Analysis

  • max time kernel
    151s
  • max time network
    140s
  • platform
    windows7_x64
  • resource
    win7v20201028
  • submitted
    13-11-2020 15:32

General

  • Target

    8237c56fb8d1968bafeb63ebd64ef362b9efc3b923e57e3732870076e04bf357.exe

  • Size

    251KB

  • MD5

    530119807d27adea9b69bcbf9aad4f0b

  • SHA1

    37c487c8363d9f4e730772ceb135e1a3d330b121

  • SHA256

    8237c56fb8d1968bafeb63ebd64ef362b9efc3b923e57e3732870076e04bf357

  • SHA512

    295342c759e0da72e18e2c2967d9df4173f05d81d8dbc3472ec6e29a6cc1729008e26830e412c995ed19b94008b77cd8c61e49af26ed41006ff351afbdb867be

Malware Config

Signatures

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

  • Modifies WinLogon for persistence 2 TTPs 1 IoCs
  • Modifies security service 2 TTPs 1 IoCs
  • Windows security bypass 2 TTPs
  • Executes dropped EXE 1 IoCs
  • Sets file to hidden 1 TTPs

    Modifies file attributes to stop it showing in Explorer etc.

  • UPX packed file 4 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Loads dropped DLL 2 IoCs
  • Windows security modification 2 TTPs 2 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 46 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 43 IoCs
  • Views/modifies file attributes 1 TTPs 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\8237c56fb8d1968bafeb63ebd64ef362b9efc3b923e57e3732870076e04bf357.exe
    "C:\Users\Admin\AppData\Local\Temp\8237c56fb8d1968bafeb63ebd64ef362b9efc3b923e57e3732870076e04bf357.exe"
    1⤵
    • Modifies WinLogon for persistence
    • Loads dropped DLL
    • Adds Run key to start application
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:240
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp\8237c56fb8d1968bafeb63ebd64ef362b9efc3b923e57e3732870076e04bf357.exe" +s +h
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:1180
      • C:\Windows\SysWOW64\attrib.exe
        attrib "C:\Users\Admin\AppData\Local\Temp\8237c56fb8d1968bafeb63ebd64ef362b9efc3b923e57e3732870076e04bf357.exe" +s +h
        3⤵
        • Views/modifies file attributes
        PID:2040
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp" +s +h
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:1972
      • C:\Windows\SysWOW64\attrib.exe
        attrib "C:\Users\Admin\AppData\Local\Temp" +s +h
        3⤵
        • Views/modifies file attributes
        PID:1736
    • C:\Users\Admin\AppData\Roaming\Temp\Microsoft.NET.exe
      "C:\Users\Admin\AppData\Roaming\Temp\Microsoft.NET.exe"
      2⤵
      • Modifies security service
      • Executes dropped EXE
      • Windows security modification
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:1752
      • C:\Windows\SysWOW64\notepad.exe
        notepad
        3⤵
          PID:1332

    Network

    MITRE ATT&CK Matrix ATT&CK v6

    Persistence

    Winlogon Helper DLL

    1
    T1004

    Modify Existing Service

    1
    T1031

    Hidden Files and Directories

    2
    T1158

    Registry Run Keys / Startup Folder

    1
    T1060

    Defense Evasion

    Modify Registry

    5
    T1112

    Disabling Security Tools

    2
    T1089

    Hidden Files and Directories

    2
    T1158

    Discovery

    System Information Discovery

    1
    T1082

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Roaming\Temp\Microsoft.NET.exe
      MD5

      530119807d27adea9b69bcbf9aad4f0b

      SHA1

      37c487c8363d9f4e730772ceb135e1a3d330b121

      SHA256

      8237c56fb8d1968bafeb63ebd64ef362b9efc3b923e57e3732870076e04bf357

      SHA512

      295342c759e0da72e18e2c2967d9df4173f05d81d8dbc3472ec6e29a6cc1729008e26830e412c995ed19b94008b77cd8c61e49af26ed41006ff351afbdb867be

    • C:\Users\Admin\AppData\Roaming\Temp\Microsoft.NET.exe
      MD5

      530119807d27adea9b69bcbf9aad4f0b

      SHA1

      37c487c8363d9f4e730772ceb135e1a3d330b121

      SHA256

      8237c56fb8d1968bafeb63ebd64ef362b9efc3b923e57e3732870076e04bf357

      SHA512

      295342c759e0da72e18e2c2967d9df4173f05d81d8dbc3472ec6e29a6cc1729008e26830e412c995ed19b94008b77cd8c61e49af26ed41006ff351afbdb867be

    • \Users\Admin\AppData\Roaming\Temp\Microsoft.NET.exe
      MD5

      530119807d27adea9b69bcbf9aad4f0b

      SHA1

      37c487c8363d9f4e730772ceb135e1a3d330b121

      SHA256

      8237c56fb8d1968bafeb63ebd64ef362b9efc3b923e57e3732870076e04bf357

      SHA512

      295342c759e0da72e18e2c2967d9df4173f05d81d8dbc3472ec6e29a6cc1729008e26830e412c995ed19b94008b77cd8c61e49af26ed41006ff351afbdb867be

    • \Users\Admin\AppData\Roaming\Temp\Microsoft.NET.exe
      MD5

      530119807d27adea9b69bcbf9aad4f0b

      SHA1

      37c487c8363d9f4e730772ceb135e1a3d330b121

      SHA256

      8237c56fb8d1968bafeb63ebd64ef362b9efc3b923e57e3732870076e04bf357

      SHA512

      295342c759e0da72e18e2c2967d9df4173f05d81d8dbc3472ec6e29a6cc1729008e26830e412c995ed19b94008b77cd8c61e49af26ed41006ff351afbdb867be

    • memory/1180-0-0x0000000000000000-mapping.dmp
    • memory/1332-9-0x0000000000000000-mapping.dmp
    • memory/1332-10-0x0000000000220000-0x0000000000221000-memory.dmp
      Filesize

      4KB

    • memory/1332-11-0x0000000000000000-mapping.dmp
    • memory/1736-3-0x0000000000000000-mapping.dmp
    • memory/1752-6-0x0000000000000000-mapping.dmp
    • memory/1972-1-0x0000000000000000-mapping.dmp
    • memory/2040-2-0x0000000000000000-mapping.dmp