Analysis

  • max time kernel
    149s
  • max time network
    154s
  • platform
    windows7_x64
  • resource
    win7-20220901-en
  • resource tags

    arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
  • submitted
    19/10/2022, 13:08

General

  • Target

    4d4ca606e35160ef23c9a396bc1758fbcddd0e56f94d4b2c0ba41d70d9e5740f.exe

  • Size

    952KB

  • MD5

    922f4b905a3be7b8d48ad90f72673050

  • SHA1

    ea6c6fee64a8c52b711ea0d2bc4070674c8f9b8a

  • SHA256

    4d4ca606e35160ef23c9a396bc1758fbcddd0e56f94d4b2c0ba41d70d9e5740f

  • SHA512

    fa85db160ae4c628466cee3333f2698854f3c7cbe8f053ac30ec7b4c61f223b0833da12ae5704c3fdb6d745b5143c0742b0b87ac9acd8fad1de4521429cac9d3

  • SSDEEP

    12288:byyy7Z3z4I8NXOGjwwG/ZjXsAHHz79p9NM5Tz103j2CF4TxQUOfhVPOSAE//VAci:baCI2OewFJN4mkxyHnnew1SatLRzD

Malware Config

Extracted

Family

darkcomet

Botnet

010

C2

shades.no-ip.org:1604

Mutex

DC_MUTEX-DA5KEY9

Attributes
  • gencode

    vdj7j58DDDAn

  • install

    false

  • offline_keylogger

    true

  • persistence

    false

Signatures

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

  • Executes dropped EXE 3 IoCs
  • UPX packed file 8 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Loads dropped DLL 5 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • Suspicious use of SetThreadContext 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of SetWindowsHookEx 5 IoCs
  • Suspicious use of WriteProcessMemory 41 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\4d4ca606e35160ef23c9a396bc1758fbcddd0e56f94d4b2c0ba41d70d9e5740f.exe
    "C:\Users\Admin\AppData\Local\Temp\4d4ca606e35160ef23c9a396bc1758fbcddd0e56f94d4b2c0ba41d70d9e5740f.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1740
    • C:\Users\Admin\AppData\Local\Temp\4d4ca606e35160ef23c9a396bc1758fbcddd0e56f94d4b2c0ba41d70d9e5740f.exe
      "C:\Users\Admin\AppData\Local\Temp\4d4ca606e35160ef23c9a396bc1758fbcddd0e56f94d4b2c0ba41d70d9e5740f.exe"
      2⤵
      • Loads dropped DLL
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:1200
      • C:\Windows\SysWOW64\cmd.exe
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\ITYVJ.bat" "
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:536
        • C:\Windows\SysWOW64\reg.exe
          REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "msoffice" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\MicrosoftOffice\micoffice.exe" /f
          4⤵
          • Adds Run key to start application
          PID:572
      • C:\Users\Admin\AppData\Roaming\MicrosoftOffice\micoffice.exe
        "C:\Users\Admin\AppData\Roaming\MicrosoftOffice\micoffice.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:884
        • C:\Users\Admin\AppData\Roaming\MicrosoftOffice\micoffice.exe
          "C:\Users\Admin\AppData\Roaming\MicrosoftOffice\micoffice.exe"
          4⤵
          • Executes dropped EXE
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of SetWindowsHookEx
          PID:1644
        • C:\Users\Admin\AppData\Roaming\MicrosoftOffice\micoffice.exe
          "C:\Users\Admin\AppData\Roaming\MicrosoftOffice\micoffice.exe"
          4⤵
          • Executes dropped EXE
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of SetWindowsHookEx
          PID:920

Network

        MITRE ATT&CK Enterprise v6

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Temp\ITYVJ.bat

          Filesize

          155B

          MD5

          f07b93136766adced3c6f0d74d869da0

          SHA1

          787c530f33687d758b41295e01d7a9a1bba3a467

          SHA256

          cd603067047c028fe12d4b099d13b3681dd698d25bc32474184e9d8edd3ed701

          SHA512

          050105a5f14939a37f653421b24959cc90cb082b20df5bb1a81335fd0ad5e70c740b43f1d6df0fc7324551425894668acc3af0c533c7d90ff149d84e844c2d10

        • C:\Users\Admin\AppData\Roaming\MicrosoftOffice\micoffice.exe

          Filesize

          952KB

          MD5

          b0854ce2dd390e7824e0cf92df73923e

          SHA1

          257a4de4f2c89e000bc8211158d5e96ddd70acff

          SHA256

          6137b32220d18ad7b2a1edd568f1697022687cc40c40c32945d41acb2286d381

          SHA512

          4118fdd3da61b38629331600cec3643c395b9d4d41d553e00a6a6777632ec4368df49c6db8233b97b0430cc00a220323197c17903e5470be17bf6d1e19e9e555

        • C:\Users\Admin\AppData\Roaming\MicrosoftOffice\micoffice.exe

          Filesize

          952KB

          MD5

          b0854ce2dd390e7824e0cf92df73923e

          SHA1

          257a4de4f2c89e000bc8211158d5e96ddd70acff

          SHA256

          6137b32220d18ad7b2a1edd568f1697022687cc40c40c32945d41acb2286d381

          SHA512

          4118fdd3da61b38629331600cec3643c395b9d4d41d553e00a6a6777632ec4368df49c6db8233b97b0430cc00a220323197c17903e5470be17bf6d1e19e9e555

        • C:\Users\Admin\AppData\Roaming\MicrosoftOffice\micoffice.exe

          Filesize

          952KB

          MD5

          b0854ce2dd390e7824e0cf92df73923e

          SHA1

          257a4de4f2c89e000bc8211158d5e96ddd70acff

          SHA256

          6137b32220d18ad7b2a1edd568f1697022687cc40c40c32945d41acb2286d381

          SHA512

          4118fdd3da61b38629331600cec3643c395b9d4d41d553e00a6a6777632ec4368df49c6db8233b97b0430cc00a220323197c17903e5470be17bf6d1e19e9e555

        • C:\Users\Admin\AppData\Roaming\MicrosoftOffice\micoffice.exe

          Filesize

          952KB

          MD5

          b0854ce2dd390e7824e0cf92df73923e

          SHA1

          257a4de4f2c89e000bc8211158d5e96ddd70acff

          SHA256

          6137b32220d18ad7b2a1edd568f1697022687cc40c40c32945d41acb2286d381

          SHA512

          4118fdd3da61b38629331600cec3643c395b9d4d41d553e00a6a6777632ec4368df49c6db8233b97b0430cc00a220323197c17903e5470be17bf6d1e19e9e555

        • \Users\Admin\AppData\Roaming\MicrosoftOffice\micoffice.exe

          Filesize

          952KB

          MD5

          b0854ce2dd390e7824e0cf92df73923e

          SHA1

          257a4de4f2c89e000bc8211158d5e96ddd70acff

          SHA256

          6137b32220d18ad7b2a1edd568f1697022687cc40c40c32945d41acb2286d381

          SHA512

          4118fdd3da61b38629331600cec3643c395b9d4d41d553e00a6a6777632ec4368df49c6db8233b97b0430cc00a220323197c17903e5470be17bf6d1e19e9e555

        • \Users\Admin\AppData\Roaming\MicrosoftOffice\micoffice.exe

          Filesize

          952KB

          MD5

          b0854ce2dd390e7824e0cf92df73923e

          SHA1

          257a4de4f2c89e000bc8211158d5e96ddd70acff

          SHA256

          6137b32220d18ad7b2a1edd568f1697022687cc40c40c32945d41acb2286d381

          SHA512

          4118fdd3da61b38629331600cec3643c395b9d4d41d553e00a6a6777632ec4368df49c6db8233b97b0430cc00a220323197c17903e5470be17bf6d1e19e9e555

        • \Users\Admin\AppData\Roaming\MicrosoftOffice\micoffice.exe

          Filesize

          952KB

          MD5

          b0854ce2dd390e7824e0cf92df73923e

          SHA1

          257a4de4f2c89e000bc8211158d5e96ddd70acff

          SHA256

          6137b32220d18ad7b2a1edd568f1697022687cc40c40c32945d41acb2286d381

          SHA512

          4118fdd3da61b38629331600cec3643c395b9d4d41d553e00a6a6777632ec4368df49c6db8233b97b0430cc00a220323197c17903e5470be17bf6d1e19e9e555

        • \Users\Admin\AppData\Roaming\MicrosoftOffice\micoffice.exe

          Filesize

          952KB

          MD5

          b0854ce2dd390e7824e0cf92df73923e

          SHA1

          257a4de4f2c89e000bc8211158d5e96ddd70acff

          SHA256

          6137b32220d18ad7b2a1edd568f1697022687cc40c40c32945d41acb2286d381

          SHA512

          4118fdd3da61b38629331600cec3643c395b9d4d41d553e00a6a6777632ec4368df49c6db8233b97b0430cc00a220323197c17903e5470be17bf6d1e19e9e555

        • \Users\Admin\AppData\Roaming\MicrosoftOffice\micoffice.exe

          Filesize

          952KB

          MD5

          b0854ce2dd390e7824e0cf92df73923e

          SHA1

          257a4de4f2c89e000bc8211158d5e96ddd70acff

          SHA256

          6137b32220d18ad7b2a1edd568f1697022687cc40c40c32945d41acb2286d381

          SHA512

          4118fdd3da61b38629331600cec3643c395b9d4d41d553e00a6a6777632ec4368df49c6db8233b97b0430cc00a220323197c17903e5470be17bf6d1e19e9e555

        • memory/884-83-0x0000000002ED0000-0x0000000002FA8000-memory.dmp

          Filesize

          864KB

        • memory/920-112-0x0000000000400000-0x00000000004B2000-memory.dmp

          Filesize

          712KB

        • memory/920-110-0x0000000000400000-0x00000000004B2000-memory.dmp

          Filesize

          712KB

        • memory/920-118-0x0000000000400000-0x00000000004B2000-memory.dmp

          Filesize

          712KB

        • memory/920-116-0x0000000000400000-0x00000000004B2000-memory.dmp

          Filesize

          712KB

        • memory/920-122-0x0000000000400000-0x00000000004B2000-memory.dmp

          Filesize

          712KB

        • memory/920-105-0x0000000000400000-0x00000000004B2000-memory.dmp

          Filesize

          712KB

        • memory/920-119-0x0000000000400000-0x00000000004B2000-memory.dmp

          Filesize

          712KB

        • memory/920-108-0x0000000000400000-0x00000000004B2000-memory.dmp

          Filesize

          712KB

        • memory/920-96-0x0000000000400000-0x00000000004B2000-memory.dmp

          Filesize

          712KB

        • memory/920-107-0x0000000000400000-0x00000000004B2000-memory.dmp

          Filesize

          712KB

        • memory/920-94-0x0000000000400000-0x00000000004B2000-memory.dmp

          Filesize

          712KB

        • memory/920-100-0x0000000000400000-0x00000000004B2000-memory.dmp

          Filesize

          712KB

        • memory/920-103-0x0000000000400000-0x00000000004B2000-memory.dmp

          Filesize

          712KB

        • memory/1200-58-0x0000000000400000-0x000000000040B000-memory.dmp

          Filesize

          44KB

        • memory/1200-59-0x0000000000400000-0x000000000040B000-memory.dmp

          Filesize

          44KB

        • memory/1200-61-0x0000000000400000-0x000000000040B000-memory.dmp

          Filesize

          44KB

        • memory/1200-62-0x0000000000400000-0x000000000040B000-memory.dmp

          Filesize

          44KB

        • memory/1200-70-0x0000000075931000-0x0000000075933000-memory.dmp

          Filesize

          8KB

        • memory/1200-115-0x0000000000400000-0x000000000040B000-memory.dmp

          Filesize

          44KB

        • memory/1200-65-0x0000000000400000-0x000000000040B000-memory.dmp

          Filesize

          44KB

        • memory/1200-66-0x0000000000400000-0x000000000040B000-memory.dmp

          Filesize

          44KB

        • memory/1200-69-0x0000000000400000-0x000000000040B000-memory.dmp

          Filesize

          44KB

        • memory/1644-121-0x0000000000400000-0x000000000040B000-memory.dmp

          Filesize

          44KB

        • memory/1740-56-0x0000000002E00000-0x0000000002ED8000-memory.dmp

          Filesize

          864KB