Overview
overview
10Static
static
10DARKCOMET ...ty.exe
windows7-x64
1DARKCOMET ...ty.exe
windows10-2004-x64
1DARKCOMET ...at.exe
windows7-x64
10DARKCOMET ...at.exe
windows10-2004-x64
10DARKCOMET ...er.exe
windows7-x64
1DARKCOMET ...er.exe
windows10-2004-x64
1DARKCOMET ...e3.dll
windows7-x64
3DARKCOMET ...e3.dll
windows10-2004-x64
3DARKCOMET ...er.dll
windows7-x64
1DARKCOMET ...er.dll
windows10-2004-x64
1Analysis
-
max time kernel
41s -
max time network
50s -
platform
windows7_x64 -
resource
win7-20220715-en -
resource tags
arch:x64arch:x86image:win7-20220715-enlocale:en-usos:windows7-x64system -
submitted
19-07-2022 09:43
Behavioral task
behavioral1
Sample
DARKCOMET 5.3.1 Fixed/DARKCOMET 5.3.1/Celesty Binder/Celesty.exe
Resource
win7-20220718-en
Behavioral task
behavioral2
Sample
DARKCOMET 5.3.1 Fixed/DARKCOMET 5.3.1/Celesty Binder/Celesty.exe
Resource
win10v2004-20220718-en
Behavioral task
behavioral3
Sample
DARKCOMET 5.3.1 Fixed/DARKCOMET 5.3.1/DarkCometRat.exe
Resource
win7-20220718-en
Behavioral task
behavioral4
Sample
DARKCOMET 5.3.1 Fixed/DARKCOMET 5.3.1/DarkCometRat.exe
Resource
win10v2004-20220718-en
Behavioral task
behavioral5
Sample
DARKCOMET 5.3.1 Fixed/DARKCOMET 5.3.1/Spoof extensions/Spoofer.exe
Resource
win7-20220715-en
Behavioral task
behavioral6
Sample
DARKCOMET 5.3.1 Fixed/DARKCOMET 5.3.1/Spoof extensions/Spoofer.exe
Resource
win10v2004-20220414-en
Behavioral task
behavioral7
Sample
DARKCOMET 5.3.1 Fixed/DARKCOMET 5.3.1/sqlite3.dll
Resource
win7-20220715-en
Behavioral task
behavioral8
Sample
DARKCOMET 5.3.1 Fixed/DARKCOMET 5.3.1/sqlite3.dll
Resource
win10v2004-20220414-en
Behavioral task
behavioral9
Sample
DARKCOMET 5.3.1 Fixed/DARKCOMET 5.3.1/userfixer.dll
Resource
win7-20220715-en
Behavioral task
behavioral10
Sample
DARKCOMET 5.3.1 Fixed/DARKCOMET 5.3.1/userfixer.dll
Resource
win10v2004-20220718-en
General
-
Target
DARKCOMET 5.3.1 Fixed/DARKCOMET 5.3.1/sqlite3.dll
-
Size
510KB
-
MD5
d3979db259f55d59b4edb327673c1905
-
SHA1
0697e8f35b5951c61a3a632d74fd96843c941628
-
SHA256
043e5570299c6099756c1809c5632eabeab95ed3c1a55c86843c0ec218940e5a
-
SHA512
0b87c89aafd3e627c7d6bed0b833601fea1917a76a972061f32a2d9e4aa2e9e85b5e8a67cb330ca44aff17915d0fe2793798451a109d3f0b5014eed06b73bb45
Malware Config
Signatures
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 908 1384 WerFault.exe rundll32.exe -
Suspicious use of WriteProcessMemory 11 IoCs
Processes:
rundll32.exerundll32.exedescription pid process target process PID 904 wrote to memory of 1384 904 rundll32.exe rundll32.exe PID 904 wrote to memory of 1384 904 rundll32.exe rundll32.exe PID 904 wrote to memory of 1384 904 rundll32.exe rundll32.exe PID 904 wrote to memory of 1384 904 rundll32.exe rundll32.exe PID 904 wrote to memory of 1384 904 rundll32.exe rundll32.exe PID 904 wrote to memory of 1384 904 rundll32.exe rundll32.exe PID 904 wrote to memory of 1384 904 rundll32.exe rundll32.exe PID 1384 wrote to memory of 908 1384 rundll32.exe WerFault.exe PID 1384 wrote to memory of 908 1384 rundll32.exe WerFault.exe PID 1384 wrote to memory of 908 1384 rundll32.exe WerFault.exe PID 1384 wrote to memory of 908 1384 rundll32.exe WerFault.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\DARKCOMET 5.3.1 Fixed\DARKCOMET 5.3.1\sqlite3.dll",#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\DARKCOMET 5.3.1 Fixed\DARKCOMET 5.3.1\sqlite3.dll",#12⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1384 -s 2243⤵
- Program crash