darkcomet | 110c0ac80f4d6a7e73183cf5a98f83440943afe69abca9a572ca4a4e54de7d13

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Users\\Admin\\AppData\\Roaming\\MSDCSC\\IDMAN.exe"	CRACKED.EXE

Modifies firewall policy service 3 TTPs 3 IoCs

defense_evasion

Modify Registry

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

description	ioc	Process
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	IDMAN.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0"	IDMAN.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "0"	IDMAN.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2089655958-977706906-1981639424-1000\Control Panel\International\Geo\Nation	NanoCore.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2089655958-977706906-1981639424-1000\Control Panel\International\Geo\Nation	CRACKED.EXE

Executes dropped EXE 3 IoCs

pid	Process
4080	CRACKED.EXE
3508	NANOCORE.EXE
3596	IDMAN.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2089655958-977706906-1981639424-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\IDMAN = "C:\\Users\\Admin\\AppData\\Roaming\\MSDCSC\\IDMAN.exe"	CRACKED.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2089655958-977706906-1981639424-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\IDMAN = "C:\\Users\\Admin\\AppData\\Roaming\\MSDCSC\\IDMAN.exe"	IDMAN.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NanoCore.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CRACKED.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IDMAN.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	dw20.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	dw20.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	dw20.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	dw20.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dw20.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3596	IDMAN.exe

Suspicious use of AdjustPrivilegeToken 50 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	4080	CRACKED.EXE
Token: SeSecurityPrivilege	4080	CRACKED.EXE
Token: SeTakeOwnershipPrivilege	4080	CRACKED.EXE
Token: SeLoadDriverPrivilege	4080	CRACKED.EXE
Token: SeSystemProfilePrivilege	4080	CRACKED.EXE
Token: SeSystemtimePrivilege	4080	CRACKED.EXE
Token: SeProfSingleProcessPrivilege	4080	CRACKED.EXE
Token: SeIncBasePriorityPrivilege	4080	CRACKED.EXE
Token: SeCreatePagefilePrivilege	4080	CRACKED.EXE
Token: SeBackupPrivilege	4080	CRACKED.EXE
Token: SeRestorePrivilege	4080	CRACKED.EXE
Token: SeShutdownPrivilege	4080	CRACKED.EXE
Token: SeDebugPrivilege	4080	CRACKED.EXE
Token: SeSystemEnvironmentPrivilege	4080	CRACKED.EXE
Token: SeChangeNotifyPrivilege	4080	CRACKED.EXE
Token: SeRemoteShutdownPrivilege	4080	CRACKED.EXE
Token: SeUndockPrivilege	4080	CRACKED.EXE
Token: SeManageVolumePrivilege	4080	CRACKED.EXE
Token: SeImpersonatePrivilege	4080	CRACKED.EXE
Token: SeCreateGlobalPrivilege	4080	CRACKED.EXE
Token: 33	4080	CRACKED.EXE
Token: 34	4080	CRACKED.EXE
Token: 35	4080	CRACKED.EXE
Token: 36	4080	CRACKED.EXE
Token: SeIncreaseQuotaPrivilege	3596	IDMAN.exe
Token: SeSecurityPrivilege	3596	IDMAN.exe
Token: SeTakeOwnershipPrivilege	3596	IDMAN.exe
Token: SeLoadDriverPrivilege	3596	IDMAN.exe
Token: SeSystemProfilePrivilege	3596	IDMAN.exe
Token: SeSystemtimePrivilege	3596	IDMAN.exe
Token: SeProfSingleProcessPrivilege	3596	IDMAN.exe
Token: SeIncBasePriorityPrivilege	3596	IDMAN.exe
Token: SeCreatePagefilePrivilege	3596	IDMAN.exe
Token: SeBackupPrivilege	3596	IDMAN.exe
Token: SeRestorePrivilege	3596	IDMAN.exe
Token: SeShutdownPrivilege	3596	IDMAN.exe
Token: SeDebugPrivilege	3596	IDMAN.exe
Token: SeSystemEnvironmentPrivilege	3596	IDMAN.exe
Token: SeChangeNotifyPrivilege	3596	IDMAN.exe
Token: SeRemoteShutdownPrivilege	3596	IDMAN.exe
Token: SeUndockPrivilege	3596	IDMAN.exe
Token: SeManageVolumePrivilege	3596	IDMAN.exe
Token: SeImpersonatePrivilege	3596	IDMAN.exe
Token: SeCreateGlobalPrivilege	3596	IDMAN.exe
Token: 33	3596	IDMAN.exe
Token: 34	3596	IDMAN.exe
Token: 35	3596	IDMAN.exe
Token: 36	3596	IDMAN.exe
Token: SeBackupPrivilege	4316	dw20.exe
Token: SeBackupPrivilege	4316	dw20.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3596	IDMAN.exe

Suspicious use of WriteProcessMemory 32 IoCs

description	pid	Process	procid_target
PID 4992 wrote to memory of 4080	4992	NanoCore.exe	87
PID 4992 wrote to memory of 4080	4992	NanoCore.exe	87
PID 4992 wrote to memory of 4080	4992	NanoCore.exe	87
PID 4992 wrote to memory of 3508	4992	NanoCore.exe	88
PID 4992 wrote to memory of 3508	4992	NanoCore.exe	88
PID 4080 wrote to memory of 3596	4080	CRACKED.EXE	90
PID 4080 wrote to memory of 3596	4080	CRACKED.EXE	90
PID 4080 wrote to memory of 3596	4080	CRACKED.EXE	90
PID 3596 wrote to memory of 3520	3596	IDMAN.exe	91
PID 3596 wrote to memory of 3520	3596	IDMAN.exe	91
PID 3596 wrote to memory of 3520	3596	IDMAN.exe	91
PID 3596 wrote to memory of 3520	3596	IDMAN.exe	91
PID 3596 wrote to memory of 3520	3596	IDMAN.exe	91
PID 3596 wrote to memory of 3520	3596	IDMAN.exe	91
PID 3596 wrote to memory of 3520	3596	IDMAN.exe	91
PID 3596 wrote to memory of 3520	3596	IDMAN.exe	91
PID 3596 wrote to memory of 3520	3596	IDMAN.exe	91
PID 3596 wrote to memory of 3520	3596	IDMAN.exe	91
PID 3596 wrote to memory of 3520	3596	IDMAN.exe	91
PID 3596 wrote to memory of 3520	3596	IDMAN.exe	91
PID 3596 wrote to memory of 3520	3596	IDMAN.exe	91
PID 3596 wrote to memory of 3520	3596	IDMAN.exe	91
PID 3596 wrote to memory of 3520	3596	IDMAN.exe	91
PID 3596 wrote to memory of 3520	3596	IDMAN.exe	91
PID 3596 wrote to memory of 3520	3596	IDMAN.exe	91
PID 3596 wrote to memory of 3520	3596	IDMAN.exe	91
PID 3596 wrote to memory of 3520	3596	IDMAN.exe	91
PID 3596 wrote to memory of 3520	3596	IDMAN.exe	91
PID 3596 wrote to memory of 3520	3596	IDMAN.exe	91
PID 3596 wrote to memory of 3520	3596	IDMAN.exe	91
PID 3508 wrote to memory of 4316	3508	NANOCORE.EXE	92
PID 3508 wrote to memory of 4316	3508	NANOCORE.EXE	92

C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\NanoCore.exe
"C:\Users\Admin\AppData\Local\Temp\NanoCore-master\sample\NanoCore.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4992
- C:\Users\Admin\AppData\Roaming\CRACKED.EXE
  "C:\Users\Admin\AppData\Roaming\CRACKED.EXE"
  2⤵
  - Modifies WinLogon for persistence
  - Checks computer location settings
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4080
- - C:\Users\Admin\AppData\Roaming\MSDCSC\IDMAN.exe
    "C:\Users\Admin\AppData\Roaming\MSDCSC\IDMAN.exe"
    3⤵
    - Modifies firewall policy service
    - Executes dropped EXE
    - Adds Run key to start application
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:3596
  - - C:\Windows\SysWOW64\notepad.exe
      notepad
      4⤵
      System Location Discovery: System Language Discovery
      PID:3520
- C:\Users\Admin\AppData\Roaming\NANOCORE.EXE
  "C:\Users\Admin\AppData\Roaming\NANOCORE.EXE"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:3508
- - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe
    dw20.exe -x -s 1204
    3⤵
    - Checks processor information in registry
    - Enumerates system info in registry
    - Suspicious use of AdjustPrivilegeToken
    PID:4316

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery