Overview
overview
10Static
static
10Wolfteam/Hack.exe
windows7-x64
10Wolfteam/Hack.exe
windows10-2004-x64
10Wolfteam/S...RT.dll
windows7-x64
3Wolfteam/S...RT.dll
windows10-2004-x64
3Wolfteam/a..._0.dll
windows10-2004-x64
3Wolfteam/a..._0.dll
windows10-2004-x64
3Wolfteam/a..._0.dll
windows10-2004-x64
3Wolfteam/a..._0.dll
windows10-2004-x64
3Wolfteam/python27.dll
windows7-x64
3Wolfteam/python27.dll
windows10-2004-x64
3Analysis
-
max time kernel
147s -
max time network
145s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
22-12-2024 12:42
Behavioral task
behavioral1
Sample
Wolfteam/Hack.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral2
Sample
Wolfteam/Hack.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral3
Sample
Wolfteam/SpeedTreeRT.dll
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral4
Sample
Wolfteam/SpeedTreeRT.dll
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral5
Sample
Wolfteam/api_ms_win_core_interlocked_l1_1_0.dll
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral6
Sample
Wolfteam/api_ms_win_core_synch_l1_1_0.dll
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral7
Sample
Wolfteam/api_ms_win_core_timezone_l1_1_0.dll
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral8
Sample
Wolfteam/api_ms_win_crt_locale_l1_1_0.dll
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral9
Sample
Wolfteam/python27.dll
Resource
win7-20241023-en
windows7-x64
Behavioral task
behavioral10
Sample
Wolfteam/python27.dll
Resource
win10v2004-20241007-en
windows10-2004-x64
General
-
Target
Wolfteam/Hack.exe
-
Size
847KB
-
MD5
1d5349887bf319b3883a8e84797f2f0f
-
SHA1
3dd4311bdaee5164f1d4e4b3183fea9262a0a721
-
SHA256
a2aacc0b545223c09ebf8540450cd436d1fe4274b10660c4cb90b2dd35727a39
-
SHA512
e9faf7ad9998c6d0c9831eca28ad4822140d0b55dcb28974101a2b8e8a1fb0ef3a9f9aacc1f797440316a10dd3b03c6a13b4276b113d55689ce66825bc470680
-
SSDEEP
24576:JZ1xuVVjfFoynPaVBUR8f+kN10EB6LtxBezjJ348:zQDgok30PLtxcVd
Malware Config
Extracted
darkcomet
Guest16
olmayanoc.duckdns.org:1604
DC_MUTEX-CWXJ2HG
-
InstallPath
MSDCSC\msdcsc.exe
-
gencode
uEE4dQifbptz
-
install
true
-
offline_keylogger
true
-
persistence
true
-
reg_key
MicroUpdate
Signatures
-
Darkcomet family
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Users\\Admin\\Documents\\MSDCSC\\msdcsc.exe" Hack.exe -
Executes dropped EXE 1 IoCs
pid Process 2380 msdcsc.exe -
Loads dropped DLL 2 IoCs
pid Process 2116 Hack.exe 2116 Hack.exe -
Adds Run key to start application 2 TTPs 3 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Users\\Admin\\Documents\\MSDCSC\\msdcsc.exe" Hack.exe Set value (str) \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Users\\Admin\\Documents\\MSDCSC\\msdcsc.exe" msdcsc.exe Set value (str) \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Users\\Admin\\Documents\\MSDCSC\\msdcsc.exe" iexplore.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2380 set thread context of 2500 2380 msdcsc.exe 31 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Hack.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language msdcsc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language iexplore.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 2116 Hack.exe Token: SeSecurityPrivilege 2116 Hack.exe Token: SeTakeOwnershipPrivilege 2116 Hack.exe Token: SeLoadDriverPrivilege 2116 Hack.exe Token: SeSystemProfilePrivilege 2116 Hack.exe Token: SeSystemtimePrivilege 2116 Hack.exe Token: SeProfSingleProcessPrivilege 2116 Hack.exe Token: SeIncBasePriorityPrivilege 2116 Hack.exe Token: SeCreatePagefilePrivilege 2116 Hack.exe Token: SeBackupPrivilege 2116 Hack.exe Token: SeRestorePrivilege 2116 Hack.exe Token: SeShutdownPrivilege 2116 Hack.exe Token: SeDebugPrivilege 2116 Hack.exe Token: SeSystemEnvironmentPrivilege 2116 Hack.exe Token: SeChangeNotifyPrivilege 2116 Hack.exe Token: SeRemoteShutdownPrivilege 2116 Hack.exe Token: SeUndockPrivilege 2116 Hack.exe Token: SeManageVolumePrivilege 2116 Hack.exe Token: SeImpersonatePrivilege 2116 Hack.exe Token: SeCreateGlobalPrivilege 2116 Hack.exe Token: 33 2116 Hack.exe Token: 34 2116 Hack.exe Token: 35 2116 Hack.exe Token: SeIncreaseQuotaPrivilege 2380 msdcsc.exe Token: SeSecurityPrivilege 2380 msdcsc.exe Token: SeTakeOwnershipPrivilege 2380 msdcsc.exe Token: SeLoadDriverPrivilege 2380 msdcsc.exe Token: SeSystemProfilePrivilege 2380 msdcsc.exe Token: SeSystemtimePrivilege 2380 msdcsc.exe Token: SeProfSingleProcessPrivilege 2380 msdcsc.exe Token: SeIncBasePriorityPrivilege 2380 msdcsc.exe Token: SeCreatePagefilePrivilege 2380 msdcsc.exe Token: SeBackupPrivilege 2380 msdcsc.exe Token: SeRestorePrivilege 2380 msdcsc.exe Token: SeShutdownPrivilege 2380 msdcsc.exe Token: SeDebugPrivilege 2380 msdcsc.exe Token: SeSystemEnvironmentPrivilege 2380 msdcsc.exe Token: SeChangeNotifyPrivilege 2380 msdcsc.exe Token: SeRemoteShutdownPrivilege 2380 msdcsc.exe Token: SeUndockPrivilege 2380 msdcsc.exe Token: SeManageVolumePrivilege 2380 msdcsc.exe Token: SeImpersonatePrivilege 2380 msdcsc.exe Token: SeCreateGlobalPrivilege 2380 msdcsc.exe Token: 33 2380 msdcsc.exe Token: 34 2380 msdcsc.exe Token: 35 2380 msdcsc.exe Token: SeIncreaseQuotaPrivilege 2500 iexplore.exe Token: SeSecurityPrivilege 2500 iexplore.exe Token: SeTakeOwnershipPrivilege 2500 iexplore.exe Token: SeLoadDriverPrivilege 2500 iexplore.exe Token: SeSystemProfilePrivilege 2500 iexplore.exe Token: SeSystemtimePrivilege 2500 iexplore.exe Token: SeProfSingleProcessPrivilege 2500 iexplore.exe Token: SeIncBasePriorityPrivilege 2500 iexplore.exe Token: SeCreatePagefilePrivilege 2500 iexplore.exe Token: SeBackupPrivilege 2500 iexplore.exe Token: SeRestorePrivilege 2500 iexplore.exe Token: SeShutdownPrivilege 2500 iexplore.exe Token: SeDebugPrivilege 2500 iexplore.exe Token: SeSystemEnvironmentPrivilege 2500 iexplore.exe Token: SeChangeNotifyPrivilege 2500 iexplore.exe Token: SeRemoteShutdownPrivilege 2500 iexplore.exe Token: SeUndockPrivilege 2500 iexplore.exe Token: SeManageVolumePrivilege 2500 iexplore.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2500 iexplore.exe -
Suspicious use of WriteProcessMemory 10 IoCs
description pid Process procid_target PID 2116 wrote to memory of 2380 2116 Hack.exe 30 PID 2116 wrote to memory of 2380 2116 Hack.exe 30 PID 2116 wrote to memory of 2380 2116 Hack.exe 30 PID 2116 wrote to memory of 2380 2116 Hack.exe 30 PID 2380 wrote to memory of 2500 2380 msdcsc.exe 31 PID 2380 wrote to memory of 2500 2380 msdcsc.exe 31 PID 2380 wrote to memory of 2500 2380 msdcsc.exe 31 PID 2380 wrote to memory of 2500 2380 msdcsc.exe 31 PID 2380 wrote to memory of 2500 2380 msdcsc.exe 31 PID 2380 wrote to memory of 2500 2380 msdcsc.exe 31
Processes
-
C:\Users\Admin\AppData\Local\Temp\Wolfteam\Hack.exe"C:\Users\Admin\AppData\Local\Temp\Wolfteam\Hack.exe"1⤵
- Modifies WinLogon for persistence
- Loads dropped DLL
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2116 -
C:\Users\Admin\Documents\MSDCSC\msdcsc.exe"C:\Users\Admin\Documents\MSDCSC\msdcsc.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2380 -
C:\Program Files (x86)\Internet Explorer\iexplore.exe"C:\Program Files (x86)\Internet Explorer\iexplore.exe"3⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2500
-
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
847KB
MD51d5349887bf319b3883a8e84797f2f0f
SHA13dd4311bdaee5164f1d4e4b3183fea9262a0a721
SHA256a2aacc0b545223c09ebf8540450cd436d1fe4274b10660c4cb90b2dd35727a39
SHA512e9faf7ad9998c6d0c9831eca28ad4822140d0b55dcb28974101a2b8e8a1fb0ef3a9f9aacc1f797440316a10dd3b03c6a13b4276b113d55689ce66825bc470680