exe -
Disables RegEdit via registry modification 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" ror.exe -
Sets file to hidden 1 TTPs 2 IoCs
Modifies file attributes to stop it showing in Explorer etc.
pid Process 2604 attrib.exe 2244 attrib.exe -
Executes dropped EXE 1 IoCs
pid Process 2256 ror.exe -
Loads dropped DLL 2 IoCs
pid Process 3000 e8412105090ad0e9d7d905b811afd4c055f69ed631b0b6de8fe34ffac23de890.exe 3000 e8412105090ad0e9d7d905b811afd4c055f69ed631b0b6de8fe34ffac23de890.exe -
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" ror.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" ror.exe -
resource yara_rule behavioral1/files/0x0007000000012119-11.dat upx behavioral1/memory/2256-12-0x0000000000400000-0x00000000004B7000-memory.dmp upx behavioral1/memory/2256-42-0x0000000000400000-0x00000000004B7000-memory.dmp upx behavioral1/memory/2256-45-0x0000000000400000-0x00000000004B7000-memory.dmp upx behavioral1/memory/2256-47-0x0000000000400000-0x00000000004B7000-memory.dmp upx behavioral1/memory/2256-51-0x0000000000400000-0x00000000004B7000-memory.dmp upx -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 7 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language attrib.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language attrib.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language e8412105090ad0e9d7d905b811afd4c055f69ed631b0b6de8fe34ffac23de890.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ror.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language notepad.exe -
Suspicious use of AdjustPrivilegeToken 23 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 2256 ror.exe Token: SeSecurityPrivilege 2256 ror.exe Token: SeTakeOwnershipPrivilege 2256 ror.exe Token: SeLoadDriverPrivilege 2256 ror.exe Token: SeSystemProfilePrivilege 2256 ror.exe Token: SeSystemtimePrivilege 2256 ror.exe Token: SeProfSingleProcessPrivilege 2256 ror.exe Token: SeIncBasePriorityPrivilege 2256 ror.exe Token: SeCreatePagefilePrivilege 2256 ror.exe Token: SeBackupPrivilege 2256 ror.exe Token: SeRestorePrivilege 2256 ror.exe Token: SeShutdownPrivilege 2256 ror.exe Token: SeDebugPrivilege 2256 ror.exe Token: SeSystemEnvironmentPrivilege 2256 ror.exe Token: SeChangeNotifyPrivilege 2256 ror.exe Token: SeRemoteShutdownPrivilege 2256 ror.exe Token: SeUndockPrivilege 2256 ror.exe Token: SeManageVolumePrivilege 2256 ror.exe Token: SeImpersonatePrivilege 2256 ror.exe Token: SeCreateGlobalPrivilege 2256 ror.exe Token: 33 2256 ror.exe Token: 34 2256 ror.exe Token: 35 2256 ror.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2256 ror.exe -
Suspicious use of WriteProcessMemory 43 IoCs
description pid Process procid_target PID 3000 wrote to memory of 2256 3000 e8412105090ad0e9d7d905b811afd4c055f69ed631b0b6de8fe34ffac23de890.exe 30 PID 3000 wrote to memory of 2256 3000 e8412105090ad0e9d7d905b811afd4c055f69ed631b0b6de8fe34ffac23de890.exe 30 PID 3000 wrote to memory of 2256 3000 e8412105090ad0e9d7d905b811afd4c055f69ed631b0b6de8fe34ffac23de890.exe 30 PID 3000 wrote to memory of 2256 3000 e8412105090ad0e9d7d905b811afd4c055f69ed631b0b6de8fe34ffac23de890.exe 30 PID 2256 wrote to memory of 1864 2256 ror.exe 31 PID 2256 wrote to memory of 1864 2256 ror.exe 31 PID 2256 wrote to memory of 1864 2256 ror.exe 31 PID 2256 wrote to memory of 1864 2256 ror.exe 31 PID 2256 wrote to memory of 2068 2256 ror.exe 33 PID 2256 wrote to memory of 2068 2256 ror.exe 33 PID 2256 wrote to memory of 2068 2256 ror.exe 33 PID 2256 wrote to memory of 2068 2256 ror.exe 33 PID 2256 wrote to memory of 2284 2256 ror.exe 35 PID 2256 wrote to memory of 2284 2256 ror.exe 35 PID 2256 wrote to memory of 2284 2256 ror.exe 35 PID 2256 wrote to memory of 2284 2256 ror.exe 35 PID 2256 wrote to memory of 2284 2256 ror.exe 35 PID 2256 wrote to memory of 2284 2256 ror.exe 35 PID 2256 wrote to memory of 2284 2256 ror.exe 35 PID 2256 wrote to memory of 2284 2256 ror.exe 35 PID 2256 wrote to memory of 2284 2256 ror.exe 35 PID 2256 wrote to memory of 2284 2256 ror.exe 35 PID 2256 wrote to memory of 2284 2256 ror.exe 35 PID 2256 wrote to memory of 2284 2256 ror.exe 35 PID 2256 wrote to memory of 2284 2256 ror.exe 35 PID 2256 wrote to memory of 2284 2256 ror.exe 35 PID 2256 wrote to memory of 2284 2256 ror.exe 35 PID 2256 wrote to memory of 2284 2256 ror.exe 35 PID 2256 wrote to memory of 2284 2256 ror.exe 35 PID 2256 wrote to memory of 2284 2256 ror.exe 35 PID 2256 wrote to memory of 2284 2256 ror.exe 35 PID 2256 wrote to memory of 2284 2256 ror.exe 35 PID 2256 wrote to memory of 2284 2256 ror.exe 35 PID 2256 wrote to memory of 2284 2256 ror.exe 35 PID 2256 wrote to memory of 2284 2256 ror.exe 35 PID 1864 wrote to memory of 2604 1864 cmd.exe 36 PID 1864 wrote to memory of 2604 1864 cmd.exe 36 PID 1864 wrote to memory of 2604 1864 cmd.exe 36 PID 1864 wrote to memory of 2604 1864 cmd.exe 36 PID 2068 wrote to memory of 2244 2068 cmd.exe 37 PID 2068 wrote to memory of 2244 2068 cmd.exe 37 PID 2068 wrote to memory of 2244 2068 cmd.exe 37 PID 2068 wrote to memory of 2244 2068 cmd.exe 37 -
System policy modification 1 TTPs 3 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\CurrentVersion ror.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\CurrentVersion\Explorern ror.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\CurrentVersion\Explorern\NoControlPanel = "1" ror.exe -
Views/modifies file attributes 1 TTPs 2 IoCs
pid Process 2604 attrib.exe 2244 attrib.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\e8412105090ad0e9d7d905b811afd4c055f69ed631b0b6de8fe34ffac23de890.exe"C:\Users\Admin\AppData\Local\Temp\e8412105090ad0e9d7d905b811afd4c055f69ed631b0b6de8fe34ffac23de890.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3000 -
C:\Users\Admin\AppData\Local\Temp\ror.exe"C:\Users\Admin\AppData\Local\Temp\ror.exe"2⤵
- Modifies security service
- Windows security bypass
- Disables RegEdit via registry modification
- Executes dropped EXE
- Windows security modification
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2256 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp\ror.exe" +s +h3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1864 -
C:\Windows\SysWOW64\attrib.exeattrib "C:\Users\Admin\AppData\Local\Temp\ror.exe" +s +h4⤵
- Sets file to hidden
- System Location Discovery: System Language Discovery
- Views/modifies file attributes
PID:2604
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp" +s +h3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2068 -
C:\Windows\SysWOW64\attrib.exeattrib "C:\Users\Admin\AppData\Local\Temp" +s +h4⤵
- Sets file to hidden
- System Location Discovery: System Language Discovery
- Views/modifies file attributes
PID:2244
-
-
-
C:\Windows\SysWOW64\notepad.exenotepad3⤵
- System Location Discovery: System Language Discovery
PID:2284
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
251KB
MD5169b88b99a74428b0dbc617fb209379e
SHA14743c42d5aea002dc04dbfe4e4eba2a2c4da6014
SHA2566f6113d00980391262126021c78100e29d9cd12ca97c18ca1172c12e7138ce80
SHA51244fdf103ee303b7497a633f595daf22704dc7af012796201bf9ac76561b41d10b6fc6007f5de5eeadf2a1c2db83310a5b73a7a466da3bb92ef4f675244f3666d