Analysis
-
max time kernel
141s -
max time network
140s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
23-12-2024 03:56
Behavioral task
behavioral1
Sample
dfad23d9613e557229aa078f25cabfa4bd6c2cdcb5194c13ae63689448f80356.exe
Resource
win7-20240903-en
General
-
Target
dfad23d9613e557229aa078f25cabfa4bd6c2cdcb5194c13ae63689448f80356.exe
-
Size
559KB
-
MD5
fa390993690c321f7b6d91b55888695a
-
SHA1
0eb8074db8a0d0fa794bb1e33d1d4a56695948f1
-
SHA256
dfad23d9613e557229aa078f25cabfa4bd6c2cdcb5194c13ae63689448f80356
-
SHA512
42967942e180d14eef1baa346cc6c6fea370831efefa51c4b2cadfafc232ffc20d15fbb1ce4f95f2350609a15f89fa1942754465ce97e57c212cecdd467974f7
-
SSDEEP
12288:x+xOrozCCYaCphtIYJb6lzOqPpFOblme0pLLsbii9cWDeO7HtoNmKzoSE:COEzCFaCpAYJbwzOqPUlvOsmi9c8Sl2
Malware Config
Signatures
-
Darkcomet family
-
Checks BIOS information in registry 2 TTPs 1 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate mcsft.exe -
Executes dropped EXE 2 IoCs
pid Process 2740 mcsft.exe 2584 mcsft.exe -
Loads dropped DLL 6 IoCs
pid Process 2320 dfad23d9613e557229aa078f25cabfa4bd6c2cdcb5194c13ae63689448f80356.exe 2320 dfad23d9613e557229aa078f25cabfa4bd6c2cdcb5194c13ae63689448f80356.exe 2320 dfad23d9613e557229aa078f25cabfa4bd6c2cdcb5194c13ae63689448f80356.exe 2320 dfad23d9613e557229aa078f25cabfa4bd6c2cdcb5194c13ae63689448f80356.exe 2320 dfad23d9613e557229aa078f25cabfa4bd6c2cdcb5194c13ae63689448f80356.exe 2740 mcsft.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Windows\CurrentVersion\Run\Mcrosoft = "C:\\Users\\Admin\\AppData\\Roaming\\mcsft.exe" reg.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2740 set thread context of 2584 2740 mcsft.exe 35 -
resource yara_rule behavioral1/memory/2320-0-0x0000000000400000-0x00000000007C8000-memory.dmp upx behavioral1/files/0x0009000000016276-27.dat upx behavioral1/memory/2740-47-0x0000000000400000-0x00000000007C8000-memory.dmp upx behavioral1/memory/2320-49-0x0000000000400000-0x00000000007C8000-memory.dmp upx behavioral1/memory/2584-54-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral1/memory/2584-56-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral1/memory/2740-57-0x0000000000400000-0x00000000007C8000-memory.dmp upx behavioral1/memory/2584-58-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral1/memory/2584-59-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral1/memory/2584-60-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral1/memory/2584-61-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral1/memory/2584-64-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral1/memory/2584-63-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral1/memory/2584-62-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral1/memory/2584-65-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral1/memory/2584-68-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral1/memory/2584-70-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral1/memory/2584-72-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral1/memory/2584-74-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral1/memory/2584-76-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral1/memory/2584-78-0x0000000000400000-0x00000000004B5000-memory.dmp upx -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language mcsft.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language mcsft.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dfad23d9613e557229aa078f25cabfa4bd6c2cdcb5194c13ae63689448f80356.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe -
Checks processor information in registry 2 TTPs 4 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 mcsft.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString mcsft.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier mcsft.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier mcsft.exe -
Enumerates system info in registry 2 TTPs 1 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier mcsft.exe -
Suspicious use of AdjustPrivilegeToken 23 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 2584 mcsft.exe Token: SeSecurityPrivilege 2584 mcsft.exe Token: SeTakeOwnershipPrivilege 2584 mcsft.exe Token: SeLoadDriverPrivilege 2584 mcsft.exe Token: SeSystemProfilePrivilege 2584 mcsft.exe Token: SeSystemtimePrivilege 2584 mcsft.exe Token: SeProfSingleProcessPrivilege 2584 mcsft.exe Token: SeIncBasePriorityPrivilege 2584 mcsft.exe Token: SeCreatePagefilePrivilege 2584 mcsft.exe Token: SeBackupPrivilege 2584 mcsft.exe Token: SeRestorePrivilege 2584 mcsft.exe Token: SeShutdownPrivilege 2584 mcsft.exe Token: SeDebugPrivilege 2584 mcsft.exe Token: SeSystemEnvironmentPrivilege 2584 mcsft.exe Token: SeChangeNotifyPrivilege 2584 mcsft.exe Token: SeRemoteShutdownPrivilege 2584 mcsft.exe Token: SeUndockPrivilege 2584 mcsft.exe Token: SeManageVolumePrivilege 2584 mcsft.exe Token: SeImpersonatePrivilege 2584 mcsft.exe Token: SeCreateGlobalPrivilege 2584 mcsft.exe Token: 33 2584 mcsft.exe Token: 34 2584 mcsft.exe Token: 35 2584 mcsft.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 2320 dfad23d9613e557229aa078f25cabfa4bd6c2cdcb5194c13ae63689448f80356.exe 2740 mcsft.exe 2584 mcsft.exe -
Suspicious use of WriteProcessMemory 21 IoCs
description pid Process procid_target PID 2320 wrote to memory of 1904 2320 dfad23d9613e557229aa078f25cabfa4bd6c2cdcb5194c13ae63689448f80356.exe 31 PID 2320 wrote to memory of 1904 2320 dfad23d9613e557229aa078f25cabfa4bd6c2cdcb5194c13ae63689448f80356.exe 31 PID 2320 wrote to memory of 1904 2320 dfad23d9613e557229aa078f25cabfa4bd6c2cdcb5194c13ae63689448f80356.exe 31 PID 2320 wrote to memory of 1904 2320 dfad23d9613e557229aa078f25cabfa4bd6c2cdcb5194c13ae63689448f80356.exe 31 PID 1904 wrote to memory of 2660 1904 cmd.exe 33 PID 1904 wrote to memory of 2660 1904 cmd.exe 33 PID 1904 wrote to memory of 2660 1904 cmd.exe 33 PID 1904 wrote to memory of 2660 1904 cmd.exe 33 PID 2320 wrote to memory of 2740 2320 dfad23d9613e557229aa078f25cabfa4bd6c2cdcb5194c13ae63689448f80356.exe 34 PID 2320 wrote to memory of 2740 2320 dfad23d9613e557229aa078f25cabfa4bd6c2cdcb5194c13ae63689448f80356.exe 34 PID 2320 wrote to memory of 2740 2320 dfad23d9613e557229aa078f25cabfa4bd6c2cdcb5194c13ae63689448f80356.exe 34 PID 2320 wrote to memory of 2740 2320 dfad23d9613e557229aa078f25cabfa4bd6c2cdcb5194c13ae63689448f80356.exe 34 PID 2740 wrote to memory of 2584 2740 mcsft.exe 35 PID 2740 wrote to memory of 2584 2740 mcsft.exe 35 PID 2740 wrote to memory of 2584 2740 mcsft.exe 35 PID 2740 wrote to memory of 2584 2740 mcsft.exe 35 PID 2740 wrote to memory of 2584 2740 mcsft.exe 35 PID 2740 wrote to memory of 2584 2740 mcsft.exe 35 PID 2740 wrote to memory of 2584 2740 mcsft.exe 35 PID 2740 wrote to memory of 2584 2740 mcsft.exe 35 PID 2740 wrote to memory of 2584 2740 mcsft.exe 35
Processes
-
C:\Users\Admin\AppData\Local\Temp\dfad23d9613e557229aa078f25cabfa4bd6c2cdcb5194c13ae63689448f80356.exe"C:\Users\Admin\AppData\Local\Temp\dfad23d9613e557229aa078f25cabfa4bd6c2cdcb5194c13ae63689448f80356.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2320 -
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\aETpO.bat" "2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1904 -
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "Mcrosoft" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\mcsft.exe" /f3⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
PID:2660
-
-
-
C:\Users\Admin\AppData\Roaming\mcsft.exe"C:\Users\Admin\AppData\Roaming\mcsft.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2740 -
C:\Users\Admin\AppData\Roaming\mcsft.exeC:\Users\Admin\AppData\Roaming\mcsft.exe3⤵
- Checks BIOS information in registry
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2584
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
135B
MD5a5feca573884d76f559b996d45e8ad9a
SHA10e81a993f3af4e31d60653dc2513186f0495f1c8
SHA256c98e20d46d6465febb5d29cfab51241521ea5d6cd621f5e18b9b7d6fbfac3f0f
SHA512a9239648b5f15eac4d4151b6e1bdc81065eeaeb101404c2a0126f03bc87f1e6a57206bfa07a44379e9d3bba889e4497a9991ff41fb109099b01512df3dc3cbda
-
Filesize
559KB
MD55eb938de6f0b990cd719a2e3b55707dd
SHA123e23e61aacb4dcb318d5bf10939bc33eeb94fdf
SHA2563bb907bfdc83e6e2a55108f6c8896553b60dc560fa62f1f6b49b80d582a88785
SHA512761fa5a92f6b159bb93ad5f46ed4588a6434bd78290ed079fa7a6fff8472bde440903d72a83dd087cc0c49081881f65e7aff7fd9916f084fcc9b6dad01f474b0