darkcomet | 9a7a2fa7fd9a752cc1f0e264e11765098e9308db0b42c6a252f336c13e1d23e0

Analysis

max time kernel
22s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
25-11-2022 07:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9a7a2fa7fd9a752cc1f0e264e11765098e9308db0b42c6a252f336c13e1d23e0.exe
Size

7.2MB
MD5

827f6fb0a7e2752eb9579d948bff7951
SHA1

1002f68f7ad6565284516a77edb020644780ea45
SHA256

9a7a2fa7fd9a752cc1f0e264e11765098e9308db0b42c6a252f336c13e1d23e0
SHA512

45147abd30ef7b30884c10ddf87301dd328289097169b0c8e0a2ea1cccf3fa13008a5b3868252c17ee9187b44bb0593799e772fb280d2e3a4bccb25c1c17f1dc
SSDEEP

196608:FxXYlCIZID4cVsgYBb/p1BA2F3qzPKpVKfu2XJV4jZb9zCjb5k3:FVf9YhBrKPEEXHEb1UW

Score

10^/10

darkcomet neshta pony persistence rat spyware stealer trojan

Malware Config

Extracted

Family

pony

http://pelehaty.netai.net/gate.php

Signatures

Darkcomet
DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
trojan rat darkcomet

Detect Neshta payload 1 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1368-55-0x0000000000400000-0x0000000000DC8000-memory.dmp	family_neshta

Neshta
Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.
persistence spyware neshta
Pony,Fareit
Pony is a Remote Access Trojan application that steals information.
rat spyware stealer pony

Checks BIOS information in registry 2 TTPs 1 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

9a7a2fa7fd9a752cc1f0e264e11765098e9308db0b42c6a252f336c13e1d23e0.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	9a7a2fa7fd9a752cc1f0e264e11765098e9308db0b42c6a252f336c13e1d23e0.exe

C:\Users\Admin\AppData\Local\Temp\9a7a2fa7fd9a752cc1f0e264e11765098e9308db0b42c6a252f336c13e1d23e0.exe
"C:\Users\Admin\AppData\Local\Temp\9a7a2fa7fd9a752cc1f0e264e11765098e9308db0b42c6a252f336c13e1d23e0.exe"
1⤵
- Checks BIOS information in registry
PID:1368

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1368-54-0x0000000075501000-0x0000000075503000-memory.dmp

Filesize
8KB

Download
memory/1368-55-0x0000000000400000-0x0000000000DC8000-memory.dmp

Filesize
9.8MB

Download