Overview

overview

10

Static

static

6c592736cf...bd.exe

windows7_x64

10

6c592736cf...bd.exe

windows10_x64

10

Analysis

  • max time kernel
    150s
  • max time network
    151s
  • platform
    windows7_x64
  • resource
    win7v20210410
  • submitted
    19/07/2021, 21:25

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    6c592736cf6ae24c1d7e5d051234fdbd.exe
  • Size 1.1MB
  • Sample210719-n5t5cs4fcs
  • SHA256 846d82f6f9d6b965ef683cd91724d72917263cf21e9f0f7e4ed2cb4f1ceacce8
  • MD5 SHA1 SHA512
Score
10/10
darkcometnjratggnyan catevasionpersistencerattrojan

Malware Config

Extracted

Family

  • darkcomet

Botnet

  • GG

C2

  • secret92.ddns.net:82

Mutex

  • DC_MUTEX-A6ET8RQ

Attributes
  • InstallPath

    MSDCSC\msdcsc.exe

  • gencode

    oqyLUmi211Cb

  • install

    true

  • offline_keylogger

    true

  • persistence

    true

  • reg_key

    MicroUpdate

Extracted

Family

  • njrat

Version

  • 0.7NC

Botnet

  • NYAN CAT

C2

  • secret92.ddns.net:8082

Mutex

  • 0c3398f1458

Attributes
  • reg_key

    0c3398f1458

  • splitter

    @!#&^%$

Signatures

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

    trojanratdarkcomet
  • Modifies WinLogon for persistence 2 TTPs 1 IoCs
    persistence
  • Modifies security service 2 TTPs 1 IoCs
    evasion
  • Windows security bypass 2 TTPs
    evasiontrojan
  • njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat
  • Executes dropped EXE 4 IoCs
  • Sets file to hidden 1 TTPs

    Modifies file attributes to stop it showing in Explorer etc.

    evasion
  • Loads dropped DLL 8 IoCs
  • Windows security modification 2 TTPs 2 IoCs
    evasiontrojan
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Modifies Internet Explorer settings 1 TTPs 64 IoCs
    adwarespyware
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 5 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • System policy modification 1 TTPs 3 IoCs
    evasion
  • Views/modifies file attributes 1 TTPs 2 IoCs
    evasion

Processes

  • C:\Users\Admin\AppData\Local\Temp\6c592736cf6ae24c1d7e5d051234fdbd.exe
    "C:\Users\Admin\AppData\Local\Temp\6c592736cf6ae24c1d7e5d051234fdbd.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:1088
    • C:\Users\Admin\AppData\Local\Temp\darknj.exe
      "C:\Users\Admin\AppData\Local\Temp\darknj.exe"
      2⤵
      • Modifies WinLogon for persistence
      • Executes dropped EXE
      • Loads dropped DLL
      • Adds Run key to start application
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2028
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp\darknj.exe" +s +h
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:1972
        • C:\Windows\SysWOW64\attrib.exe
          attrib "C:\Users\Admin\AppData\Local\Temp\darknj.exe" +s +h
          4⤵
          • Views/modifies file attributes
          PID:1828
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp" +s +h
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:1772
        • C:\Windows\SysWOW64\attrib.exe
          attrib "C:\Users\Admin\AppData\Local\Temp" +s +h
          4⤵
          • Views/modifies file attributes
          PID:1728
      • C:\Users\Admin\AppData\Local\Temp\NJ.EXE
        "C:\Users\Admin\AppData\Local\Temp\NJ.EXE"
        3⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        PID:1792
      • C:\Windows\SysWOW64\notepad.exe
        notepad
        3⤵
          PID:1420
        • C:\ProgramData\Microsoft\Windows\Start Menu\MSDCSC\msdcsc.exe
          "C:\ProgramData\Microsoft\Windows\Start Menu\MSDCSC\msdcsc.exe"
          3⤵
          • Modifies security service
          • Executes dropped EXE
          • Windows security modification
          • Adds Run key to start application
          • Suspicious behavior: GetForegroundWindowSpam
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          • System policy modification
          PID:1536
          • C:\Windows\SysWOW64\notepad.exe
            notepad
            4⤵
              PID:740
        • C:\Users\Admin\AppData\Local\Temp\R-Launcher.exe
          "C:\Users\Admin\AppData\Local\Temp\R-Launcher.exe"
          2⤵
          • Executes dropped EXE
          PID:1452
          • C:\Program Files\Internet Explorer\iexplore.exe
            "C:\Program Files\Internet Explorer\iexplore.exe" http://java.com/download
            3⤵
            • Modifies Internet Explorer settings
            • Suspicious use of FindShellTrayWindow
            • Suspicious use of SetWindowsHookEx
            PID:1184
            • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
              "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1184 CREDAT:275457 /prefetch:2
              4⤵
              • Modifies Internet Explorer settings
              • Suspicious use of SetWindowsHookEx
              PID:1160

      Network

            MITRE ATT&CK Enterprise v6

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            memory/740-95-0x0000000000200000-0x0000000000201000-memory.dmp
            Download

            memory/1088-59-0x00000000753B1000-0x00000000753B3000-memory.dmp
            Download

            memory/1160-99-0x0000000000460000-0x0000000000462000-memory.dmp
            Download

            memory/1420-86-0x0000000000190000-0x0000000000191000-memory.dmp
            Download

            memory/1536-94-0x00000000003C0000-0x00000000003C1000-memory.dmp
            Download

            memory/1792-85-0x0000000000260000-0x0000000000261000-memory.dmp
            Download

            memory/2028-72-0x0000000000240000-0x0000000000241000-memory.dmp
            Download