Analysis
-
max time kernel
151s -
max time network
49s -
platform
windows7_x64 -
resource
win7-20220901-en -
resource tags
-
submitted
23-11-2022 12:37
General
-
Target
fba71d7e42c54406f33bfc7fb376513f3a3a5e6056e93567117c51b919a18581.exe
-
Size
844KB
-
MD5
5a1a76f5d6652816ec4bcb7cabead9a4
-
SHA1
150b6d0ce62b21a0b99e850c392b35c620360d99
-
SHA256
fba71d7e42c54406f33bfc7fb376513f3a3a5e6056e93567117c51b919a18581
-
SHA512
ee9042b2e7cabc361701c131ead0f8eb1061639c90a5d01d77b54ab1e4c9cd018831607408d2fada544605f70e24a6bd2895464d695016fc44b11da06e9c2c32
-
SSDEEP
24576:9TSeM/uDIUuEPFQE+mYeg/Sia3aaBPJWxMjg:VCuDIUlPFv+mY36F9BP5jg
Malware Config
Extracted
darkcomet
Guest16_min
markgraham.noip.me:2124
DCMIN_MUTEX-FUSP59W
-
gencode
Le3UD9gfvz8p
-
install
false
-
offline_keylogger
true
-
persistence
false
Signatures
-
Darkcomet
DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 2 IoCs
-
Uses the VBS compiler for execution 1 TTPs
-
Adds Run key to start application 2 TTPs 2 IoCs
-
Suspicious use of SetThreadContext 2 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 54 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
-
Suspicious use of WriteProcessMemory 38 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\fba71d7e42c54406f33bfc7fb376513f3a3a5e6056e93567117c51b919a18581.exe"C:\Users\Admin\AppData\Local\Temp\fba71d7e42c54406f33bfc7fb376513f3a3a5e6056e93567117c51b919a18581.exe"1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"2⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\WUDHost.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\WUDHost.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Acctres.exeC:\Users\Admin\AppData\Roaming\Microsoft\Windows\Acctres.exe3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"4⤵
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\WUDHost.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\WUDHost.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
844KB
MD55a1a76f5d6652816ec4bcb7cabead9a4
SHA1150b6d0ce62b21a0b99e850c392b35c620360d99
SHA256fba71d7e42c54406f33bfc7fb376513f3a3a5e6056e93567117c51b919a18581
SHA512ee9042b2e7cabc361701c131ead0f8eb1061639c90a5d01d77b54ab1e4c9cd018831607408d2fada544605f70e24a6bd2895464d695016fc44b11da06e9c2c32
-
Filesize
844KB
MD55a1a76f5d6652816ec4bcb7cabead9a4
SHA1150b6d0ce62b21a0b99e850c392b35c620360d99
SHA256fba71d7e42c54406f33bfc7fb376513f3a3a5e6056e93567117c51b919a18581
SHA512ee9042b2e7cabc361701c131ead0f8eb1061639c90a5d01d77b54ab1e4c9cd018831607408d2fada544605f70e24a6bd2895464d695016fc44b11da06e9c2c32
-
Filesize
8KB
MD5203abaf3a0b4387f8c83b8df44b52be4
SHA1f298f77bf98b2941d4c7473c8fe0e8feedaaca6f
SHA2564b5118a6792cf0fec015c0db676d42049333f725f9d10f4d36df95a41003ae38
SHA512475e350bca4c5273779fe58e17bfe18a713572e17e417f700aa6418196c2830ae003f7fa9f8eb956ebea06e32fe35b47e967d5f1bff9b3a920585562360b0b50
-
Filesize
8KB
MD5203abaf3a0b4387f8c83b8df44b52be4
SHA1f298f77bf98b2941d4c7473c8fe0e8feedaaca6f
SHA2564b5118a6792cf0fec015c0db676d42049333f725f9d10f4d36df95a41003ae38
SHA512475e350bca4c5273779fe58e17bfe18a713572e17e417f700aa6418196c2830ae003f7fa9f8eb956ebea06e32fe35b47e967d5f1bff9b3a920585562360b0b50
-
Filesize
8KB
MD5203abaf3a0b4387f8c83b8df44b52be4
SHA1f298f77bf98b2941d4c7473c8fe0e8feedaaca6f
SHA2564b5118a6792cf0fec015c0db676d42049333f725f9d10f4d36df95a41003ae38
SHA512475e350bca4c5273779fe58e17bfe18a713572e17e417f700aa6418196c2830ae003f7fa9f8eb956ebea06e32fe35b47e967d5f1bff9b3a920585562360b0b50
-
Filesize
844KB
MD55a1a76f5d6652816ec4bcb7cabead9a4
SHA1150b6d0ce62b21a0b99e850c392b35c620360d99
SHA256fba71d7e42c54406f33bfc7fb376513f3a3a5e6056e93567117c51b919a18581
SHA512ee9042b2e7cabc361701c131ead0f8eb1061639c90a5d01d77b54ab1e4c9cd018831607408d2fada544605f70e24a6bd2895464d695016fc44b11da06e9c2c32
-
Filesize
8KB
MD5203abaf3a0b4387f8c83b8df44b52be4
SHA1f298f77bf98b2941d4c7473c8fe0e8feedaaca6f
SHA2564b5118a6792cf0fec015c0db676d42049333f725f9d10f4d36df95a41003ae38
SHA512475e350bca4c5273779fe58e17bfe18a713572e17e417f700aa6418196c2830ae003f7fa9f8eb956ebea06e32fe35b47e967d5f1bff9b3a920585562360b0b50
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
5.7MB
-
Filesize
8KB
-
Filesize
5.7MB
-
-
Filesize
5.7MB
-
Filesize
5.7MB
-
-
Filesize
5.7MB
-
Filesize
5.7MB
-
Filesize
5.7MB
-
-
Filesize
5.7MB
-
Filesize
5.7MB
-
-
Filesize
712KB