Analysis
-
max time kernel
150s -
max time network
155s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
-
submitted
23-11-2022 18:38
General
-
Target
d6dd2afabd3a2da675d616501c668af3ae6ed9951ff5507f5b283399b8c94199.exe
-
Size
834KB
-
MD5
b1c50a7fc4f9065eb4d146e99b3ba8c9
-
SHA1
e05cae1327a90d4758c55a82dace360a71ae878c
-
SHA256
d6dd2afabd3a2da675d616501c668af3ae6ed9951ff5507f5b283399b8c94199
-
SHA512
8f3a1647be8d5a962e555be12f9f03da897d8b67d404c4b15cde4565662d129384f8bb882cd384a7e2bced0e7b885520f040896216f7f10e95399da2f75c8178
-
SSDEEP
12288:p+yR54BjPCAmvE6R71Ti/AAyvQo4ypD6tfn+60XhD14H/ZEg3Mk5RHdYO6IWsl:p+dBirR7hP4oFx69+Dx54REXk5R9YUl
Malware Config
Extracted
darkcomet
Victims
mrchbk.noip.me:2123
DC_MUTEX-EZ6YFTY
-
gencode
4FUM8Qy2Ej7F
-
install
false
-
offline_keylogger
true
-
persistence
false
Signatures
-
Darkcomet
DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 2 IoCs
-
Uses the VBS compiler for execution 1 TTPs
-
Adds Run key to start application 2 TTPs 2 IoCs
-
Suspicious use of SetThreadContext 2 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 50 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
-
Suspicious use of WriteProcessMemory 38 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\d6dd2afabd3a2da675d616501c668af3ae6ed9951ff5507f5b283399b8c94199.exe"C:\Users\Admin\AppData\Local\Temp\d6dd2afabd3a2da675d616501c668af3ae6ed9951ff5507f5b283399b8c94199.exe"1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"2⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\IpOverUsbSvrc.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\IpOverUsbSvrc.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Acctres.exeC:\Users\Admin\AppData\Roaming\Microsoft\Windows\Acctres.exe3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"4⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\IpOverUsbSvrc.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\IpOverUsbSvrc.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
834KB
MD5b1c50a7fc4f9065eb4d146e99b3ba8c9
SHA1e05cae1327a90d4758c55a82dace360a71ae878c
SHA256d6dd2afabd3a2da675d616501c668af3ae6ed9951ff5507f5b283399b8c94199
SHA5128f3a1647be8d5a962e555be12f9f03da897d8b67d404c4b15cde4565662d129384f8bb882cd384a7e2bced0e7b885520f040896216f7f10e95399da2f75c8178
-
Filesize
834KB
MD5b1c50a7fc4f9065eb4d146e99b3ba8c9
SHA1e05cae1327a90d4758c55a82dace360a71ae878c
SHA256d6dd2afabd3a2da675d616501c668af3ae6ed9951ff5507f5b283399b8c94199
SHA5128f3a1647be8d5a962e555be12f9f03da897d8b67d404c4b15cde4565662d129384f8bb882cd384a7e2bced0e7b885520f040896216f7f10e95399da2f75c8178
-
Filesize
17KB
MD5fd03ff313a655e0b59dce81044bc6341
SHA10fa0dc26876f636956c3de82685bdbbc8ad3ef86
SHA2561f1c8c1458eaee47a448513db52ddb536406146d48793c3c24f41eb72b13cec9
SHA51200fdf54987cb8abd0c68619e02991aeb50e5509ea56b0e5fa613ac29fddcc57c585cd0e5be055cb5c6563828b6a631666fe6e7004dada7607ddd903659264ddd
-
Filesize
17KB
MD5fd03ff313a655e0b59dce81044bc6341
SHA10fa0dc26876f636956c3de82685bdbbc8ad3ef86
SHA2561f1c8c1458eaee47a448513db52ddb536406146d48793c3c24f41eb72b13cec9
SHA51200fdf54987cb8abd0c68619e02991aeb50e5509ea56b0e5fa613ac29fddcc57c585cd0e5be055cb5c6563828b6a631666fe6e7004dada7607ddd903659264ddd
-
Filesize
17KB
MD5fd03ff313a655e0b59dce81044bc6341
SHA10fa0dc26876f636956c3de82685bdbbc8ad3ef86
SHA2561f1c8c1458eaee47a448513db52ddb536406146d48793c3c24f41eb72b13cec9
SHA51200fdf54987cb8abd0c68619e02991aeb50e5509ea56b0e5fa613ac29fddcc57c585cd0e5be055cb5c6563828b6a631666fe6e7004dada7607ddd903659264ddd
-
Filesize
834KB
MD5b1c50a7fc4f9065eb4d146e99b3ba8c9
SHA1e05cae1327a90d4758c55a82dace360a71ae878c
SHA256d6dd2afabd3a2da675d616501c668af3ae6ed9951ff5507f5b283399b8c94199
SHA5128f3a1647be8d5a962e555be12f9f03da897d8b67d404c4b15cde4565662d129384f8bb882cd384a7e2bced0e7b885520f040896216f7f10e95399da2f75c8178
-
Filesize
17KB
MD5fd03ff313a655e0b59dce81044bc6341
SHA10fa0dc26876f636956c3de82685bdbbc8ad3ef86
SHA2561f1c8c1458eaee47a448513db52ddb536406146d48793c3c24f41eb72b13cec9
SHA51200fdf54987cb8abd0c68619e02991aeb50e5509ea56b0e5fa613ac29fddcc57c585cd0e5be055cb5c6563828b6a631666fe6e7004dada7607ddd903659264ddd
-
Filesize
5.7MB
-
-
Filesize
5.7MB
-
Filesize
5.7MB
-
Filesize
5.7MB
-
Filesize
5.7MB
-
-
-
Filesize
712KB
-
-
Filesize
5.7MB
-
Filesize
5.7MB
-
Filesize
5.7MB
-
Filesize
8KB
-
Filesize
5.7MB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB