Analysis

  • max time kernel
    154s
  • max time network
    158s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    11/10/2022, 02:09

General

  • Target

    56f8552df348743efc54aec80d22a3a8f7571aae6b69de2c2b7bdda096f854a5.exe

  • Size

    732KB

  • MD5

    509cf818e25245ed925e677bf8710ef5

  • SHA1

    a2571877d819a338b856b06f01de819e89073fc8

  • SHA256

    56f8552df348743efc54aec80d22a3a8f7571aae6b69de2c2b7bdda096f854a5

  • SHA512

    1e5025fa907abd3e1822f6a61cdeadff15958e1cce3e800aa8c4a4dfd1344d29bae89731aa7e119906c0a03b1345986c2139c19f39b965c66f0c4cf69b8aec6c

  • SSDEEP

    12288:FpwABK90BOe/x9lPAYvxPQVjdsAY2XjWlnlpTMMXG91uhKIXn/FbZR:3wAcu99lPzvxP+Bsz2XjWTRMQckkIXnx

Score
10/10

Malware Config

Signatures

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

  • Checks BIOS information in registry 2 TTPs 2 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Suspicious use of SetThreadContext 1 IoCs
  • Checks processor information in registry 2 TTPs 8 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 48 IoCs
  • Suspicious use of WriteProcessMemory 5 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\56f8552df348743efc54aec80d22a3a8f7571aae6b69de2c2b7bdda096f854a5.exe
    "C:\Users\Admin\AppData\Local\Temp\56f8552df348743efc54aec80d22a3a8f7571aae6b69de2c2b7bdda096f854a5.exe"
    1⤵
    • Checks BIOS information in registry
    • Suspicious use of SetThreadContext
    • Checks processor information in registry
    • Enumerates system info in registry
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3292
    • C:\Windows\SysWOW64\explorer.exe
      "C:\Windows\SysWOW64\explorer.exe"
      2⤵
      • Checks BIOS information in registry
      • Checks processor information in registry
      • Enumerates system info in registry
      • Suspicious use of AdjustPrivilegeToken
      PID:4936

Network

        MITRE ATT&CK Enterprise v6

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • memory/4936-133-0x0000000000400000-0x00000000004C8000-memory.dmp

          Filesize

          800KB

        • memory/4936-134-0x0000000000400000-0x00000000004C8000-memory.dmp

          Filesize

          800KB

        • memory/4936-135-0x0000000000400000-0x00000000004C8000-memory.dmp

          Filesize

          800KB

        • memory/4936-136-0x0000000000400000-0x00000000004C8000-memory.dmp

          Filesize

          800KB

        • memory/4936-137-0x0000000000400000-0x00000000004C8000-memory.dmp

          Filesize

          800KB