Analysis
-
max time kernel
119s -
max time network
118s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
18-12-2024 09:49
Behavioral task
behavioral1
Sample
bfc2324ddd5fd33c825bae046d89fe4f3ef80c929cfca0ae093d451eca61e90aN.exe
Resource
win7-20241010-en
General
-
Target
bfc2324ddd5fd33c825bae046d89fe4f3ef80c929cfca0ae093d451eca61e90aN.exe
-
Size
576KB
-
MD5
c10a0c7f2d4093984324341c8947dfd0
-
SHA1
edf40e1940938e46eeec1df5f9866c10b9ac39a2
-
SHA256
bfc2324ddd5fd33c825bae046d89fe4f3ef80c929cfca0ae093d451eca61e90a
-
SHA512
1c74b4ad5b84b55a258dde7b4e661a3e685d1a11456a8bee1320fe28500d69cf0521085e3013bc0da40f33ca135541af331f01edf09ea1bae89fdb7f1b1937a2
-
SSDEEP
12288:+NWPkHlUkErBuxQ4uzi6d6dL/yiXLzeMdK6io8levy0FhVlpzkzDDoSO:+NWPkHlUfBgpuPdWzyuDTifgyWlv
Malware Config
Signatures
-
Darkcomet family
-
Checks BIOS information in registry 2 TTPs 1 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate mcsft.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation bfc2324ddd5fd33c825bae046d89fe4f3ef80c929cfca0ae093d451eca61e90aN.exe -
Executes dropped EXE 2 IoCs
pid Process 3852 mcsft.exe 1888 mcsft.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Mcrosoft = "C:\\Users\\Admin\\AppData\\Roaming\\mcsft.exe" reg.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 3852 set thread context of 1888 3852 mcsft.exe 88 -
resource yara_rule behavioral2/memory/532-0-0x0000000000400000-0x00000000007C8000-memory.dmp upx behavioral2/files/0x0008000000023c91-16.dat upx behavioral2/memory/3852-28-0x0000000000400000-0x00000000007C8000-memory.dmp upx behavioral2/memory/532-30-0x0000000000400000-0x00000000007C8000-memory.dmp upx behavioral2/memory/1888-33-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral2/memory/1888-36-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral2/memory/1888-40-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral2/memory/3852-39-0x0000000000400000-0x00000000007C8000-memory.dmp upx behavioral2/memory/1888-38-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral2/memory/1888-41-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral2/memory/1888-43-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral2/memory/1888-46-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral2/memory/1888-45-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral2/memory/1888-44-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral2/memory/1888-42-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral2/memory/1888-47-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral2/memory/1888-48-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral2/memory/1888-49-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral2/memory/1888-50-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral2/memory/1888-51-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral2/memory/1888-52-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral2/memory/1888-53-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral2/memory/1888-54-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral2/memory/1888-55-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral2/memory/1888-56-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral2/memory/1888-57-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral2/memory/1888-58-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral2/memory/1888-59-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral2/memory/1888-60-0x0000000000400000-0x00000000004B5000-memory.dmp upx -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bfc2324ddd5fd33c825bae046d89fe4f3ef80c929cfca0ae093d451eca61e90aN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language mcsft.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language mcsft.exe -
Checks processor information in registry 2 TTPs 4 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 mcsft.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString mcsft.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier mcsft.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier mcsft.exe -
Enumerates system info in registry 2 TTPs 1 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier mcsft.exe -
Suspicious use of AdjustPrivilegeToken 24 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 1888 mcsft.exe Token: SeSecurityPrivilege 1888 mcsft.exe Token: SeTakeOwnershipPrivilege 1888 mcsft.exe Token: SeLoadDriverPrivilege 1888 mcsft.exe Token: SeSystemProfilePrivilege 1888 mcsft.exe Token: SeSystemtimePrivilege 1888 mcsft.exe Token: SeProfSingleProcessPrivilege 1888 mcsft.exe Token: SeIncBasePriorityPrivilege 1888 mcsft.exe Token: SeCreatePagefilePrivilege 1888 mcsft.exe Token: SeBackupPrivilege 1888 mcsft.exe Token: SeRestorePrivilege 1888 mcsft.exe Token: SeShutdownPrivilege 1888 mcsft.exe Token: SeDebugPrivilege 1888 mcsft.exe Token: SeSystemEnvironmentPrivilege 1888 mcsft.exe Token: SeChangeNotifyPrivilege 1888 mcsft.exe Token: SeRemoteShutdownPrivilege 1888 mcsft.exe Token: SeUndockPrivilege 1888 mcsft.exe Token: SeManageVolumePrivilege 1888 mcsft.exe Token: SeImpersonatePrivilege 1888 mcsft.exe Token: SeCreateGlobalPrivilege 1888 mcsft.exe Token: 33 1888 mcsft.exe Token: 34 1888 mcsft.exe Token: 35 1888 mcsft.exe Token: 36 1888 mcsft.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 532 bfc2324ddd5fd33c825bae046d89fe4f3ef80c929cfca0ae093d451eca61e90aN.exe 3852 mcsft.exe 1888 mcsft.exe -
Suspicious use of WriteProcessMemory 17 IoCs
description pid Process procid_target PID 532 wrote to memory of 3724 532 bfc2324ddd5fd33c825bae046d89fe4f3ef80c929cfca0ae093d451eca61e90aN.exe 83 PID 532 wrote to memory of 3724 532 bfc2324ddd5fd33c825bae046d89fe4f3ef80c929cfca0ae093d451eca61e90aN.exe 83 PID 532 wrote to memory of 3724 532 bfc2324ddd5fd33c825bae046d89fe4f3ef80c929cfca0ae093d451eca61e90aN.exe 83 PID 3724 wrote to memory of 772 3724 cmd.exe 86 PID 3724 wrote to memory of 772 3724 cmd.exe 86 PID 3724 wrote to memory of 772 3724 cmd.exe 86 PID 532 wrote to memory of 3852 532 bfc2324ddd5fd33c825bae046d89fe4f3ef80c929cfca0ae093d451eca61e90aN.exe 87 PID 532 wrote to memory of 3852 532 bfc2324ddd5fd33c825bae046d89fe4f3ef80c929cfca0ae093d451eca61e90aN.exe 87 PID 532 wrote to memory of 3852 532 bfc2324ddd5fd33c825bae046d89fe4f3ef80c929cfca0ae093d451eca61e90aN.exe 87 PID 3852 wrote to memory of 1888 3852 mcsft.exe 88 PID 3852 wrote to memory of 1888 3852 mcsft.exe 88 PID 3852 wrote to memory of 1888 3852 mcsft.exe 88 PID 3852 wrote to memory of 1888 3852 mcsft.exe 88 PID 3852 wrote to memory of 1888 3852 mcsft.exe 88 PID 3852 wrote to memory of 1888 3852 mcsft.exe 88 PID 3852 wrote to memory of 1888 3852 mcsft.exe 88 PID 3852 wrote to memory of 1888 3852 mcsft.exe 88
Processes
-
C:\Users\Admin\AppData\Local\Temp\bfc2324ddd5fd33c825bae046d89fe4f3ef80c929cfca0ae093d451eca61e90aN.exe"C:\Users\Admin\AppData\Local\Temp\bfc2324ddd5fd33c825bae046d89fe4f3ef80c929cfca0ae093d451eca61e90aN.exe"1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:532 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\hgpoN.bat" "2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3724 -
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "Mcrosoft" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\mcsft.exe" /f3⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
PID:772
-
-
-
C:\Users\Admin\AppData\Roaming\mcsft.exe"C:\Users\Admin\AppData\Roaming\mcsft.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3852 -
C:\Users\Admin\AppData\Roaming\mcsft.exeC:\Users\Admin\AppData\Roaming\mcsft.exe3⤵
- Checks BIOS information in registry
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1888
-
-
Network
-
Remote address:8.8.8.8:53Request58.55.71.13.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Requestletsgoboom.no-ip.infoIN AResponse
-
Remote address:8.8.8.8:53Request136.32.126.40.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request95.221.229.192.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Requestletsgoboom.no-ip.infoIN AResponse
-
Remote address:8.8.8.8:53Requestletsgoboom.no-ip.infoIN AResponse
-
Remote address:8.8.8.8:53Request104.219.191.52.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request13.86.106.20.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Requestletsgoboom.no-ip.infoIN AResponse
-
Remote address:8.8.8.8:53Requestletsgoboom.no-ip.infoIN AResponse
-
Remote address:8.8.8.8:53Requestletsgoboom.no-ip.infoIN AResponse
-
Remote address:8.8.8.8:53Request212.20.149.52.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Requestletsgoboom.no-ip.infoIN AResponse
-
Remote address:8.8.8.8:53Request198.187.3.20.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request92.12.20.2.in-addr.arpaIN PTRResponse92.12.20.2.in-addr.arpaIN PTRa2-20-12-92deploystaticakamaitechnologiescom
-
Remote address:8.8.8.8:53Requestletsgoboom.no-ip.infoIN AResponse
-
Remote address:8.8.8.8:53Requestletsgoboom.no-ip.infoIN AResponse
-
Remote address:8.8.8.8:53Requestletsgoboom.no-ip.infoIN AResponse
-
Remote address:8.8.8.8:53Requestletsgoboom.no-ip.infoIN AResponse
-
Remote address:8.8.8.8:53Requestletsgoboom.no-ip.infoIN AResponse
-
Remote address:8.8.8.8:53Requestletsgoboom.no-ip.infoIN AResponse
-
Remote address:8.8.8.8:53Requestletsgoboom.no-ip.infoIN AResponse
-
Remote address:8.8.8.8:53Requestletsgoboom.no-ip.infoIN AResponse
-
Remote address:8.8.8.8:53Requestletsgoboom.no-ip.infoIN AResponse
-
Remote address:8.8.8.8:53Requestletsgoboom.no-ip.infoIN AResponse
-
Remote address:8.8.8.8:53Requestletsgoboom.no-ip.infoIN AResponse
-
Remote address:8.8.8.8:53Requestletsgoboom.no-ip.infoIN AResponse
-
Remote address:8.8.8.8:53Request19.229.111.52.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Requestletsgoboom.no-ip.infoIN AResponse
-
Remote address:8.8.8.8:53Requestletsgoboom.no-ip.infoIN AResponse
-
Remote address:8.8.8.8:53Requestletsgoboom.no-ip.infoIN AResponse
-
Remote address:8.8.8.8:53Requestletsgoboom.no-ip.infoIN AResponse
-
Remote address:8.8.8.8:53Requestletsgoboom.no-ip.infoIN AResponse
-
70 B 144 B 1 1
DNS Request
58.55.71.13.in-addr.arpa
-
67 B 127 B 1 1
DNS Request
letsgoboom.no-ip.info
-
72 B 158 B 1 1
DNS Request
136.32.126.40.in-addr.arpa
-
73 B 144 B 1 1
DNS Request
95.221.229.192.in-addr.arpa
-
67 B 127 B 1 1
DNS Request
letsgoboom.no-ip.info
-
67 B 127 B 1 1
DNS Request
letsgoboom.no-ip.info
-
73 B 147 B 1 1
DNS Request
104.219.191.52.in-addr.arpa
-
71 B 157 B 1 1
DNS Request
13.86.106.20.in-addr.arpa
-
67 B 127 B 1 1
DNS Request
letsgoboom.no-ip.info
-
67 B 127 B 1 1
DNS Request
letsgoboom.no-ip.info
-
67 B 127 B 1 1
DNS Request
letsgoboom.no-ip.info
-
72 B 146 B 1 1
DNS Request
212.20.149.52.in-addr.arpa
-
67 B 127 B 1 1
DNS Request
letsgoboom.no-ip.info
-
71 B 157 B 1 1
DNS Request
198.187.3.20.in-addr.arpa
-
69 B 131 B 1 1
DNS Request
92.12.20.2.in-addr.arpa
-
67 B 127 B 1 1
DNS Request
letsgoboom.no-ip.info
-
67 B 127 B 1 1
DNS Request
letsgoboom.no-ip.info
-
67 B 127 B 1 1
DNS Request
letsgoboom.no-ip.info
-
67 B 127 B 1 1
DNS Request
letsgoboom.no-ip.info
-
67 B 127 B 1 1
DNS Request
letsgoboom.no-ip.info
-
67 B 127 B 1 1
DNS Request
letsgoboom.no-ip.info
-
67 B 127 B 1 1
DNS Request
letsgoboom.no-ip.info
-
67 B 127 B 1 1
DNS Request
letsgoboom.no-ip.info
-
67 B 127 B 1 1
DNS Request
letsgoboom.no-ip.info
-
67 B 127 B 1 1
DNS Request
letsgoboom.no-ip.info
-
67 B 127 B 1 1
DNS Request
letsgoboom.no-ip.info
-
67 B 127 B 1 1
DNS Request
letsgoboom.no-ip.info
-
72 B 158 B 1 1
DNS Request
19.229.111.52.in-addr.arpa
-
67 B 127 B 1 1
DNS Request
letsgoboom.no-ip.info
-
67 B 127 B 1 1
DNS Request
letsgoboom.no-ip.info
-
67 B 127 B 1 1
DNS Request
letsgoboom.no-ip.info
-
67 B 127 B 1 1
DNS Request
letsgoboom.no-ip.info
-
67 B 127 B 1 1
DNS Request
letsgoboom.no-ip.info
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
135B
MD5a5feca573884d76f559b996d45e8ad9a
SHA10e81a993f3af4e31d60653dc2513186f0495f1c8
SHA256c98e20d46d6465febb5d29cfab51241521ea5d6cd621f5e18b9b7d6fbfac3f0f
SHA512a9239648b5f15eac4d4151b6e1bdc81065eeaeb101404c2a0126f03bc87f1e6a57206bfa07a44379e9d3bba889e4497a9991ff41fb109099b01512df3dc3cbda
-
Filesize
576KB
MD5a714f25ef7bd2314492455fa9bebd993
SHA1066cf5a4986602301629bf0edc4c3af4df4b9a18
SHA256d1f7b49a19970f1079fa4de120612e4ed2b5bea16086a901ab5fce5203623611
SHA512a0978670faa2957971114f065b81c919816f60cc457da69aa33af442514f2715f9bdf961df438a2cea171c5c9d2d0d69e3546dc15251381b8bba2ae8f38fa269