Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
118s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
08/01/2025, 23:31
Static task
static1
Behavioral task
behavioral1
Sample
1fe57ec8aa73b0a0ec80fc3b2c508597724165cd2754b2589d974e917726dd34N.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
1fe57ec8aa73b0a0ec80fc3b2c508597724165cd2754b2589d974e917726dd34N.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/snorts.dll
Resource
win7-20240903-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/snorts.dll
Resource
win10v2004-20241007-en
General
-
Target
1fe57ec8aa73b0a0ec80fc3b2c508597724165cd2754b2589d974e917726dd34N.exe
-
Size
300KB
-
MD5
7a20bc1617941753c2df045d10b2e9b0
-
SHA1
7cf9362db3615c9d7ac1bd86a8b34767ad1bb7e2
-
SHA256
1fe57ec8aa73b0a0ec80fc3b2c508597724165cd2754b2589d974e917726dd34
-
SHA512
638da391a2e39d38d8c18fba23b20055dfa92b98402898477643bd2fd97a2852ebbf3190a1b99b2794cccb572fe33863762590431a7894066f0fcddc61ce5f80
-
SSDEEP
6144:1wHysEYOmWb2UfOEmvb/cjO6wlD+GznCWFYx185H1cI5+2d2Qd0HTLCXv:eEY52eb/cSFFquN5+hpHfC/
Malware Config
Extracted
darkcomet
Member
privatefirmservices.misconfused.org:1889
DC_MUTEX-VPYPTFZ
-
InstallPath
outlook\reader.exe
-
gencode
lMrP0lsejr0x
-
install
true
-
offline_keylogger
true
-
persistence
true
-
reg_key
MicroUpdate
Signatures
-
Darkcomet family
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Users\\Admin\\Favorites\\outlook\\reader.exe" 1fe57ec8aa73b0a0ec80fc3b2c508597724165cd2754b2589d974e917726dd34N.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation 1fe57ec8aa73b0a0ec80fc3b2c508597724165cd2754b2589d974e917726dd34N.exe -
Executes dropped EXE 2 IoCs
pid Process 3716 reader.exe 116 reader.exe -
Loads dropped DLL 2 IoCs
pid Process 3940 1fe57ec8aa73b0a0ec80fc3b2c508597724165cd2754b2589d974e917726dd34N.exe 3716 reader.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Users\\Admin\\Favorites\\outlook\\reader.exe" 1fe57ec8aa73b0a0ec80fc3b2c508597724165cd2754b2589d974e917726dd34N.exe -
Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 3940 set thread context of 3464 3940 1fe57ec8aa73b0a0ec80fc3b2c508597724165cd2754b2589d974e917726dd34N.exe 82 PID 3716 set thread context of 116 3716 reader.exe 86 -
resource yara_rule behavioral2/memory/3464-10-0x0000000000400000-0x00000000004B7000-memory.dmp upx behavioral2/memory/3464-6-0x0000000000400000-0x00000000004B7000-memory.dmp upx behavioral2/memory/3464-11-0x0000000000400000-0x00000000004B7000-memory.dmp upx behavioral2/memory/3464-13-0x0000000000400000-0x00000000004B7000-memory.dmp upx behavioral2/memory/3464-12-0x0000000000400000-0x00000000004B7000-memory.dmp upx behavioral2/memory/3464-14-0x0000000000400000-0x00000000004B7000-memory.dmp upx behavioral2/memory/3464-91-0x0000000000400000-0x00000000004B7000-memory.dmp upx behavioral2/memory/116-92-0x0000000000400000-0x00000000004B7000-memory.dmp upx behavioral2/memory/116-94-0x0000000000400000-0x00000000004B7000-memory.dmp upx behavioral2/memory/116-93-0x0000000000400000-0x00000000004B7000-memory.dmp upx behavioral2/memory/116-95-0x0000000000400000-0x00000000004B7000-memory.dmp upx behavioral2/memory/116-98-0x0000000000400000-0x00000000004B7000-memory.dmp upx behavioral2/memory/116-99-0x0000000000400000-0x00000000004B7000-memory.dmp upx behavioral2/memory/116-100-0x0000000000400000-0x00000000004B7000-memory.dmp upx behavioral2/memory/116-101-0x0000000000400000-0x00000000004B7000-memory.dmp upx behavioral2/memory/116-102-0x0000000000400000-0x00000000004B7000-memory.dmp upx behavioral2/memory/116-103-0x0000000000400000-0x00000000004B7000-memory.dmp upx behavioral2/memory/116-104-0x0000000000400000-0x00000000004B7000-memory.dmp upx behavioral2/memory/116-105-0x0000000000400000-0x00000000004B7000-memory.dmp upx behavioral2/memory/116-106-0x0000000000400000-0x00000000004B7000-memory.dmp upx behavioral2/memory/116-107-0x0000000000400000-0x00000000004B7000-memory.dmp upx behavioral2/memory/116-108-0x0000000000400000-0x00000000004B7000-memory.dmp upx behavioral2/memory/116-109-0x0000000000400000-0x00000000004B7000-memory.dmp upx behavioral2/memory/116-110-0x0000000000400000-0x00000000004B7000-memory.dmp upx -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1fe57ec8aa73b0a0ec80fc3b2c508597724165cd2754b2589d974e917726dd34N.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1fe57ec8aa73b0a0ec80fc3b2c508597724165cd2754b2589d974e917726dd34N.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reader.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reader.exe -
NSIS installer 2 IoCs
resource yara_rule behavioral2/files/0x000b000000023b8e-19.dat nsis_installer_1 behavioral2/files/0x000b000000023b8e-19.dat nsis_installer_2 -
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ 1fe57ec8aa73b0a0ec80fc3b2c508597724165cd2754b2589d974e917726dd34N.exe -
Suspicious use of AdjustPrivilegeToken 48 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 3464 1fe57ec8aa73b0a0ec80fc3b2c508597724165cd2754b2589d974e917726dd34N.exe Token: SeSecurityPrivilege 3464 1fe57ec8aa73b0a0ec80fc3b2c508597724165cd2754b2589d974e917726dd34N.exe Token: SeTakeOwnershipPrivilege 3464 1fe57ec8aa73b0a0ec80fc3b2c508597724165cd2754b2589d974e917726dd34N.exe Token: SeLoadDriverPrivilege 3464 1fe57ec8aa73b0a0ec80fc3b2c508597724165cd2754b2589d974e917726dd34N.exe Token: SeSystemProfilePrivilege 3464 1fe57ec8aa73b0a0ec80fc3b2c508597724165cd2754b2589d974e917726dd34N.exe Token: SeSystemtimePrivilege 3464 1fe57ec8aa73b0a0ec80fc3b2c508597724165cd2754b2589d974e917726dd34N.exe Token: SeProfSingleProcessPrivilege 3464 1fe57ec8aa73b0a0ec80fc3b2c508597724165cd2754b2589d974e917726dd34N.exe Token: SeIncBasePriorityPrivilege 3464 1fe57ec8aa73b0a0ec80fc3b2c508597724165cd2754b2589d974e917726dd34N.exe Token: SeCreatePagefilePrivilege 3464 1fe57ec8aa73b0a0ec80fc3b2c508597724165cd2754b2589d974e917726dd34N.exe Token: SeBackupPrivilege 3464 1fe57ec8aa73b0a0ec80fc3b2c508597724165cd2754b2589d974e917726dd34N.exe Token: SeRestorePrivilege 3464 1fe57ec8aa73b0a0ec80fc3b2c508597724165cd2754b2589d974e917726dd34N.exe Token: SeShutdownPrivilege 3464 1fe57ec8aa73b0a0ec80fc3b2c508597724165cd2754b2589d974e917726dd34N.exe Token: SeDebugPrivilege 3464 1fe57ec8aa73b0a0ec80fc3b2c508597724165cd2754b2589d974e917726dd34N.exe Token: SeSystemEnvironmentPrivilege 3464 1fe57ec8aa73b0a0ec80fc3b2c508597724165cd2754b2589d974e917726dd34N.exe Token: SeChangeNotifyPrivilege 3464 1fe57ec8aa73b0a0ec80fc3b2c508597724165cd2754b2589d974e917726dd34N.exe Token: SeRemoteShutdownPrivilege 3464 1fe57ec8aa73b0a0ec80fc3b2c508597724165cd2754b2589d974e917726dd34N.exe Token: SeUndockPrivilege 3464 1fe57ec8aa73b0a0ec80fc3b2c508597724165cd2754b2589d974e917726dd34N.exe Token: SeManageVolumePrivilege 3464 1fe57ec8aa73b0a0ec80fc3b2c508597724165cd2754b2589d974e917726dd34N.exe Token: SeImpersonatePrivilege 3464 1fe57ec8aa73b0a0ec80fc3b2c508597724165cd2754b2589d974e917726dd34N.exe Token: SeCreateGlobalPrivilege 3464 1fe57ec8aa73b0a0ec80fc3b2c508597724165cd2754b2589d974e917726dd34N.exe Token: 33 3464 1fe57ec8aa73b0a0ec80fc3b2c508597724165cd2754b2589d974e917726dd34N.exe Token: 34 3464 1fe57ec8aa73b0a0ec80fc3b2c508597724165cd2754b2589d974e917726dd34N.exe Token: 35 3464 1fe57ec8aa73b0a0ec80fc3b2c508597724165cd2754b2589d974e917726dd34N.exe Token: 36 3464 1fe57ec8aa73b0a0ec80fc3b2c508597724165cd2754b2589d974e917726dd34N.exe Token: SeIncreaseQuotaPrivilege 116 reader.exe Token: SeSecurityPrivilege 116 reader.exe Token: SeTakeOwnershipPrivilege 116 reader.exe Token: SeLoadDriverPrivilege 116 reader.exe Token: SeSystemProfilePrivilege 116 reader.exe Token: SeSystemtimePrivilege 116 reader.exe Token: SeProfSingleProcessPrivilege 116 reader.exe Token: SeIncBasePriorityPrivilege 116 reader.exe Token: SeCreatePagefilePrivilege 116 reader.exe Token: SeBackupPrivilege 116 reader.exe Token: SeRestorePrivilege 116 reader.exe Token: SeShutdownPrivilege 116 reader.exe Token: SeDebugPrivilege 116 reader.exe Token: SeSystemEnvironmentPrivilege 116 reader.exe Token: SeChangeNotifyPrivilege 116 reader.exe Token: SeRemoteShutdownPrivilege 116 reader.exe Token: SeUndockPrivilege 116 reader.exe Token: SeManageVolumePrivilege 116 reader.exe Token: SeImpersonatePrivilege 116 reader.exe Token: SeCreateGlobalPrivilege 116 reader.exe Token: 33 116 reader.exe Token: 34 116 reader.exe Token: 35 116 reader.exe Token: 36 116 reader.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 116 reader.exe -
Suspicious use of WriteProcessMemory 19 IoCs
description pid Process procid_target PID 3940 wrote to memory of 3464 3940 1fe57ec8aa73b0a0ec80fc3b2c508597724165cd2754b2589d974e917726dd34N.exe 82 PID 3940 wrote to memory of 3464 3940 1fe57ec8aa73b0a0ec80fc3b2c508597724165cd2754b2589d974e917726dd34N.exe 82 PID 3940 wrote to memory of 3464 3940 1fe57ec8aa73b0a0ec80fc3b2c508597724165cd2754b2589d974e917726dd34N.exe 82 PID 3940 wrote to memory of 3464 3940 1fe57ec8aa73b0a0ec80fc3b2c508597724165cd2754b2589d974e917726dd34N.exe 82 PID 3940 wrote to memory of 3464 3940 1fe57ec8aa73b0a0ec80fc3b2c508597724165cd2754b2589d974e917726dd34N.exe 82 PID 3940 wrote to memory of 3464 3940 1fe57ec8aa73b0a0ec80fc3b2c508597724165cd2754b2589d974e917726dd34N.exe 82 PID 3940 wrote to memory of 3464 3940 1fe57ec8aa73b0a0ec80fc3b2c508597724165cd2754b2589d974e917726dd34N.exe 82 PID 3940 wrote to memory of 3464 3940 1fe57ec8aa73b0a0ec80fc3b2c508597724165cd2754b2589d974e917726dd34N.exe 82 PID 3464 wrote to memory of 3716 3464 1fe57ec8aa73b0a0ec80fc3b2c508597724165cd2754b2589d974e917726dd34N.exe 85 PID 3464 wrote to memory of 3716 3464 1fe57ec8aa73b0a0ec80fc3b2c508597724165cd2754b2589d974e917726dd34N.exe 85 PID 3464 wrote to memory of 3716 3464 1fe57ec8aa73b0a0ec80fc3b2c508597724165cd2754b2589d974e917726dd34N.exe 85 PID 3716 wrote to memory of 116 3716 reader.exe 86 PID 3716 wrote to memory of 116 3716 reader.exe 86 PID 3716 wrote to memory of 116 3716 reader.exe 86 PID 3716 wrote to memory of 116 3716 reader.exe 86 PID 3716 wrote to memory of 116 3716 reader.exe 86 PID 3716 wrote to memory of 116 3716 reader.exe 86 PID 3716 wrote to memory of 116 3716 reader.exe 86 PID 3716 wrote to memory of 116 3716 reader.exe 86
Processes
-
C:\Users\Admin\AppData\Local\Temp\1fe57ec8aa73b0a0ec80fc3b2c508597724165cd2754b2589d974e917726dd34N.exe"C:\Users\Admin\AppData\Local\Temp\1fe57ec8aa73b0a0ec80fc3b2c508597724165cd2754b2589d974e917726dd34N.exe"1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3940 -
C:\Users\Admin\AppData\Local\Temp\1fe57ec8aa73b0a0ec80fc3b2c508597724165cd2754b2589d974e917726dd34N.exe"C:\Users\Admin\AppData\Local\Temp\1fe57ec8aa73b0a0ec80fc3b2c508597724165cd2754b2589d974e917726dd34N.exe"2⤵
- Modifies WinLogon for persistence
- Checks computer location settings
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3464 -
C:\Users\Admin\Favorites\outlook\reader.exe"C:\Users\Admin\Favorites\outlook\reader.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3716 -
C:\Users\Admin\Favorites\outlook\reader.exe"C:\Users\Admin\Favorites\outlook\reader.exe"4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:116
-
-
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
22KB
MD503335eedd55f4e846c30f6e343b79f72
SHA1d97be693fa21f3e1f75f6aec08c943a5589d0de4
SHA2560379140a954b9a8cd1be8fa6302a7296af60298b7af77a1e40914f95d012b647
SHA5122f43d9a46c720ae424354b5082f37422d8add2d0931f628fb8f503de5860c94efd130bf66b61efaf6865984fea573d122ada603af06aec56286cd29d9faf5b18
-
Filesize
251KB
MD5742ea6c8197de6c5e44e3eab801f240d
SHA1a8ea8771b12665a0e2199486d86270da3d212536
SHA25652798a3abc8a383259f1273930412f6cbf1abe4beb314c120d7e123dfecfb7a7
SHA512a1a2c311d552405658c051fa570ca37398d129a6c95dff2c85d1c0db68c18b70cf64cff6c0168ec67f35e2eeb96fd5787882d2de020d2577101706554cf79d6b
-
Filesize
300KB
MD57a20bc1617941753c2df045d10b2e9b0
SHA17cf9362db3615c9d7ac1bd86a8b34767ad1bb7e2
SHA2561fe57ec8aa73b0a0ec80fc3b2c508597724165cd2754b2589d974e917726dd34
SHA512638da391a2e39d38d8c18fba23b20055dfa92b98402898477643bd2fd97a2852ebbf3190a1b99b2794cccb572fe33863762590431a7894066f0fcddc61ce5f80