Analysis

  • max time kernel
    150s
  • max time network
    143s
  • platform
    windows10_x64
  • resource
    win10v20201028
  • submitted
    13-11-2020 15:32

General

  • Target

    8237c56fb8d1968bafeb63ebd64ef362b9efc3b923e57e3732870076e04bf357.exe

  • Size

    251KB

  • MD5

    530119807d27adea9b69bcbf9aad4f0b

  • SHA1

    37c487c8363d9f4e730772ceb135e1a3d330b121

  • SHA256

    8237c56fb8d1968bafeb63ebd64ef362b9efc3b923e57e3732870076e04bf357

  • SHA512

    295342c759e0da72e18e2c2967d9df4173f05d81d8dbc3472ec6e29a6cc1729008e26830e412c995ed19b94008b77cd8c61e49af26ed41006ff351afbdb867be

Malware Config

Signatures

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

  • Modifies WinLogon for persistence 2 TTPs 1 IoCs
  • Modifies security service 2 TTPs 1 IoCs
  • Windows security bypass 2 TTPs
  • Executes dropped EXE 1 IoCs
  • Sets file to hidden 1 TTPs

    Modifies file attributes to stop it showing in Explorer etc.

  • UPX packed file 2 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Windows security modification 2 TTPs 2 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 48 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 37 IoCs
  • Views/modifies file attributes 1 TTPs 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\8237c56fb8d1968bafeb63ebd64ef362b9efc3b923e57e3732870076e04bf357.exe
    "C:\Users\Admin\AppData\Local\Temp\8237c56fb8d1968bafeb63ebd64ef362b9efc3b923e57e3732870076e04bf357.exe"
    1⤵
    • Modifies WinLogon for persistence
    • Adds Run key to start application
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1056
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp\8237c56fb8d1968bafeb63ebd64ef362b9efc3b923e57e3732870076e04bf357.exe" +s +h
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:400
      • C:\Windows\SysWOW64\attrib.exe
        attrib "C:\Users\Admin\AppData\Local\Temp\8237c56fb8d1968bafeb63ebd64ef362b9efc3b923e57e3732870076e04bf357.exe" +s +h
        3⤵
        • Views/modifies file attributes
        PID:3820
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp" +s +h
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:2928
      • C:\Windows\SysWOW64\attrib.exe
        attrib "C:\Users\Admin\AppData\Local\Temp" +s +h
        3⤵
        • Views/modifies file attributes
        PID:2888
    • C:\Users\Admin\AppData\Roaming\Temp\Microsoft.NET.exe
      "C:\Users\Admin\AppData\Roaming\Temp\Microsoft.NET.exe"
      2⤵
      • Modifies security service
      • Executes dropped EXE
      • Windows security modification
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:208
      • C:\Windows\SysWOW64\notepad.exe
        notepad
        3⤵
          PID:1372

    Network

    MITRE ATT&CK Matrix ATT&CK v6

    Persistence

    Winlogon Helper DLL

    1
    T1004

    Modify Existing Service

    1
    T1031

    Hidden Files and Directories

    2
    T1158

    Registry Run Keys / Startup Folder

    1
    T1060

    Defense Evasion

    Modify Registry

    5
    T1112

    Disabling Security Tools

    2
    T1089

    Hidden Files and Directories

    2
    T1158

    Discovery

    System Information Discovery

    1
    T1082

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Roaming\Temp\Microsoft.NET.exe
      MD5

      530119807d27adea9b69bcbf9aad4f0b

      SHA1

      37c487c8363d9f4e730772ceb135e1a3d330b121

      SHA256

      8237c56fb8d1968bafeb63ebd64ef362b9efc3b923e57e3732870076e04bf357

      SHA512

      295342c759e0da72e18e2c2967d9df4173f05d81d8dbc3472ec6e29a6cc1729008e26830e412c995ed19b94008b77cd8c61e49af26ed41006ff351afbdb867be

    • C:\Users\Admin\AppData\Roaming\Temp\Microsoft.NET.exe
      MD5

      530119807d27adea9b69bcbf9aad4f0b

      SHA1

      37c487c8363d9f4e730772ceb135e1a3d330b121

      SHA256

      8237c56fb8d1968bafeb63ebd64ef362b9efc3b923e57e3732870076e04bf357

      SHA512

      295342c759e0da72e18e2c2967d9df4173f05d81d8dbc3472ec6e29a6cc1729008e26830e412c995ed19b94008b77cd8c61e49af26ed41006ff351afbdb867be

    • memory/208-2-0x0000000000000000-mapping.dmp
    • memory/400-0-0x0000000000000000-mapping.dmp
    • memory/1372-8-0x00000000031B0000-0x00000000031B1000-memory.dmp
      Filesize

      4KB

    • memory/1372-7-0x0000000000000000-mapping.dmp
    • memory/1372-9-0x0000000000000000-mapping.dmp
    • memory/2888-6-0x0000000000000000-mapping.dmp
    • memory/2928-1-0x0000000000000000-mapping.dmp
    • memory/3820-5-0x0000000000000000-mapping.dmp