Analysis
-
max time kernel
141s -
max time network
143s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
23-12-2024 04:10
Behavioral task
behavioral1
Sample
dfad23d9613e557229aa078f25cabfa4bd6c2cdcb5194c13ae63689448f80356.exe
Resource
win7-20240903-en
General
-
Target
dfad23d9613e557229aa078f25cabfa4bd6c2cdcb5194c13ae63689448f80356.exe
-
Size
559KB
-
MD5
fa390993690c321f7b6d91b55888695a
-
SHA1
0eb8074db8a0d0fa794bb1e33d1d4a56695948f1
-
SHA256
dfad23d9613e557229aa078f25cabfa4bd6c2cdcb5194c13ae63689448f80356
-
SHA512
42967942e180d14eef1baa346cc6c6fea370831efefa51c4b2cadfafc232ffc20d15fbb1ce4f95f2350609a15f89fa1942754465ce97e57c212cecdd467974f7
-
SSDEEP
12288:x+xOrozCCYaCphtIYJb6lzOqPpFOblme0pLLsbii9cWDeO7HtoNmKzoSE:COEzCFaCpAYJbwzOqPUlvOsmi9c8Sl2
Malware Config
Signatures
-
Darkcomet family
-
Checks BIOS information in registry 2 TTPs 1 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate mcsft.exe -
Executes dropped EXE 2 IoCs
pid Process 2920 mcsft.exe 2624 mcsft.exe -
Loads dropped DLL 6 IoCs
pid Process 2424 dfad23d9613e557229aa078f25cabfa4bd6c2cdcb5194c13ae63689448f80356.exe 2424 dfad23d9613e557229aa078f25cabfa4bd6c2cdcb5194c13ae63689448f80356.exe 2424 dfad23d9613e557229aa078f25cabfa4bd6c2cdcb5194c13ae63689448f80356.exe 2424 dfad23d9613e557229aa078f25cabfa4bd6c2cdcb5194c13ae63689448f80356.exe 2424 dfad23d9613e557229aa078f25cabfa4bd6c2cdcb5194c13ae63689448f80356.exe 2920 mcsft.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Windows\CurrentVersion\Run\Mcrosoft = "C:\\Users\\Admin\\AppData\\Roaming\\mcsft.exe" reg.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2920 set thread context of 2624 2920 mcsft.exe 34 -
resource yara_rule behavioral1/memory/2424-0-0x0000000000400000-0x00000000007C8000-memory.dmp upx behavioral1/files/0x000900000001660e-38.dat upx behavioral1/memory/2920-48-0x0000000000400000-0x00000000007C8000-memory.dmp upx behavioral1/memory/2424-46-0x0000000000400000-0x00000000007C8000-memory.dmp upx behavioral1/memory/2624-58-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral1/memory/2624-56-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral1/memory/2920-57-0x0000000000400000-0x00000000007C8000-memory.dmp upx behavioral1/memory/2624-53-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral1/memory/2624-59-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral1/memory/2624-60-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral1/memory/2624-61-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral1/memory/2624-62-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral1/memory/2624-65-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral1/memory/2624-64-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral1/memory/2624-63-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral1/memory/2424-66-0x0000000003A80000-0x0000000003E48000-memory.dmp upx behavioral1/memory/2624-67-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral1/memory/2624-70-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral1/memory/2624-72-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral1/memory/2624-74-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral1/memory/2624-76-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral1/memory/2624-79-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral1/memory/2624-81-0x0000000000400000-0x00000000004B5000-memory.dmp upx -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dfad23d9613e557229aa078f25cabfa4bd6c2cdcb5194c13ae63689448f80356.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language mcsft.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language mcsft.exe -
Checks processor information in registry 2 TTPs 4 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 mcsft.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString mcsft.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier mcsft.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier mcsft.exe -
Enumerates system info in registry 2 TTPs 1 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier mcsft.exe -
Suspicious use of AdjustPrivilegeToken 23 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 2624 mcsft.exe Token: SeSecurityPrivilege 2624 mcsft.exe Token: SeTakeOwnershipPrivilege 2624 mcsft.exe Token: SeLoadDriverPrivilege 2624 mcsft.exe Token: SeSystemProfilePrivilege 2624 mcsft.exe Token: SeSystemtimePrivilege 2624 mcsft.exe Token: SeProfSingleProcessPrivilege 2624 mcsft.exe Token: SeIncBasePriorityPrivilege 2624 mcsft.exe Token: SeCreatePagefilePrivilege 2624 mcsft.exe Token: SeBackupPrivilege 2624 mcsft.exe Token: SeRestorePrivilege 2624 mcsft.exe Token: SeShutdownPrivilege 2624 mcsft.exe Token: SeDebugPrivilege 2624 mcsft.exe Token: SeSystemEnvironmentPrivilege 2624 mcsft.exe Token: SeChangeNotifyPrivilege 2624 mcsft.exe Token: SeRemoteShutdownPrivilege 2624 mcsft.exe Token: SeUndockPrivilege 2624 mcsft.exe Token: SeManageVolumePrivilege 2624 mcsft.exe Token: SeImpersonatePrivilege 2624 mcsft.exe Token: SeCreateGlobalPrivilege 2624 mcsft.exe Token: 33 2624 mcsft.exe Token: 34 2624 mcsft.exe Token: 35 2624 mcsft.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 2424 dfad23d9613e557229aa078f25cabfa4bd6c2cdcb5194c13ae63689448f80356.exe 2920 mcsft.exe 2624 mcsft.exe -
Suspicious use of WriteProcessMemory 21 IoCs
description pid Process procid_target PID 2424 wrote to memory of 2660 2424 dfad23d9613e557229aa078f25cabfa4bd6c2cdcb5194c13ae63689448f80356.exe 30 PID 2424 wrote to memory of 2660 2424 dfad23d9613e557229aa078f25cabfa4bd6c2cdcb5194c13ae63689448f80356.exe 30 PID 2424 wrote to memory of 2660 2424 dfad23d9613e557229aa078f25cabfa4bd6c2cdcb5194c13ae63689448f80356.exe 30 PID 2424 wrote to memory of 2660 2424 dfad23d9613e557229aa078f25cabfa4bd6c2cdcb5194c13ae63689448f80356.exe 30 PID 2660 wrote to memory of 2792 2660 cmd.exe 32 PID 2660 wrote to memory of 2792 2660 cmd.exe 32 PID 2660 wrote to memory of 2792 2660 cmd.exe 32 PID 2660 wrote to memory of 2792 2660 cmd.exe 32 PID 2424 wrote to memory of 2920 2424 dfad23d9613e557229aa078f25cabfa4bd6c2cdcb5194c13ae63689448f80356.exe 33 PID 2424 wrote to memory of 2920 2424 dfad23d9613e557229aa078f25cabfa4bd6c2cdcb5194c13ae63689448f80356.exe 33 PID 2424 wrote to memory of 2920 2424 dfad23d9613e557229aa078f25cabfa4bd6c2cdcb5194c13ae63689448f80356.exe 33 PID 2424 wrote to memory of 2920 2424 dfad23d9613e557229aa078f25cabfa4bd6c2cdcb5194c13ae63689448f80356.exe 33 PID 2920 wrote to memory of 2624 2920 mcsft.exe 34 PID 2920 wrote to memory of 2624 2920 mcsft.exe 34 PID 2920 wrote to memory of 2624 2920 mcsft.exe 34 PID 2920 wrote to memory of 2624 2920 mcsft.exe 34 PID 2920 wrote to memory of 2624 2920 mcsft.exe 34 PID 2920 wrote to memory of 2624 2920 mcsft.exe 34 PID 2920 wrote to memory of 2624 2920 mcsft.exe 34 PID 2920 wrote to memory of 2624 2920 mcsft.exe 34 PID 2920 wrote to memory of 2624 2920 mcsft.exe 34
Processes
-
C:\Users\Admin\AppData\Local\Temp\dfad23d9613e557229aa078f25cabfa4bd6c2cdcb5194c13ae63689448f80356.exe"C:\Users\Admin\AppData\Local\Temp\dfad23d9613e557229aa078f25cabfa4bd6c2cdcb5194c13ae63689448f80356.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2424 -
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\gDToC.bat" "2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2660 -
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "Mcrosoft" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\mcsft.exe" /f3⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
PID:2792
-
-
-
C:\Users\Admin\AppData\Roaming\mcsft.exe"C:\Users\Admin\AppData\Roaming\mcsft.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2920 -
C:\Users\Admin\AppData\Roaming\mcsft.exeC:\Users\Admin\AppData\Roaming\mcsft.exe3⤵
- Checks BIOS information in registry
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2624
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
135B
MD5a5feca573884d76f559b996d45e8ad9a
SHA10e81a993f3af4e31d60653dc2513186f0495f1c8
SHA256c98e20d46d6465febb5d29cfab51241521ea5d6cd621f5e18b9b7d6fbfac3f0f
SHA512a9239648b5f15eac4d4151b6e1bdc81065eeaeb101404c2a0126f03bc87f1e6a57206bfa07a44379e9d3bba889e4497a9991ff41fb109099b01512df3dc3cbda
-
Filesize
559KB
MD56f675768d5d88bc051fbfb1873ef6abf
SHA1ec2c372106d6cba661ec03284bcd82cd89121e6e
SHA256b207fede2b18791c76a860f41cc8f20fa177c37c19abc252d3e6fceb5093e1d9
SHA51249161bd1fe59ae89e67a67dbd9814c8dc7cc225b5c597999296fb72210994422f40a2994ef54e6d9c56af9e449c7aca6cdd8d3f4ba239fca5ea276b670a40fb3