Analysis

  • max time kernel
    110s
  • max time network
    150s
  • platform
    windows10_x64
  • resource
    win10v20210408
  • submitted
    11-06-2021 14:27

General

  • Target

    445bc3da96e63745748cc4d7d14faaa80122f46bc86e2.exe

  • Size

    833KB

  • MD5

    aff59ff4873a180e497cac498323fd56

  • SHA1

    3cb24379d8aeb29a58fddac419f8bd0fc1068c89

  • SHA256

    445bc3da96e63745748cc4d7d14faaa80122f46bc86e2a4628956f5aea4b70f7

  • SHA512

    cbf9ed1d90ea527bc9e8f3564d1fd2f3d1f9c92e10ba8da790f58c815f07ae11f6c5da3772b95b286867e3be124994ddc32aa1758a1d2acb8667d01dfca7b929

Malware Config

Signatures

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

  • Modifies WinLogon for persistence 2 TTPs 1 IoCs
  • Executes dropped EXE 2 IoCs
  • UPX packed file 4 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious use of AdjustPrivilegeToken 48 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 18 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\445bc3da96e63745748cc4d7d14faaa80122f46bc86e2.exe
    "C:\Users\Admin\AppData\Local\Temp\445bc3da96e63745748cc4d7d14faaa80122f46bc86e2.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2840
    • C:\Windows\SysWOW64\cmd.exe
      cmd /c schtasks /Create /TN svchost.exe /XML "C:\Users\Admin\AppData\Local\Temp\906e3b9444e74d05a4e8d74c157bad7e.xml"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:2928
      • C:\Windows\SysWOW64\schtasks.exe
        schtasks /Create /TN svchost.exe /XML "C:\Users\Admin\AppData\Local\Temp\906e3b9444e74d05a4e8d74c157bad7e.xml"
        3⤵
        • Creates scheduled task(s)
        PID:2384
    • C:\Users\Admin\AppData\Local\Temp\D&H.exe
      "C:\Users\Admin\AppData\Local\Temp\D&H.exe"
      2⤵
      • Modifies WinLogon for persistence
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:4084
      • C:\Users\Admin\AppData\Roaming\MSDCSC\msdcsc.exe
        "C:\Users\Admin\AppData\Roaming\MSDCSC\msdcsc.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of SetWindowsHookEx
        PID:776
    • C:\Users\Admin\AppData\Local\Temp\445bc3da96e63745748cc4d7d14faaa80122f46bc86e2.exe
      "C:\Users\Admin\AppData\Local\Temp\445bc3da96e63745748cc4d7d14faaa80122f46bc86e2.exe"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:196
      • C:\Users\Admin\AppData\Local\Temp\445bc3da96e63745748cc4d7d14faaa80122f46bc86e2.exe
        "C:\Users\Admin\AppData\Local\Temp\445bc3da96e63745748cc4d7d14faaa80122f46bc86e2.exe"
        3⤵
          PID:3460

    Network

    MITRE ATT&CK Enterprise v6

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\906e3b9444e74d05a4e8d74c157bad7e.xml

      MD5

      f0e0e81f7cf053c3bb14ea4e007fae8e

      SHA1

      ee5362c257452de3241d01c497f2a0d101b55164

      SHA256

      6843901f475e8ae813a07cf3551672f497208cfe6967a9239075f480b5a6e0bc

      SHA512

      8c5c373b7cd41a24664c0ea3d5618e351481a95c3d180e5fb1a5a69aa7e8cb54067e4de9ee8ee4cddb07097ea596f71dcb95e09566c77a5f96df4ccdcd448670

    • C:\Users\Admin\AppData\Local\Temp\D&H.exe

      MD5

      6ecfbfb290b771d5aad3a289494a7e01

      SHA1

      999277c449813f3292afce6e2a105e9f5331ba21

      SHA256

      d1d5863a9d03fe4f0d32466a06e0384a5750990343cc62c46f45fd8ea6ae644f

      SHA512

      9b71b3b503416f701257531247588fce8aefb21e990f1955e0cd6286686eb0f97edd43a2b8ee3af46c48d4857e2c5d09adde32e44d7a0589a5529da571b93f18

    • C:\Users\Admin\AppData\Local\Temp\D&H.exe

      MD5

      6ecfbfb290b771d5aad3a289494a7e01

      SHA1

      999277c449813f3292afce6e2a105e9f5331ba21

      SHA256

      d1d5863a9d03fe4f0d32466a06e0384a5750990343cc62c46f45fd8ea6ae644f

      SHA512

      9b71b3b503416f701257531247588fce8aefb21e990f1955e0cd6286686eb0f97edd43a2b8ee3af46c48d4857e2c5d09adde32e44d7a0589a5529da571b93f18

    • C:\Users\Admin\AppData\Roaming\MSDCSC\msdcsc.exe

      MD5

      6ecfbfb290b771d5aad3a289494a7e01

      SHA1

      999277c449813f3292afce6e2a105e9f5331ba21

      SHA256

      d1d5863a9d03fe4f0d32466a06e0384a5750990343cc62c46f45fd8ea6ae644f

      SHA512

      9b71b3b503416f701257531247588fce8aefb21e990f1955e0cd6286686eb0f97edd43a2b8ee3af46c48d4857e2c5d09adde32e44d7a0589a5529da571b93f18

    • C:\Users\Admin\AppData\Roaming\MSDCSC\msdcsc.exe

      MD5

      6ecfbfb290b771d5aad3a289494a7e01

      SHA1

      999277c449813f3292afce6e2a105e9f5331ba21

      SHA256

      d1d5863a9d03fe4f0d32466a06e0384a5750990343cc62c46f45fd8ea6ae644f

      SHA512

      9b71b3b503416f701257531247588fce8aefb21e990f1955e0cd6286686eb0f97edd43a2b8ee3af46c48d4857e2c5d09adde32e44d7a0589a5529da571b93f18

    • memory/196-117-0x0000000000000000-mapping.dmp

    • memory/776-122-0x0000000000000000-mapping.dmp

    • memory/776-126-0x0000000000640000-0x0000000000641000-memory.dmp

      Filesize

      4KB

    • memory/2384-119-0x0000000000000000-mapping.dmp

    • memory/2928-114-0x0000000000000000-mapping.dmp

    • memory/3460-121-0x0000000000000000-mapping.dmp

    • memory/4084-115-0x0000000000000000-mapping.dmp

    • memory/4084-125-0x0000000002790000-0x0000000002791000-memory.dmp

      Filesize

      4KB