Analysis

  • max time kernel
    151s
  • max time network
    46s
  • platform
    windows7_x64
  • resource
    win7-20220414-en
  • submitted
    02-05-2022 03:44

General

  • Target

    5c49e614b6fa16befe88fbbac9a6c42f2615db6b842de7b7dce9bcb32f928239.exe

  • Size

    1MB

  • MD5

    03eded5108ae1519bdb97a27dfac2ff0

  • SHA1

    b6a6aa3e1d66b0b774573c0b522947912091d36d

  • SHA256

    5c49e614b6fa16befe88fbbac9a6c42f2615db6b842de7b7dce9bcb32f928239

  • SHA512

    bef373872833ba3a650accfa79730c1ba98c6bd23e5773a9955833836385c6488ec4326e915b5534085c08bde407073c3e9bc0e888cd5c46e287ea91281d8d3f

Malware Config

Extracted

Family

darkcomet

Botnet

1

C2

anthraxgold.no-ip.info:666

Attributes
gencode
M6QvjZgri1v2
install
false
offline_keylogger
false
persistence
false

Signatures

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

  • Executes dropped EXE ⋅ 3 IoCs
  • UPX packed file ⋅ 14 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Loads dropped DLL ⋅ 5 IoCs
  • Adds Run key to start application ⋅ 2 TTPs 2 IoCs
  • Suspicious use of SetThreadContext ⋅ 3 IoCs
  • Enumerates physical storage devices ⋅ 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious use of AdjustPrivilegeToken ⋅ 64 IoCs
  • Suspicious use of SetWindowsHookEx ⋅ 4 IoCs
  • Suspicious use of WriteProcessMemory ⋅ 36 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\5c49e614b6fa16befe88fbbac9a6c42f2615db6b842de7b7dce9bcb32f928239.exe
    "C:\Users\Admin\AppData\Local\Temp\5c49e614b6fa16befe88fbbac9a6c42f2615db6b842de7b7dce9bcb32f928239.exe"
    Suspicious use of SetThreadContext
    Suspicious use of SetWindowsHookEx
    Suspicious use of WriteProcessMemory
    PID:960
    • C:\Users\Admin\AppData\Local\Temp\5c49e614b6fa16befe88fbbac9a6c42f2615db6b842de7b7dce9bcb32f928239.exe
      "C:\Users\Admin\AppData\Local\Temp\5c49e614b6fa16befe88fbbac9a6c42f2615db6b842de7b7dce9bcb32f928239.exe"
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:1640
      • C:\Windows\SysWOW64\cmd.exe
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\OAIRY.bat" "
        Suspicious use of WriteProcessMemory
        PID:1396
        • C:\Windows\SysWOW64\reg.exe
          REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "svchost" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\test\test.exe" /f
          Adds Run key to start application
          PID:1896
      • C:\Users\Admin\AppData\Roaming\test\test.exe
        "C:\Users\Admin\AppData\Roaming\test\test.exe"
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        PID:1764
        • C:\Users\Admin\AppData\Roaming\test\test.exe
          "C:\Users\Admin\AppData\Roaming\test\test.exe"
          Executes dropped EXE
          Suspicious use of AdjustPrivilegeToken
          Suspicious use of SetWindowsHookEx
          PID:2004
        • C:\Users\Admin\AppData\Roaming\test\test.exe
          "C:\Users\Admin\AppData\Roaming\test\test.exe"
          Executes dropped EXE
          Suspicious use of AdjustPrivilegeToken
          PID:1436

Network

MITRE ATT&CK Matrix

Collection

    Command and Control

      Credential Access

        Defense Evasion

        Execution

          Exfiltration

            Impact

              Initial Access

                Lateral Movement

                  Privilege Escalation

                    Replay Monitor

                    00:00 00:00

                    Downloads

                    • C:\Users\Admin\AppData\Local\Temp\OAIRY.bat
                      MD5

                      527683c48cc4c7190219814c77b72fe0

                      SHA1

                      d995878a8f4b9824a0508039eeada5376be9a52d

                      SHA256

                      bbebf3e66136e700d8e3e2e0c8f461cdd9d7e68fe5a18a235afe86344932fb4b

                      SHA512

                      408a53b240c23fa34153ccc2b2315f28a9741121ecc9b76d50267ee62d78230e65574327369f83c779c781802c0c28f6c578703c01a67de46c3d44f71b814fa6

                    • C:\Users\Admin\AppData\Roaming\test\test.exe
                      MD5

                      827b4f3af186a6eefc4b74b9aececc4b

                      SHA1

                      666a94170291377a6f69b4ad9b0b364f76e8db6c

                      SHA256

                      6fcde23c73209eed95d44fbc6d33903c7a25f888394b3cde86a6d104b3914576

                      SHA512

                      19dc99322e1d9b205b731f66f1f0355682c708043fcc4ec28580631bc33899130c7389fe85893f46a3eb22d1e739c4dc042299e64dc216b9efd1d185e3407a2f

                    • C:\Users\Admin\AppData\Roaming\test\test.exe
                      MD5

                      827b4f3af186a6eefc4b74b9aececc4b

                      SHA1

                      666a94170291377a6f69b4ad9b0b364f76e8db6c

                      SHA256

                      6fcde23c73209eed95d44fbc6d33903c7a25f888394b3cde86a6d104b3914576

                      SHA512

                      19dc99322e1d9b205b731f66f1f0355682c708043fcc4ec28580631bc33899130c7389fe85893f46a3eb22d1e739c4dc042299e64dc216b9efd1d185e3407a2f

                    • C:\Users\Admin\AppData\Roaming\test\test.exe
                      MD5

                      827b4f3af186a6eefc4b74b9aececc4b

                      SHA1

                      666a94170291377a6f69b4ad9b0b364f76e8db6c

                      SHA256

                      6fcde23c73209eed95d44fbc6d33903c7a25f888394b3cde86a6d104b3914576

                      SHA512

                      19dc99322e1d9b205b731f66f1f0355682c708043fcc4ec28580631bc33899130c7389fe85893f46a3eb22d1e739c4dc042299e64dc216b9efd1d185e3407a2f

                    • C:\Users\Admin\AppData\Roaming\test\test.exe
                      MD5

                      827b4f3af186a6eefc4b74b9aececc4b

                      SHA1

                      666a94170291377a6f69b4ad9b0b364f76e8db6c

                      SHA256

                      6fcde23c73209eed95d44fbc6d33903c7a25f888394b3cde86a6d104b3914576

                      SHA512

                      19dc99322e1d9b205b731f66f1f0355682c708043fcc4ec28580631bc33899130c7389fe85893f46a3eb22d1e739c4dc042299e64dc216b9efd1d185e3407a2f

                    • \Users\Admin\AppData\Roaming\test\test.exe
                      MD5

                      827b4f3af186a6eefc4b74b9aececc4b

                      SHA1

                      666a94170291377a6f69b4ad9b0b364f76e8db6c

                      SHA256

                      6fcde23c73209eed95d44fbc6d33903c7a25f888394b3cde86a6d104b3914576

                      SHA512

                      19dc99322e1d9b205b731f66f1f0355682c708043fcc4ec28580631bc33899130c7389fe85893f46a3eb22d1e739c4dc042299e64dc216b9efd1d185e3407a2f

                    • \Users\Admin\AppData\Roaming\test\test.exe
                      MD5

                      827b4f3af186a6eefc4b74b9aececc4b

                      SHA1

                      666a94170291377a6f69b4ad9b0b364f76e8db6c

                      SHA256

                      6fcde23c73209eed95d44fbc6d33903c7a25f888394b3cde86a6d104b3914576

                      SHA512

                      19dc99322e1d9b205b731f66f1f0355682c708043fcc4ec28580631bc33899130c7389fe85893f46a3eb22d1e739c4dc042299e64dc216b9efd1d185e3407a2f

                    • \Users\Admin\AppData\Roaming\test\test.exe
                      MD5

                      827b4f3af186a6eefc4b74b9aececc4b

                      SHA1

                      666a94170291377a6f69b4ad9b0b364f76e8db6c

                      SHA256

                      6fcde23c73209eed95d44fbc6d33903c7a25f888394b3cde86a6d104b3914576

                      SHA512

                      19dc99322e1d9b205b731f66f1f0355682c708043fcc4ec28580631bc33899130c7389fe85893f46a3eb22d1e739c4dc042299e64dc216b9efd1d185e3407a2f

                    • \Users\Admin\AppData\Roaming\test\test.exe
                      MD5

                      827b4f3af186a6eefc4b74b9aececc4b

                      SHA1

                      666a94170291377a6f69b4ad9b0b364f76e8db6c

                      SHA256

                      6fcde23c73209eed95d44fbc6d33903c7a25f888394b3cde86a6d104b3914576

                      SHA512

                      19dc99322e1d9b205b731f66f1f0355682c708043fcc4ec28580631bc33899130c7389fe85893f46a3eb22d1e739c4dc042299e64dc216b9efd1d185e3407a2f

                    • \Users\Admin\AppData\Roaming\test\test.exe
                      MD5

                      827b4f3af186a6eefc4b74b9aececc4b

                      SHA1

                      666a94170291377a6f69b4ad9b0b364f76e8db6c

                      SHA256

                      6fcde23c73209eed95d44fbc6d33903c7a25f888394b3cde86a6d104b3914576

                      SHA512

                      19dc99322e1d9b205b731f66f1f0355682c708043fcc4ec28580631bc33899130c7389fe85893f46a3eb22d1e739c4dc042299e64dc216b9efd1d185e3407a2f

                    • memory/960-61-0x0000000000401000-0x0000000000546000-memory.dmp
                    • memory/960-54-0x0000000000400000-0x000000000054B000-memory.dmp
                    • memory/960-63-0x0000000000401000-0x0000000000546000-memory.dmp
                    • memory/960-64-0x0000000000401000-0x0000000000546000-memory.dmp
                    • memory/960-60-0x0000000000401000-0x0000000000546000-memory.dmp
                    • memory/960-62-0x0000000000401000-0x0000000000546000-memory.dmp
                    • memory/960-57-0x0000000000401000-0x0000000000546000-memory.dmp
                    • memory/960-58-0x0000000000401000-0x0000000000546000-memory.dmp
                    • memory/1396-78-0x0000000000000000-mapping.dmp
                    • memory/1436-108-0x0000000000400000-0x00000000004B7000-memory.dmp
                    • memory/1436-110-0x0000000000400000-0x00000000004B7000-memory.dmp
                    • memory/1436-125-0x0000000000400000-0x00000000004B7000-memory.dmp
                    • memory/1436-123-0x0000000000400000-0x00000000004B7000-memory.dmp
                    • memory/1436-122-0x0000000000400000-0x00000000004B7000-memory.dmp
                    • memory/1436-119-0x0000000000400000-0x00000000004B7000-memory.dmp
                    • memory/1436-116-0x00000000004B5640-mapping.dmp
                    • memory/1436-115-0x0000000000400000-0x00000000004B7000-memory.dmp
                    • memory/1436-114-0x0000000000400000-0x00000000004B7000-memory.dmp
                    • memory/1640-65-0x0000000000400000-0x000000000040B000-memory.dmp
                    • memory/1640-68-0x0000000000400000-0x000000000040B000-memory.dmp
                    • memory/1640-66-0x0000000000400000-0x000000000040B000-memory.dmp
                    • memory/1640-69-0x0000000000400000-0x000000000040B000-memory.dmp
                    • memory/1640-70-0x00000000004085D0-mapping.dmp
                    • memory/1640-72-0x0000000000400000-0x000000000040B000-memory.dmp
                    • memory/1640-73-0x0000000000400000-0x000000000040B000-memory.dmp
                    • memory/1640-76-0x0000000000400000-0x000000000040B000-memory.dmp
                    • memory/1640-77-0x0000000074DC1000-0x0000000074DC3000-memory.dmp
                    • memory/1764-86-0x0000000000000000-mapping.dmp
                    • memory/1896-80-0x0000000000000000-mapping.dmp
                    • memory/2004-105-0x00000000004085D0-mapping.dmp
                    • memory/2004-121-0x0000000000400000-0x000000000040B000-memory.dmp