Analysis
-
max time kernel
112s -
max time network
121s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
10-12-2024 21:01
Static task
static1
Behavioral task
behavioral1
Sample
5ff3f1dc8602ffe1e546da895ee6d732844f4c63ae79eb36ad93ba829ecd06c5.exe
Resource
win7-20241023-en
General
-
Target
5ff3f1dc8602ffe1e546da895ee6d732844f4c63ae79eb36ad93ba829ecd06c5.exe
-
Size
574KB
-
MD5
f0d5d2eaff412860a20ee3bb28f38864
-
SHA1
77838c5ea88e77d1f133a03f9dceb89b61f396fa
-
SHA256
5ff3f1dc8602ffe1e546da895ee6d732844f4c63ae79eb36ad93ba829ecd06c5
-
SHA512
b3fba22eaab5d300839479ff5134c1d3437a48f42679818367180bdb04454592a969779d1a7724518914c36ca10413f823f72a80720b7e39c4b68cfb58799f4d
-
SSDEEP
12288:zCyEHAWAdljmJqkC3xMX85FSR2f9A08NIX+Vjwd4G/3z1ET4m3HdsubM:zFhWAfn22m0eD1GPz8HdxI
Malware Config
Signatures
-
Darkcomet family
-
Checks BIOS information in registry 2 TTPs 1 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate Soundcrd.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation 5ff3f1dc8602ffe1e546da895ee6d732844f4c63ae79eb36ad93ba829ecd06c5.exe -
Executes dropped EXE 3 IoCs
pid Process 4456 Soundcrd.exe 4492 Soundcrd.exe 3680 Soundcrd.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Mcrosoftt = "C:\\Users\\Admin\\AppData\\Roaming\\Soundcrd.exe" reg.exe -
Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 4456 set thread context of 4492 4456 Soundcrd.exe 87 PID 4456 set thread context of 3680 4456 Soundcrd.exe 88 -
resource yara_rule behavioral2/memory/4492-33-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral2/memory/4492-36-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral2/memory/4492-37-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral2/memory/4492-39-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral2/memory/3680-47-0x0000000000400000-0x0000000000409000-memory.dmp upx behavioral2/memory/4492-45-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral2/memory/4492-52-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral2/memory/4492-51-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral2/memory/4492-50-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral2/memory/4492-44-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral2/memory/3680-43-0x0000000000400000-0x0000000000409000-memory.dmp upx behavioral2/memory/3680-40-0x0000000000400000-0x0000000000409000-memory.dmp upx behavioral2/memory/4492-55-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral2/memory/3680-56-0x0000000000400000-0x0000000000409000-memory.dmp upx behavioral2/memory/4492-61-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral2/memory/4492-65-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral2/memory/4492-69-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral2/memory/4492-73-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral2/memory/4492-77-0x0000000000400000-0x00000000004B5000-memory.dmp upx -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 6 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5ff3f1dc8602ffe1e546da895ee6d732844f4c63ae79eb36ad93ba829ecd06c5.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Soundcrd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Soundcrd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Soundcrd.exe -
Checks processor information in registry 2 TTPs 4 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 Soundcrd.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString Soundcrd.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier Soundcrd.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier Soundcrd.exe -
Enumerates system info in registry 2 TTPs 1 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier Soundcrd.exe -
Suspicious use of AdjustPrivilegeToken 25 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 4492 Soundcrd.exe Token: SeSecurityPrivilege 4492 Soundcrd.exe Token: SeTakeOwnershipPrivilege 4492 Soundcrd.exe Token: SeLoadDriverPrivilege 4492 Soundcrd.exe Token: SeSystemProfilePrivilege 4492 Soundcrd.exe Token: SeSystemtimePrivilege 4492 Soundcrd.exe Token: SeProfSingleProcessPrivilege 4492 Soundcrd.exe Token: SeIncBasePriorityPrivilege 4492 Soundcrd.exe Token: SeCreatePagefilePrivilege 4492 Soundcrd.exe Token: SeBackupPrivilege 4492 Soundcrd.exe Token: SeRestorePrivilege 4492 Soundcrd.exe Token: SeShutdownPrivilege 4492 Soundcrd.exe Token: SeDebugPrivilege 4492 Soundcrd.exe Token: SeSystemEnvironmentPrivilege 4492 Soundcrd.exe Token: SeChangeNotifyPrivilege 4492 Soundcrd.exe Token: SeRemoteShutdownPrivilege 4492 Soundcrd.exe Token: SeUndockPrivilege 4492 Soundcrd.exe Token: SeManageVolumePrivilege 4492 Soundcrd.exe Token: SeImpersonatePrivilege 4492 Soundcrd.exe Token: SeCreateGlobalPrivilege 4492 Soundcrd.exe Token: 33 4492 Soundcrd.exe Token: 34 4492 Soundcrd.exe Token: 35 4492 Soundcrd.exe Token: 36 4492 Soundcrd.exe Token: SeDebugPrivilege 3680 Soundcrd.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 2032 5ff3f1dc8602ffe1e546da895ee6d732844f4c63ae79eb36ad93ba829ecd06c5.exe 4456 Soundcrd.exe 3680 Soundcrd.exe -
Suspicious use of WriteProcessMemory 25 IoCs
description pid Process procid_target PID 2032 wrote to memory of 4392 2032 5ff3f1dc8602ffe1e546da895ee6d732844f4c63ae79eb36ad93ba829ecd06c5.exe 82 PID 2032 wrote to memory of 4392 2032 5ff3f1dc8602ffe1e546da895ee6d732844f4c63ae79eb36ad93ba829ecd06c5.exe 82 PID 2032 wrote to memory of 4392 2032 5ff3f1dc8602ffe1e546da895ee6d732844f4c63ae79eb36ad93ba829ecd06c5.exe 82 PID 4392 wrote to memory of 2940 4392 cmd.exe 85 PID 4392 wrote to memory of 2940 4392 cmd.exe 85 PID 4392 wrote to memory of 2940 4392 cmd.exe 85 PID 2032 wrote to memory of 4456 2032 5ff3f1dc8602ffe1e546da895ee6d732844f4c63ae79eb36ad93ba829ecd06c5.exe 86 PID 2032 wrote to memory of 4456 2032 5ff3f1dc8602ffe1e546da895ee6d732844f4c63ae79eb36ad93ba829ecd06c5.exe 86 PID 2032 wrote to memory of 4456 2032 5ff3f1dc8602ffe1e546da895ee6d732844f4c63ae79eb36ad93ba829ecd06c5.exe 86 PID 4456 wrote to memory of 4492 4456 Soundcrd.exe 87 PID 4456 wrote to memory of 4492 4456 Soundcrd.exe 87 PID 4456 wrote to memory of 4492 4456 Soundcrd.exe 87 PID 4456 wrote to memory of 4492 4456 Soundcrd.exe 87 PID 4456 wrote to memory of 4492 4456 Soundcrd.exe 87 PID 4456 wrote to memory of 4492 4456 Soundcrd.exe 87 PID 4456 wrote to memory of 4492 4456 Soundcrd.exe 87 PID 4456 wrote to memory of 4492 4456 Soundcrd.exe 87 PID 4456 wrote to memory of 3680 4456 Soundcrd.exe 88 PID 4456 wrote to memory of 3680 4456 Soundcrd.exe 88 PID 4456 wrote to memory of 3680 4456 Soundcrd.exe 88 PID 4456 wrote to memory of 3680 4456 Soundcrd.exe 88 PID 4456 wrote to memory of 3680 4456 Soundcrd.exe 88 PID 4456 wrote to memory of 3680 4456 Soundcrd.exe 88 PID 4456 wrote to memory of 3680 4456 Soundcrd.exe 88 PID 4456 wrote to memory of 3680 4456 Soundcrd.exe 88
Processes
-
C:\Users\Admin\AppData\Local\Temp\5ff3f1dc8602ffe1e546da895ee6d732844f4c63ae79eb36ad93ba829ecd06c5.exe"C:\Users\Admin\AppData\Local\Temp\5ff3f1dc8602ffe1e546da895ee6d732844f4c63ae79eb36ad93ba829ecd06c5.exe"1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2032 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\VuyJE.bat" "2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4392 -
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "Mcrosoftt" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Soundcrd.exe" /f3⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
PID:2940
-
-
-
C:\Users\Admin\AppData\Roaming\Soundcrd.exe"C:\Users\Admin\AppData\Roaming\Soundcrd.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4456 -
C:\Users\Admin\AppData\Roaming\Soundcrd.exeC:\Users\Admin\AppData\Roaming\Soundcrd.exe3⤵
- Checks BIOS information in registry
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious use of AdjustPrivilegeToken
PID:4492
-
-
C:\Users\Admin\AppData\Roaming\Soundcrd.exeC:\Users\Admin\AppData\Roaming\Soundcrd.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:3680
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
139B
MD5173bcce4810d4901872d0ef4f0bfea4e
SHA1561b03fdfe68b6419fddf57f32e1aab9a6126a2f
SHA25610ea37eceabbe80fe9814280b66b957636951dbeeed18a9b4d50a1d24a6f1d1d
SHA5122401e0a5e3f7bf590a0767449da2249d09717e8c1cb71a7475e81d9615580001cfc38705cd1a5b4edc33f7df043bf195e28e4a5442a32bc879dffc6473bd545e
-
Filesize
574KB
MD564eea8a3c17063a23819e0f80cb50f97
SHA13f95f346086cdab9001ec5cd6e56b7376eb1e67d
SHA256ce438b777190b6b5f0138799e917a8bdd18367a135973bcde90e82c67f744292
SHA512c53d5c566fa920272d6cc28e2e65de05558b54242c5decc0baf43b4bf9a54c66388ab06b83e7b32a42eabe6284609111babc9ef3814f2fd0d076959c3ffab054