Analysis
-
max time kernel
119s -
max time network
113s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
10-12-2024 15:16
Static task
static1
Behavioral task
behavioral1
Sample
e8412105090ad0e9d7d905b811afd4c055f69ed631b0b6de8fe34ffac23de890.exe
Resource
win7-20240903-en
General
-
Target
e8412105090ad0e9d7d905b811afd4c055f69ed631b0b6de8fe34ffac23de890.exe
-
Size
718KB
-
MD5
7a59e4b586b19bb7e57799e71831bf30
-
SHA1
260639259b3781deaed92c9c63e196a3b9c100be
-
SHA256
e8412105090ad0e9d7d905b811afd4c055f69ed631b0b6de8fe34ffac23de890
-
SHA512
e233cf418db931990a8671b6e1c7e52dc2a7595cb77e913e98c9f2c2150e6b713012cd19f2487761a8e364e320af47741cf7ab53142fe9305d7491a8b76d747c
-
SSDEEP
12288:QL88mbu2rpKomPPijFbJ34tEZCgWSZkK5VdKbggPdOXwx6vwGpy30Yw6W:b8p2goysF4taCgVRdiNlOQF30V
Malware Config
Extracted
darkcomet
fo
127.0.0.1:1010
46.39.230.61:1010
DC_MUTEX-PR2UBLF
-
gencode
ovcHaFsW9bRT
-
install
false
-
offline_keylogger
true
-
persistence
false
Signatures
-
Darkcomet family
-
Modifies security service 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wscsvc\Start = "4" ror.exe -
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" ror.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" ror.exe -
Disables RegEdit via registry modification 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" ror.exe -
Sets file to hidden 1 TTPs 2 IoCs
Modifies file attributes to stop it showing in Explorer etc.
pid Process 516 attrib.exe 1472 attrib.exe -
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation e8412105090ad0e9d7d905b811afd4c055f69ed631b0b6de8fe34ffac23de890.exe Key value queried \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation ror.exe -
Executes dropped EXE 1 IoCs
pid Process 3572 ror.exe -
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" ror.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" ror.exe -
resource yara_rule behavioral2/files/0x000c000000023b92-4.dat upx behavioral2/memory/3572-14-0x0000000000400000-0x00000000004B7000-memory.dmp upx behavioral2/memory/3572-19-0x0000000000400000-0x00000000004B7000-memory.dmp upx behavioral2/memory/3572-22-0x0000000000400000-0x00000000004B7000-memory.dmp upx behavioral2/memory/3572-24-0x0000000000400000-0x00000000004B7000-memory.dmp upx behavioral2/memory/3572-27-0x0000000000400000-0x00000000004B7000-memory.dmp upx behavioral2/memory/3572-29-0x0000000000400000-0x00000000004B7000-memory.dmp upx -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 1 IoCs
pid pid_target Process procid_target 3268 3988 WerFault.exe 87 -
System Location Discovery: System Language Discovery 1 TTPs 6 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language e8412105090ad0e9d7d905b811afd4c055f69ed631b0b6de8fe34ffac23de890.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ror.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language attrib.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language attrib.exe -
Modifies registry class 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings OpenWith.exe Key created \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings e8412105090ad0e9d7d905b811afd4c055f69ed631b0b6de8fe34ffac23de890.exe -
Suspicious use of AdjustPrivilegeToken 24 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 3572 ror.exe Token: SeSecurityPrivilege 3572 ror.exe Token: SeTakeOwnershipPrivilege 3572 ror.exe Token: SeLoadDriverPrivilege 3572 ror.exe Token: SeSystemProfilePrivilege 3572 ror.exe Token: SeSystemtimePrivilege 3572 ror.exe Token: SeProfSingleProcessPrivilege 3572 ror.exe Token: SeIncBasePriorityPrivilege 3572 ror.exe Token: SeCreatePagefilePrivilege 3572 ror.exe Token: SeBackupPrivilege 3572 ror.exe Token: SeRestorePrivilege 3572 ror.exe Token: SeShutdownPrivilege 3572 ror.exe Token: SeDebugPrivilege 3572 ror.exe Token: SeSystemEnvironmentPrivilege 3572 ror.exe Token: SeChangeNotifyPrivilege 3572 ror.exe Token: SeRemoteShutdownPrivilege 3572 ror.exe Token: SeUndockPrivilege 3572 ror.exe Token: SeManageVolumePrivilege 3572 ror.exe Token: SeImpersonatePrivilege 3572 ror.exe Token: SeCreateGlobalPrivilege 3572 ror.exe Token: 33 3572 ror.exe Token: 34 3572 ror.exe Token: 35 3572 ror.exe Token: 36 3572 ror.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 712 OpenWith.exe 3572 ror.exe -
Suspicious use of WriteProcessMemory 37 IoCs
description pid Process procid_target PID 224 wrote to memory of 3572 224 e8412105090ad0e9d7d905b811afd4c055f69ed631b0b6de8fe34ffac23de890.exe 82 PID 224 wrote to memory of 3572 224 e8412105090ad0e9d7d905b811afd4c055f69ed631b0b6de8fe34ffac23de890.exe 82 PID 224 wrote to memory of 3572 224 e8412105090ad0e9d7d905b811afd4c055f69ed631b0b6de8fe34ffac23de890.exe 82 PID 3572 wrote to memory of 3724 3572 ror.exe 84 PID 3572 wrote to memory of 3724 3572 ror.exe 84 PID 3572 wrote to memory of 3724 3572 ror.exe 84 PID 3572 wrote to memory of 396 3572 ror.exe 85 PID 3572 wrote to memory of 396 3572 ror.exe 85 PID 3572 wrote to memory of 396 3572 ror.exe 85 PID 3572 wrote to memory of 3988 3572 ror.exe 87 PID 3572 wrote to memory of 3988 3572 ror.exe 87 PID 3572 wrote to memory of 3988 3572 ror.exe 87 PID 3572 wrote to memory of 3988 3572 ror.exe 87 PID 3572 wrote to memory of 3988 3572 ror.exe 87 PID 3572 wrote to memory of 3988 3572 ror.exe 87 PID 3572 wrote to memory of 3988 3572 ror.exe 87 PID 3572 wrote to memory of 3988 3572 ror.exe 87 PID 3572 wrote to memory of 3988 3572 ror.exe 87 PID 3572 wrote to memory of 3988 3572 ror.exe 87 PID 3572 wrote to memory of 3988 3572 ror.exe 87 PID 3572 wrote to memory of 3988 3572 ror.exe 87 PID 3572 wrote to memory of 3988 3572 ror.exe 87 PID 3572 wrote to memory of 3988 3572 ror.exe 87 PID 3572 wrote to memory of 3988 3572 ror.exe 87 PID 3572 wrote to memory of 3988 3572 ror.exe 87 PID 3572 wrote to memory of 3988 3572 ror.exe 87 PID 3572 wrote to memory of 3988 3572 ror.exe 87 PID 3572 wrote to memory of 3988 3572 ror.exe 87 PID 3572 wrote to memory of 3988 3572 ror.exe 87 PID 3572 wrote to memory of 3988 3572 ror.exe 87 PID 3572 wrote to memory of 3988 3572 ror.exe 87 PID 3724 wrote to memory of 516 3724 cmd.exe 91 PID 3724 wrote to memory of 516 3724 cmd.exe 91 PID 3724 wrote to memory of 516 3724 cmd.exe 91 PID 396 wrote to memory of 1472 396 cmd.exe 92 PID 396 wrote to memory of 1472 396 cmd.exe 92 PID 396 wrote to memory of 1472 396 cmd.exe 92 -
System policy modification 1 TTPs 3 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\CurrentVersion ror.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\CurrentVersion\Explorern ror.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\CurrentVersion\Explorern\NoControlPanel = "1" ror.exe -
Views/modifies file attributes 1 TTPs 2 IoCs
pid Process 1472 attrib.exe 516 attrib.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\e8412105090ad0e9d7d905b811afd4c055f69ed631b0b6de8fe34ffac23de890.exe"C:\Users\Admin\AppData\Local\Temp\e8412105090ad0e9d7d905b811afd4c055f69ed631b0b6de8fe34ffac23de890.exe"1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:224 -
C:\Users\Admin\AppData\Local\Temp\ror.exe"C:\Users\Admin\AppData\Local\Temp\ror.exe"2⤵
- Modifies security service
- Windows security bypass
- Disables RegEdit via registry modification
- Checks computer location settings
- Executes dropped EXE
- Windows security modification
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:3572 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp\ror.exe" +s +h3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3724 -
C:\Windows\SysWOW64\attrib.exeattrib "C:\Users\Admin\AppData\Local\Temp\ror.exe" +s +h4⤵
- Sets file to hidden
- System Location Discovery: System Language Discovery
- Views/modifies file attributes
PID:516
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp" +s +h3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:396 -
C:\Windows\SysWOW64\attrib.exeattrib "C:\Users\Admin\AppData\Local\Temp" +s +h4⤵
- Sets file to hidden
- System Location Discovery: System Language Discovery
- Views/modifies file attributes
PID:1472
-
-
-
C:\Windows\SysWOW64\notepad.exenotepad3⤵PID:3988
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3988 -s 764⤵
- Program crash
PID:3268
-
-
-
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:712
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 3988 -ip 39881⤵PID:2864
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
251KB
MD5169b88b99a74428b0dbc617fb209379e
SHA14743c42d5aea002dc04dbfe4e4eba2a2c4da6014
SHA2566f6113d00980391262126021c78100e29d9cd12ca97c18ca1172c12e7138ce80
SHA51244fdf103ee303b7497a633f595daf22704dc7af012796201bf9ac76561b41d10b6fc6007f5de5eeadf2a1c2db83310a5b73a7a466da3bb92ef4f675244f3666d