Analysis

  • max time kernel
    150s
  • max time network
    150s
  • platform
    windows7_x64
  • resource
    win7-20220812-en
  • resource tags

    arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
  • submitted
    19/10/2022, 13:08

General

  • Target

    38fe0f23f3ceeca17a13a952f9b6b72b6e3dd64c42e67786732258f0cd35074f.exe

  • Size

    952KB

  • MD5

    81aede4eb24d420a6b7a2943786cf620

  • SHA1

    83ce725227bb89aefecf2e4c084d1b111bd78347

  • SHA256

    38fe0f23f3ceeca17a13a952f9b6b72b6e3dd64c42e67786732258f0cd35074f

  • SHA512

    71dac65caf8ad2c9fb195678776a90db44b58be4a58fceedf2d94953055cbd526a5e7c7dd829335e6c193ba9da31b491f18ee380ed9c130c7e15698f0f8498f1

  • SSDEEP

    12288:byyy7Z3z4I8NXOGjwwG/ZjXsAHHz79p9NM5Tz103j2CF4TxQUOfhVPOSAE//VAci:baCI2OewFJN4mkxyHnnew1SatLRzD

Malware Config

Extracted

Family

darkcomet

Botnet

010

C2

shades.no-ip.org:1604

Mutex

DC_MUTEX-DA5KEY9

Attributes
  • gencode

    vdj7j58DDDAn

  • install

    false

  • offline_keylogger

    true

  • persistence

    false

Signatures

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

  • Executes dropped EXE 3 IoCs
  • UPX packed file 8 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Loads dropped DLL 5 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • Suspicious use of SetThreadContext 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of SetWindowsHookEx 5 IoCs
  • Suspicious use of WriteProcessMemory 41 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\38fe0f23f3ceeca17a13a952f9b6b72b6e3dd64c42e67786732258f0cd35074f.exe
    "C:\Users\Admin\AppData\Local\Temp\38fe0f23f3ceeca17a13a952f9b6b72b6e3dd64c42e67786732258f0cd35074f.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1212
    • C:\Users\Admin\AppData\Local\Temp\38fe0f23f3ceeca17a13a952f9b6b72b6e3dd64c42e67786732258f0cd35074f.exe
      "C:\Users\Admin\AppData\Local\Temp\38fe0f23f3ceeca17a13a952f9b6b72b6e3dd64c42e67786732258f0cd35074f.exe"
      2⤵
      • Loads dropped DLL
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:1172
      • C:\Windows\SysWOW64\cmd.exe
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\XOLGV.bat" "
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:1704
        • C:\Windows\SysWOW64\reg.exe
          REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "msoffice" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\MicrosoftOffice\micoffice.exe" /f
          4⤵
          • Adds Run key to start application
          PID:1588
      • C:\Users\Admin\AppData\Roaming\MicrosoftOffice\micoffice.exe
        "C:\Users\Admin\AppData\Roaming\MicrosoftOffice\micoffice.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:1664
        • C:\Users\Admin\AppData\Roaming\MicrosoftOffice\micoffice.exe
          "C:\Users\Admin\AppData\Roaming\MicrosoftOffice\micoffice.exe"
          4⤵
          • Executes dropped EXE
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of SetWindowsHookEx
          PID:1768
        • C:\Users\Admin\AppData\Roaming\MicrosoftOffice\micoffice.exe
          "C:\Users\Admin\AppData\Roaming\MicrosoftOffice\micoffice.exe"
          4⤵
          • Executes dropped EXE
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of SetWindowsHookEx
          PID:1164

Network

        MITRE ATT&CK Enterprise v6

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Temp\XOLGV.bat

          Filesize

          155B

          MD5

          f07b93136766adced3c6f0d74d869da0

          SHA1

          787c530f33687d758b41295e01d7a9a1bba3a467

          SHA256

          cd603067047c028fe12d4b099d13b3681dd698d25bc32474184e9d8edd3ed701

          SHA512

          050105a5f14939a37f653421b24959cc90cb082b20df5bb1a81335fd0ad5e70c740b43f1d6df0fc7324551425894668acc3af0c533c7d90ff149d84e844c2d10

        • C:\Users\Admin\AppData\Roaming\MicrosoftOffice\micoffice.exe

          Filesize

          952KB

          MD5

          9af6bd730a1622e152701d2658ddd665

          SHA1

          f6390bb376182f18b40311273d7c0a7b4ccdfb68

          SHA256

          e46071299afbabb1cad1d8b2cda05cd83f320e905e787495f577bcb0bf61c88b

          SHA512

          575b75a34aa7ab015db7f75dc99e3cc60412cde7e8e365f7e6dd759351229faa560733382c7e838be39b94cd84dbc94818005af62b86724e58ed3f7e4ba79cec

        • C:\Users\Admin\AppData\Roaming\MicrosoftOffice\micoffice.exe

          Filesize

          952KB

          MD5

          9af6bd730a1622e152701d2658ddd665

          SHA1

          f6390bb376182f18b40311273d7c0a7b4ccdfb68

          SHA256

          e46071299afbabb1cad1d8b2cda05cd83f320e905e787495f577bcb0bf61c88b

          SHA512

          575b75a34aa7ab015db7f75dc99e3cc60412cde7e8e365f7e6dd759351229faa560733382c7e838be39b94cd84dbc94818005af62b86724e58ed3f7e4ba79cec

        • C:\Users\Admin\AppData\Roaming\MicrosoftOffice\micoffice.exe

          Filesize

          952KB

          MD5

          9af6bd730a1622e152701d2658ddd665

          SHA1

          f6390bb376182f18b40311273d7c0a7b4ccdfb68

          SHA256

          e46071299afbabb1cad1d8b2cda05cd83f320e905e787495f577bcb0bf61c88b

          SHA512

          575b75a34aa7ab015db7f75dc99e3cc60412cde7e8e365f7e6dd759351229faa560733382c7e838be39b94cd84dbc94818005af62b86724e58ed3f7e4ba79cec

        • C:\Users\Admin\AppData\Roaming\MicrosoftOffice\micoffice.exe

          Filesize

          952KB

          MD5

          9af6bd730a1622e152701d2658ddd665

          SHA1

          f6390bb376182f18b40311273d7c0a7b4ccdfb68

          SHA256

          e46071299afbabb1cad1d8b2cda05cd83f320e905e787495f577bcb0bf61c88b

          SHA512

          575b75a34aa7ab015db7f75dc99e3cc60412cde7e8e365f7e6dd759351229faa560733382c7e838be39b94cd84dbc94818005af62b86724e58ed3f7e4ba79cec

        • \Users\Admin\AppData\Roaming\MicrosoftOffice\micoffice.exe

          Filesize

          952KB

          MD5

          9af6bd730a1622e152701d2658ddd665

          SHA1

          f6390bb376182f18b40311273d7c0a7b4ccdfb68

          SHA256

          e46071299afbabb1cad1d8b2cda05cd83f320e905e787495f577bcb0bf61c88b

          SHA512

          575b75a34aa7ab015db7f75dc99e3cc60412cde7e8e365f7e6dd759351229faa560733382c7e838be39b94cd84dbc94818005af62b86724e58ed3f7e4ba79cec

        • \Users\Admin\AppData\Roaming\MicrosoftOffice\micoffice.exe

          Filesize

          952KB

          MD5

          9af6bd730a1622e152701d2658ddd665

          SHA1

          f6390bb376182f18b40311273d7c0a7b4ccdfb68

          SHA256

          e46071299afbabb1cad1d8b2cda05cd83f320e905e787495f577bcb0bf61c88b

          SHA512

          575b75a34aa7ab015db7f75dc99e3cc60412cde7e8e365f7e6dd759351229faa560733382c7e838be39b94cd84dbc94818005af62b86724e58ed3f7e4ba79cec

        • \Users\Admin\AppData\Roaming\MicrosoftOffice\micoffice.exe

          Filesize

          952KB

          MD5

          9af6bd730a1622e152701d2658ddd665

          SHA1

          f6390bb376182f18b40311273d7c0a7b4ccdfb68

          SHA256

          e46071299afbabb1cad1d8b2cda05cd83f320e905e787495f577bcb0bf61c88b

          SHA512

          575b75a34aa7ab015db7f75dc99e3cc60412cde7e8e365f7e6dd759351229faa560733382c7e838be39b94cd84dbc94818005af62b86724e58ed3f7e4ba79cec

        • \Users\Admin\AppData\Roaming\MicrosoftOffice\micoffice.exe

          Filesize

          952KB

          MD5

          9af6bd730a1622e152701d2658ddd665

          SHA1

          f6390bb376182f18b40311273d7c0a7b4ccdfb68

          SHA256

          e46071299afbabb1cad1d8b2cda05cd83f320e905e787495f577bcb0bf61c88b

          SHA512

          575b75a34aa7ab015db7f75dc99e3cc60412cde7e8e365f7e6dd759351229faa560733382c7e838be39b94cd84dbc94818005af62b86724e58ed3f7e4ba79cec

        • \Users\Admin\AppData\Roaming\MicrosoftOffice\micoffice.exe

          Filesize

          952KB

          MD5

          9af6bd730a1622e152701d2658ddd665

          SHA1

          f6390bb376182f18b40311273d7c0a7b4ccdfb68

          SHA256

          e46071299afbabb1cad1d8b2cda05cd83f320e905e787495f577bcb0bf61c88b

          SHA512

          575b75a34aa7ab015db7f75dc99e3cc60412cde7e8e365f7e6dd759351229faa560733382c7e838be39b94cd84dbc94818005af62b86724e58ed3f7e4ba79cec

        • memory/1164-102-0x0000000000400000-0x00000000004B2000-memory.dmp

          Filesize

          712KB

        • memory/1164-122-0x0000000000400000-0x00000000004B2000-memory.dmp

          Filesize

          712KB

        • memory/1164-111-0x0000000000400000-0x00000000004B2000-memory.dmp

          Filesize

          712KB

        • memory/1164-115-0x0000000000400000-0x00000000004B2000-memory.dmp

          Filesize

          712KB

        • memory/1164-109-0x0000000000400000-0x00000000004B2000-memory.dmp

          Filesize

          712KB

        • memory/1164-107-0x0000000000400000-0x00000000004B2000-memory.dmp

          Filesize

          712KB

        • memory/1164-95-0x0000000000400000-0x00000000004B2000-memory.dmp

          Filesize

          712KB

        • memory/1164-119-0x0000000000400000-0x00000000004B2000-memory.dmp

          Filesize

          712KB

        • memory/1164-106-0x0000000000400000-0x00000000004B2000-memory.dmp

          Filesize

          712KB

        • memory/1164-104-0x0000000000400000-0x00000000004B2000-memory.dmp

          Filesize

          712KB

        • memory/1164-100-0x0000000000400000-0x00000000004B2000-memory.dmp

          Filesize

          712KB

        • memory/1164-94-0x0000000000400000-0x00000000004B2000-memory.dmp

          Filesize

          712KB

        • memory/1164-118-0x0000000000400000-0x00000000004B2000-memory.dmp

          Filesize

          712KB

        • memory/1172-59-0x0000000000400000-0x000000000040B000-memory.dmp

          Filesize

          44KB

        • memory/1172-62-0x0000000000400000-0x000000000040B000-memory.dmp

          Filesize

          44KB

        • memory/1172-116-0x0000000000400000-0x000000000040B000-memory.dmp

          Filesize

          44KB

        • memory/1172-61-0x0000000000400000-0x000000000040B000-memory.dmp

          Filesize

          44KB

        • memory/1172-65-0x0000000000400000-0x000000000040B000-memory.dmp

          Filesize

          44KB

        • memory/1172-66-0x0000000000400000-0x000000000040B000-memory.dmp

          Filesize

          44KB

        • memory/1172-69-0x0000000000400000-0x000000000040B000-memory.dmp

          Filesize

          44KB

        • memory/1172-58-0x0000000000400000-0x000000000040B000-memory.dmp

          Filesize

          44KB

        • memory/1172-70-0x0000000076711000-0x0000000076713000-memory.dmp

          Filesize

          8KB

        • memory/1212-56-0x0000000002CD0000-0x0000000002DA8000-memory.dmp

          Filesize

          864KB

        • memory/1664-83-0x0000000002D70000-0x0000000002E48000-memory.dmp

          Filesize

          864KB

        • memory/1768-121-0x0000000000400000-0x000000000040B000-memory.dmp

          Filesize

          44KB