Analysis

  • max time kernel
    153s
  • max time network
    156s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    23-11-2022 14:47

General

  • Target

    21cabd77124daa5365171111e599e0d1451b11f2d8d051eef184fac01837f855.exe

  • Size

    839KB

  • MD5

    716a5a605210a120fbf1ff9e5c51f05f

  • SHA1

    b471a3fdea022668e3f57c9c1f0172f821b3e9d2

  • SHA256

    21cabd77124daa5365171111e599e0d1451b11f2d8d051eef184fac01837f855

  • SHA512

    e867601e8648e2508961a26d9bd33f560165425f16dfbd695ecf7d9d54052cbfeb35bcbed316eb3116fb236b4987a2b238cf7f62c046a4bd534b30105979ba82

  • SSDEEP

    12288:QTIHhdXKcl+XRhORnhRZxdGJAVGWuCAIMd0coVXi3W8vsoxDrS7YlX:Qq3XK6+X3OR3Zxd6UwCydGVkW83Dr

Malware Config

Extracted

Family

darkcomet

Botnet

Victims

C2

mrchbk.noip.me:2123

Mutex

DC_MUTEX-EZ6YFTY

Attributes
  • gencode

    4FUM8Qy2Ej7F

  • install

    false

  • offline_keylogger

    true

  • persistence

    false

Signatures

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

  • Executes dropped EXE 3 IoCs
  • Checks computer location settings 2 TTPs 3 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Uses the VBS compiler for execution 1 TTPs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 52 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 33 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\21cabd77124daa5365171111e599e0d1451b11f2d8d051eef184fac01837f855.exe
    "C:\Users\Admin\AppData\Local\Temp\21cabd77124daa5365171111e599e0d1451b11f2d8d051eef184fac01837f855.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1308
    • C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
      "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      PID:1936
    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\WUDHost.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\WUDHost.exe"
      2⤵
      • Executes dropped EXE
      • Checks computer location settings
      • Adds Run key to start application
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:4780
      • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Acctres.exe
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Acctres.exe"
        3⤵
        • Executes dropped EXE
        • Checks computer location settings
        • Suspicious use of SetThreadContext
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:3296
        • C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
          "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
          4⤵
          • Suspicious use of AdjustPrivilegeToken
          PID:1712
        • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\WUDHost.exe
          "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\WUDHost.exe"
          4⤵
          • Executes dropped EXE
          • Adds Run key to start application
          • Suspicious use of AdjustPrivilegeToken
          PID:4640

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Microsoft\CLR_v2.0_32\UsageLogs\WUDHost.exe.log

    Filesize

    128B

    MD5

    a5dcc7c9c08af7dddd82be5b036a4416

    SHA1

    4f998ca1526d199e355ffb435bae111a2779b994

    SHA256

    e24033ceec97fd03402b03acaaabd1d1e378e83bb1683afbccac760e00f8ead5

    SHA512

    56035de734836c0c39f0b48641c51c26adb6e79c6c65e23ca96603f71c95b8673e2ef853146e87efc899dd1878d0bbc2c82d91fbf0fce81c552048e986f9bb5a

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Acctres.exe

    Filesize

    839KB

    MD5

    716a5a605210a120fbf1ff9e5c51f05f

    SHA1

    b471a3fdea022668e3f57c9c1f0172f821b3e9d2

    SHA256

    21cabd77124daa5365171111e599e0d1451b11f2d8d051eef184fac01837f855

    SHA512

    e867601e8648e2508961a26d9bd33f560165425f16dfbd695ecf7d9d54052cbfeb35bcbed316eb3116fb236b4987a2b238cf7f62c046a4bd534b30105979ba82

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Acctres.exe

    Filesize

    839KB

    MD5

    716a5a605210a120fbf1ff9e5c51f05f

    SHA1

    b471a3fdea022668e3f57c9c1f0172f821b3e9d2

    SHA256

    21cabd77124daa5365171111e599e0d1451b11f2d8d051eef184fac01837f855

    SHA512

    e867601e8648e2508961a26d9bd33f560165425f16dfbd695ecf7d9d54052cbfeb35bcbed316eb3116fb236b4987a2b238cf7f62c046a4bd534b30105979ba82

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\WUDHost.exe

    Filesize

    6KB

    MD5

    c677bce7b149928e92e3dd82986b5de6

    SHA1

    4918e2da147258648fb783d4bf0690651184438c

    SHA256

    d3c76f694a366c6faf639fe422479abda26c3fc139969fa1cff2d315af2029ef

    SHA512

    255458271f88a0dc63ae36a6fa0a062e8e2531ba27046184934a558dd57412977f70aba5476cc60d65c32e8c1ce4d050d7a511bd18c880c9137f3c7e0e038ef8

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\WUDHost.exe

    Filesize

    6KB

    MD5

    c677bce7b149928e92e3dd82986b5de6

    SHA1

    4918e2da147258648fb783d4bf0690651184438c

    SHA256

    d3c76f694a366c6faf639fe422479abda26c3fc139969fa1cff2d315af2029ef

    SHA512

    255458271f88a0dc63ae36a6fa0a062e8e2531ba27046184934a558dd57412977f70aba5476cc60d65c32e8c1ce4d050d7a511bd18c880c9137f3c7e0e038ef8

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\WUDHost.exe

    Filesize

    6KB

    MD5

    c677bce7b149928e92e3dd82986b5de6

    SHA1

    4918e2da147258648fb783d4bf0690651184438c

    SHA256

    d3c76f694a366c6faf639fe422479abda26c3fc139969fa1cff2d315af2029ef

    SHA512

    255458271f88a0dc63ae36a6fa0a062e8e2531ba27046184934a558dd57412977f70aba5476cc60d65c32e8c1ce4d050d7a511bd18c880c9137f3c7e0e038ef8

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\WUDHost.exe

    Filesize

    6KB

    MD5

    c677bce7b149928e92e3dd82986b5de6

    SHA1

    4918e2da147258648fb783d4bf0690651184438c

    SHA256

    d3c76f694a366c6faf639fe422479abda26c3fc139969fa1cff2d315af2029ef

    SHA512

    255458271f88a0dc63ae36a6fa0a062e8e2531ba27046184934a558dd57412977f70aba5476cc60d65c32e8c1ce4d050d7a511bd18c880c9137f3c7e0e038ef8

  • memory/1308-150-0x0000000074C60000-0x0000000075211000-memory.dmp

    Filesize

    5.7MB

  • memory/1308-132-0x0000000074C60000-0x0000000075211000-memory.dmp

    Filesize

    5.7MB

  • memory/1308-133-0x0000000074C60000-0x0000000075211000-memory.dmp

    Filesize

    5.7MB

  • memory/1712-156-0x0000000000400000-0x00000000004B2000-memory.dmp

    Filesize

    712KB

  • memory/1712-152-0x0000000000000000-mapping.dmp

  • memory/1936-138-0x0000000000400000-0x00000000004B2000-memory.dmp

    Filesize

    712KB

  • memory/1936-137-0x0000000000400000-0x00000000004B2000-memory.dmp

    Filesize

    712KB

  • memory/1936-136-0x0000000000400000-0x00000000004B2000-memory.dmp

    Filesize

    712KB

  • memory/1936-135-0x0000000000400000-0x00000000004B2000-memory.dmp

    Filesize

    712KB

  • memory/1936-143-0x0000000000400000-0x00000000004B2000-memory.dmp

    Filesize

    712KB

  • memory/1936-134-0x0000000000000000-mapping.dmp

  • memory/3296-146-0x0000000000000000-mapping.dmp

  • memory/3296-149-0x0000000074C60000-0x0000000075211000-memory.dmp

    Filesize

    5.7MB

  • memory/3296-148-0x0000000074C60000-0x0000000075211000-memory.dmp

    Filesize

    5.7MB

  • memory/4640-157-0x0000000000000000-mapping.dmp

  • memory/4640-161-0x0000000074C60000-0x0000000075211000-memory.dmp

    Filesize

    5.7MB

  • memory/4640-162-0x0000000074C60000-0x0000000075211000-memory.dmp

    Filesize

    5.7MB

  • memory/4780-151-0x0000000074C60000-0x0000000075211000-memory.dmp

    Filesize

    5.7MB

  • memory/4780-144-0x0000000074C60000-0x0000000075211000-memory.dmp

    Filesize

    5.7MB

  • memory/4780-142-0x0000000074C60000-0x0000000075211000-memory.dmp

    Filesize

    5.7MB

  • memory/4780-139-0x0000000000000000-mapping.dmp