Analysis

  • max time kernel
    151s
  • max time network
    175s
  • platform
    windows7_x64
  • resource
    win7-20220812-en
  • resource tags

    arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
  • submitted
    11/10/2022, 02:41

General

  • Target

    81d45690bdbea2b6c2b35878903e6ceaed8bf002a157c27d7b647c18a9e5d006.exe

  • Size

    728KB

  • MD5

    47a3a38c613fc7fe50379423838f42a0

  • SHA1

    baf35bd9625bec201df56e0859f6205f55fe480b

  • SHA256

    81d45690bdbea2b6c2b35878903e6ceaed8bf002a157c27d7b647c18a9e5d006

  • SHA512

    4efbfceaf33d19596173b0ec9ae2c8e5894182edf0366b4aa543cda9b4a957a4d36be897626668fbd2256f8f17045a355bb5067dfdd3297946ef53034798051f

  • SSDEEP

    12288:7iLERtSJj3culKz/LXzqCFeJ8eAQlfmO8hzrFsaCT6xwb2T99X//Mbt:71ij3cJzTXz/Ub8NYmxxTnX

Malware Config

Extracted

Family

darkcomet

Botnet

installs

C2

shine.redirectme.net:1604

Mutex

DCMIN_MUTEX-82NGH63

Attributes
  • gencode

    6yJTM4P9wAcU

  • install

    false

  • offline_keylogger

    true

  • persistence

    false

Signatures

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

  • Executes dropped EXE 2 IoCs
  • UPX packed file 9 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Loads dropped DLL 5 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • Suspicious use of SetThreadContext 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of SetWindowsHookEx 5 IoCs
  • Suspicious use of WriteProcessMemory 41 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\81d45690bdbea2b6c2b35878903e6ceaed8bf002a157c27d7b647c18a9e5d006.exe
    "C:\Users\Admin\AppData\Local\Temp\81d45690bdbea2b6c2b35878903e6ceaed8bf002a157c27d7b647c18a9e5d006.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1884
    • C:\Users\Admin\AppData\Local\Temp\81d45690bdbea2b6c2b35878903e6ceaed8bf002a157c27d7b647c18a9e5d006.exe
      "C:\Users\Admin\AppData\Local\Temp\81d45690bdbea2b6c2b35878903e6ceaed8bf002a157c27d7b647c18a9e5d006.exe"
      2⤵
      • Loads dropped DLL
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:1076
      • C:\Windows\SysWOW64\cmd.exe
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\DULJA.bat" "
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:1720
        • C:\Windows\SysWOW64\reg.exe
          REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "firefox udate.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\temp\firefox udate.exe" /f
          4⤵
          • Adds Run key to start application
          PID:340
      • C:\Users\Admin\AppData\Roaming\temp\firefox udate.exe
        "C:\Users\Admin\AppData\Roaming\temp\firefox udate.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:908
        • C:\Users\Admin\AppData\Roaming\temp\firefox udate.exe
          "C:\Users\Admin\AppData\Roaming\temp\firefox udate.exe"
          4⤵
          • Executes dropped EXE
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of SetWindowsHookEx
          PID:612
        • C:\Windows\SysWOW64\svchost.exe
          "C:\Windows\system32\svchost.exe"
          4⤵
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of SetWindowsHookEx
          PID:1072

Network

        MITRE ATT&CK Enterprise v6

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Temp\DULJA.bat

          Filesize

          157B

          MD5

          b03159f96ccac2ce831bdb56b8d4fa0f

          SHA1

          575391e3af00ffe0b31e5fafadb8b0d87609c94a

          SHA256

          c94041f2bd22f248f9bd175a089d9d8461af32add1fff5b8ce00816cce520d3c

          SHA512

          889199d3e641bfcc15b2be03781196736538e7407e03eaeba0393226efea09983be622858c8bbc6f17997358aa42cd71bb81c3b82387164a78205a553a899be4

        • C:\Users\Admin\AppData\Roaming\temp\firefox udate.exe

          Filesize

          728KB

          MD5

          181e2f86c874a3edcd82334b239dfc3d

          SHA1

          b40d7334ff53659877bcebc164b56a2e93e5e1e8

          SHA256

          abad3a9b5c922eb738ba46c9f8fcb33a6b27aa85aac22fa7477cc589f0342d53

          SHA512

          c2124baf957a55807c9bc248ea5cef7e5bbe17468e3d08a8f69e7275451811b5b54fe32f56bcb560b6fbfdaed3657666773a409897d992ffefbab35ebc72cdbd

        • C:\Users\Admin\AppData\Roaming\temp\firefox udate.exe

          Filesize

          728KB

          MD5

          181e2f86c874a3edcd82334b239dfc3d

          SHA1

          b40d7334ff53659877bcebc164b56a2e93e5e1e8

          SHA256

          abad3a9b5c922eb738ba46c9f8fcb33a6b27aa85aac22fa7477cc589f0342d53

          SHA512

          c2124baf957a55807c9bc248ea5cef7e5bbe17468e3d08a8f69e7275451811b5b54fe32f56bcb560b6fbfdaed3657666773a409897d992ffefbab35ebc72cdbd

        • C:\Users\Admin\AppData\Roaming\temp\firefox udate.exe

          Filesize

          728KB

          MD5

          181e2f86c874a3edcd82334b239dfc3d

          SHA1

          b40d7334ff53659877bcebc164b56a2e93e5e1e8

          SHA256

          abad3a9b5c922eb738ba46c9f8fcb33a6b27aa85aac22fa7477cc589f0342d53

          SHA512

          c2124baf957a55807c9bc248ea5cef7e5bbe17468e3d08a8f69e7275451811b5b54fe32f56bcb560b6fbfdaed3657666773a409897d992ffefbab35ebc72cdbd

        • \Users\Admin\AppData\Roaming\temp\firefox udate.exe

          Filesize

          728KB

          MD5

          181e2f86c874a3edcd82334b239dfc3d

          SHA1

          b40d7334ff53659877bcebc164b56a2e93e5e1e8

          SHA256

          abad3a9b5c922eb738ba46c9f8fcb33a6b27aa85aac22fa7477cc589f0342d53

          SHA512

          c2124baf957a55807c9bc248ea5cef7e5bbe17468e3d08a8f69e7275451811b5b54fe32f56bcb560b6fbfdaed3657666773a409897d992ffefbab35ebc72cdbd

        • \Users\Admin\AppData\Roaming\temp\firefox udate.exe

          Filesize

          728KB

          MD5

          181e2f86c874a3edcd82334b239dfc3d

          SHA1

          b40d7334ff53659877bcebc164b56a2e93e5e1e8

          SHA256

          abad3a9b5c922eb738ba46c9f8fcb33a6b27aa85aac22fa7477cc589f0342d53

          SHA512

          c2124baf957a55807c9bc248ea5cef7e5bbe17468e3d08a8f69e7275451811b5b54fe32f56bcb560b6fbfdaed3657666773a409897d992ffefbab35ebc72cdbd

        • \Users\Admin\AppData\Roaming\temp\firefox udate.exe

          Filesize

          728KB

          MD5

          181e2f86c874a3edcd82334b239dfc3d

          SHA1

          b40d7334ff53659877bcebc164b56a2e93e5e1e8

          SHA256

          abad3a9b5c922eb738ba46c9f8fcb33a6b27aa85aac22fa7477cc589f0342d53

          SHA512

          c2124baf957a55807c9bc248ea5cef7e5bbe17468e3d08a8f69e7275451811b5b54fe32f56bcb560b6fbfdaed3657666773a409897d992ffefbab35ebc72cdbd

        • \Users\Admin\AppData\Roaming\temp\firefox udate.exe

          Filesize

          728KB

          MD5

          181e2f86c874a3edcd82334b239dfc3d

          SHA1

          b40d7334ff53659877bcebc164b56a2e93e5e1e8

          SHA256

          abad3a9b5c922eb738ba46c9f8fcb33a6b27aa85aac22fa7477cc589f0342d53

          SHA512

          c2124baf957a55807c9bc248ea5cef7e5bbe17468e3d08a8f69e7275451811b5b54fe32f56bcb560b6fbfdaed3657666773a409897d992ffefbab35ebc72cdbd

        • \Users\Admin\AppData\Roaming\temp\firefox udate.exe

          Filesize

          728KB

          MD5

          181e2f86c874a3edcd82334b239dfc3d

          SHA1

          b40d7334ff53659877bcebc164b56a2e93e5e1e8

          SHA256

          abad3a9b5c922eb738ba46c9f8fcb33a6b27aa85aac22fa7477cc589f0342d53

          SHA512

          c2124baf957a55807c9bc248ea5cef7e5bbe17468e3d08a8f69e7275451811b5b54fe32f56bcb560b6fbfdaed3657666773a409897d992ffefbab35ebc72cdbd

        • memory/612-112-0x0000000000400000-0x000000000040B000-memory.dmp

          Filesize

          44KB

        • memory/612-125-0x0000000000400000-0x000000000040B000-memory.dmp

          Filesize

          44KB

        • memory/908-86-0x00000000026F0000-0x00000000027A7000-memory.dmp

          Filesize

          732KB

        • memory/1072-113-0x0000000000400000-0x00000000004B5000-memory.dmp

          Filesize

          724KB

        • memory/1072-126-0x0000000000400000-0x00000000004B5000-memory.dmp

          Filesize

          724KB

        • memory/1072-124-0x0000000000400000-0x00000000004B5000-memory.dmp

          Filesize

          724KB

        • memory/1072-122-0x0000000000400000-0x00000000004B5000-memory.dmp

          Filesize

          724KB

        • memory/1072-119-0x0000000000400000-0x00000000004B5000-memory.dmp

          Filesize

          724KB

        • memory/1072-117-0x0000000000400000-0x00000000004B5000-memory.dmp

          Filesize

          724KB

        • memory/1072-115-0x0000000000400000-0x00000000004B5000-memory.dmp

          Filesize

          724KB

        • memory/1072-111-0x0000000000400000-0x00000000004B5000-memory.dmp

          Filesize

          724KB

        • memory/1072-102-0x0000000000400000-0x00000000004B5000-memory.dmp

          Filesize

          724KB

        • memory/1072-103-0x0000000000400000-0x00000000004B5000-memory.dmp

          Filesize

          724KB

        • memory/1072-105-0x0000000000400000-0x00000000004B5000-memory.dmp

          Filesize

          724KB

        • memory/1072-107-0x0000000000400000-0x00000000004B5000-memory.dmp

          Filesize

          724KB

        • memory/1072-109-0x0000000000400000-0x00000000004B5000-memory.dmp

          Filesize

          724KB

        • memory/1076-61-0x0000000000400000-0x000000000040B000-memory.dmp

          Filesize

          44KB

        • memory/1076-63-0x0000000000400000-0x000000000040B000-memory.dmp

          Filesize

          44KB

        • memory/1076-64-0x0000000000400000-0x000000000040B000-memory.dmp

          Filesize

          44KB

        • memory/1076-67-0x0000000000400000-0x000000000040B000-memory.dmp

          Filesize

          44KB

        • memory/1076-120-0x0000000000400000-0x000000000040B000-memory.dmp

          Filesize

          44KB

        • memory/1076-68-0x0000000000400000-0x000000000040B000-memory.dmp

          Filesize

          44KB

        • memory/1076-71-0x0000000000400000-0x000000000040B000-memory.dmp

          Filesize

          44KB

        • memory/1076-60-0x0000000000400000-0x000000000040B000-memory.dmp

          Filesize

          44KB

        • memory/1076-72-0x0000000076321000-0x0000000076323000-memory.dmp

          Filesize

          8KB

        • memory/1884-56-0x0000000002950000-0x0000000002A07000-memory.dmp

          Filesize

          732KB