Analysis

  • max time kernel
    150s
  • max time network
    150s
  • platform
    windows10_x64
  • resource
    win10v20210410
  • submitted
    15-05-2021 04:44

General

  • Target

    ac7730946cebdf5ebf972d73356681662f2058d9a71517ff74e2a986276272f1.exe

  • Size

    1.9MB

  • MD5

    ba3851b7a3b93b34ab082dd184b01969

  • SHA1

    04a9cf0d8a973c9de96dae6fd830f9780512424d

  • SHA256

    ac7730946cebdf5ebf972d73356681662f2058d9a71517ff74e2a986276272f1

  • SHA512

    4765f079e434990360f34c3bf8c90d9e48ba0ff988a3a2d2edacf30085eb6a8ce10af3677d199a5830bd80278965674afac15e79438872946d2213268324e121

Malware Config

Signatures

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

  • Executes dropped EXE 3 IoCs
  • UPX packed file 4 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Adds Run key to start application 2 TTPs 2 IoCs
  • Suspicious use of SetThreadContext 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 33 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\ac7730946cebdf5ebf972d73356681662f2058d9a71517ff74e2a986276272f1.exe
    "C:\Users\Admin\AppData\Local\Temp\ac7730946cebdf5ebf972d73356681662f2058d9a71517ff74e2a986276272f1.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:3892
    • C:\Users\Admin\AppData\Local\Temp\ac7730946cebdf5ebf972d73356681662f2058d9a71517ff74e2a986276272f1.exe
      "C:\Users\Admin\AppData\Local\Temp\ac7730946cebdf5ebf972d73356681662f2058d9a71517ff74e2a986276272f1.exe"
      2⤵
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2168
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\RFCQQ.bat" "
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:196
        • C:\Windows\SysWOW64\reg.exe
          REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "svchost" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\test\test.exe" /f
          4⤵
          • Adds Run key to start application
          PID:688
      • C:\Users\Admin\AppData\Roaming\test\test.exe
        "C:\Users\Admin\AppData\Roaming\test\test.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:988
        • C:\Users\Admin\AppData\Roaming\test\test.exe
          "C:\Users\Admin\AppData\Roaming\test\test.exe"
          4⤵
          • Executes dropped EXE
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of SetWindowsHookEx
          PID:3672
        • C:\Users\Admin\AppData\Roaming\test\test.exe
          "C:\Users\Admin\AppData\Roaming\test\test.exe"
          4⤵
          • Executes dropped EXE
          • Suspicious use of AdjustPrivilegeToken
          PID:3776

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\RFCQQ.bat

    MD5

    527683c48cc4c7190219814c77b72fe0

    SHA1

    d995878a8f4b9824a0508039eeada5376be9a52d

    SHA256

    bbebf3e66136e700d8e3e2e0c8f461cdd9d7e68fe5a18a235afe86344932fb4b

    SHA512

    408a53b240c23fa34153ccc2b2315f28a9741121ecc9b76d50267ee62d78230e65574327369f83c779c781802c0c28f6c578703c01a67de46c3d44f71b814fa6

  • C:\Users\Admin\AppData\Roaming\test\test.exe

    MD5

    78e9bb6a1372b920494c62f4315981e8

    SHA1

    6c8e076b63408c085d6e5e8be87565c3b2c19f8b

    SHA256

    2a5199f0353435da7d56f5333069a8b68a1816db93956cbee32bcf0f7a494d59

    SHA512

    f10d4db8190954692ecc900b85fd0366de26956c3c453005ddfb093f4faf8779e0bd471722ce2d8b67f421b2833b72a2808207cff419906bae24d1f8f9b55584

  • C:\Users\Admin\AppData\Roaming\test\test.exe

    MD5

    78e9bb6a1372b920494c62f4315981e8

    SHA1

    6c8e076b63408c085d6e5e8be87565c3b2c19f8b

    SHA256

    2a5199f0353435da7d56f5333069a8b68a1816db93956cbee32bcf0f7a494d59

    SHA512

    f10d4db8190954692ecc900b85fd0366de26956c3c453005ddfb093f4faf8779e0bd471722ce2d8b67f421b2833b72a2808207cff419906bae24d1f8f9b55584

  • C:\Users\Admin\AppData\Roaming\test\test.exe

    MD5

    78e9bb6a1372b920494c62f4315981e8

    SHA1

    6c8e076b63408c085d6e5e8be87565c3b2c19f8b

    SHA256

    2a5199f0353435da7d56f5333069a8b68a1816db93956cbee32bcf0f7a494d59

    SHA512

    f10d4db8190954692ecc900b85fd0366de26956c3c453005ddfb093f4faf8779e0bd471722ce2d8b67f421b2833b72a2808207cff419906bae24d1f8f9b55584

  • C:\Users\Admin\AppData\Roaming\test\test.exe

    MD5

    78e9bb6a1372b920494c62f4315981e8

    SHA1

    6c8e076b63408c085d6e5e8be87565c3b2c19f8b

    SHA256

    2a5199f0353435da7d56f5333069a8b68a1816db93956cbee32bcf0f7a494d59

    SHA512

    f10d4db8190954692ecc900b85fd0366de26956c3c453005ddfb093f4faf8779e0bd471722ce2d8b67f421b2833b72a2808207cff419906bae24d1f8f9b55584

  • memory/196-128-0x0000000000000000-mapping.dmp

  • memory/688-130-0x0000000000000000-mapping.dmp

  • memory/988-145-0x00000000006D0000-0x00000000006D1000-memory.dmp

    Filesize

    4KB

  • memory/988-146-0x00000000006F0000-0x00000000006F1000-memory.dmp

    Filesize

    4KB

  • memory/988-147-0x0000000000700000-0x0000000000701000-memory.dmp

    Filesize

    4KB

  • memory/988-148-0x00000000021D0000-0x00000000021D1000-memory.dmp

    Filesize

    4KB

  • memory/988-131-0x0000000000000000-mapping.dmp

  • memory/2168-120-0x0000000000400000-0x000000000040B000-memory.dmp

    Filesize

    44KB

  • memory/2168-117-0x0000000000400000-0x000000000040B000-memory.dmp

    Filesize

    44KB

  • memory/2168-118-0x00000000004085D0-mapping.dmp

  • memory/3672-138-0x00000000004085D0-mapping.dmp

  • memory/3776-140-0x0000000000400000-0x00000000004B7000-memory.dmp

    Filesize

    732KB

  • memory/3776-142-0x00000000004B5640-mapping.dmp

  • memory/3776-153-0x0000000000400000-0x00000000004B7000-memory.dmp

    Filesize

    732KB

  • memory/3776-154-0x0000000002440000-0x0000000002441000-memory.dmp

    Filesize

    4KB

  • memory/3892-127-0x00000000021D0000-0x00000000021D1000-memory.dmp

    Filesize

    4KB

  • memory/3892-114-0x0000000000400000-0x000000000054B000-memory.dmp

    Filesize

    1.3MB

  • memory/3892-126-0x00000000021C0000-0x00000000021C1000-memory.dmp

    Filesize

    4KB

  • memory/3892-125-0x00000000006A0000-0x00000000007EA000-memory.dmp

    Filesize

    1.3MB

  • memory/3892-124-0x00000000006A0000-0x00000000007EA000-memory.dmp

    Filesize

    1.3MB

  • memory/3892-122-0x00000000006A0000-0x00000000007EA000-memory.dmp

    Filesize

    1.3MB

  • memory/3892-119-0x00000000006A0000-0x00000000007EA000-memory.dmp

    Filesize

    1.3MB