Analysis

  • max time kernel
    159s
  • max time network
    162s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    11/10/2022, 04:46

General

  • Target

    0fefa5c1b5bf7e238b720169c5660d2ba562c9515c9f462ce08b167e827e608c.exe

  • Size

    349KB

  • MD5

    40631aa681889da86bee90b134293cc0

  • SHA1

    288b2188dc84ff3169c77b9a6ba5b08dc2686a7a

  • SHA256

    0fefa5c1b5bf7e238b720169c5660d2ba562c9515c9f462ce08b167e827e608c

  • SHA512

    e927abe0b7d18917b2a42f919880f27897d421d1d0b08cff4ae6287679c9405522065b0a7869de1e3439e4bd8d4d5e7cff6ddd0b5f6a00b7163f4bfa19fbe328

  • SSDEEP

    6144:iqLzGyzpKalLBQmByDu0waBX3o0dkkfipENy6jvV39qggrQOXq+ZDCsTz:xphltQI0wqo0dRfFyCjuhXqAx

Malware Config

Extracted

Family

darkcomet

Botnet

Guest16

C2

127.0.0.1:1604

Mutex

DC_MUTEX-PBR5DBT

Attributes
  • gencode

    UhKXsb3TmV1L

  • install

    false

  • offline_keylogger

    true

  • password

    0123456789

  • persistence

    false

Signatures

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

  • UPX packed file 7 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious use of AdjustPrivilegeToken 24 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\0fefa5c1b5bf7e238b720169c5660d2ba562c9515c9f462ce08b167e827e608c.exe
    "C:\Users\Admin\AppData\Local\Temp\0fefa5c1b5bf7e238b720169c5660d2ba562c9515c9f462ce08b167e827e608c.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:4444
    • C:\Users\Admin\AppData\Local\Temp\0fefa5c1b5bf7e238b720169c5660d2ba562c9515c9f462ce08b167e827e608c.exe
      C:\Users\Admin\AppData\Local\Temp\0fefa5c1b5bf7e238b720169c5660d2ba562c9515c9f462ce08b167e827e608c.exe
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      PID:4968

Network

        MITRE ATT&CK Enterprise v6

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • memory/4444-132-0x0000000002200000-0x0000000002204000-memory.dmp

          Filesize

          16KB

        • memory/4968-134-0x0000000000400000-0x00000000004B7000-memory.dmp

          Filesize

          732KB

        • memory/4968-135-0x0000000000400000-0x00000000004B7000-memory.dmp

          Filesize

          732KB

        • memory/4968-136-0x0000000000400000-0x00000000004B7000-memory.dmp

          Filesize

          732KB

        • memory/4968-137-0x0000000000400000-0x00000000004B7000-memory.dmp

          Filesize

          732KB

        • memory/4968-138-0x0000000000400000-0x00000000004B7000-memory.dmp

          Filesize

          732KB

        • memory/4968-139-0x0000000000400000-0x00000000004B7000-memory.dmp

          Filesize

          732KB

        • memory/4968-140-0x0000000000400000-0x00000000004B7000-memory.dmp

          Filesize

          732KB