Overview

overview

10

Static

static

10

f3d6caf5d3...18.exe

windows7-x64

10

f3d6caf5d3...18.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    296s
  • max time network
    357s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20221111-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
  • submitted
    26-11-2022 02:01

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    f3d6caf5d3485c17526bf4249621c74e01d90a9ab3ee4f33c17249c982bf3d18.exe

  • Size

    658KB

  • MD5

    3127bfcb04c1efdf78534610c0f6e46b

  • SHA1

    fd0e2e9ea3b1563706145362f9fccb610653d6f9

  • SHA256

    f3d6caf5d3485c17526bf4249621c74e01d90a9ab3ee4f33c17249c982bf3d18

  • SHA512

    36119a3e441efc57b2e96e7a7bcb8c3902eec6bb5faf418fc9859ae351e667a0ced45a765ce634dc01e3a1662bddb7a15ea40ac979bd5496935f006e7a0880f1

  • SSDEEP

    12288:y9HFJ9rJxRX1uVVjoaWSoynxdO1FVBaOiRZTERfIhNkNCCLo9Ek5C/h6:eZ1xuVVjfFoynPaVBUR8f+kN10EB8

Score
10/10
darkcometvictimepersistencerattrojan

Malware Config

Extracted

Family

darkcomet

Botnet

Victime

C2

23.95.52.24:1604

Mutex

MUTEX-GURB7WX

Attributes
  • InstallPath

    Microsoft\windowsupdate.com

  • gencode

    hkdEYJPYqYa3

  • install

    true

  • offline_keylogger

    true

  • persistence

    true

  • reg_key

    Windows

Signatures

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

    trojanratdarkcomet
  • Modifies WinLogon for persistence 2 TTPs 1 IoCs
    persistence
  • Executes dropped EXE 1 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Drops file in System32 directory 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious use of AdjustPrivilegeToken 48 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 20 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\f3d6caf5d3485c17526bf4249621c74e01d90a9ab3ee4f33c17249c982bf3d18.exe
    "C:\Users\Admin\AppData\Local\Temp\f3d6caf5d3485c17526bf4249621c74e01d90a9ab3ee4f33c17249c982bf3d18.exe"
    1⤵
    • Modifies WinLogon for persistence
    • Checks computer location settings
    • Adds Run key to start application
    • Drops file in System32 directory
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:5092
    • C:\Windows\SysWOW64\notepad.exe
      notepad
      2⤵
        PID:3376
      • C:\Windows\SysWOW64\Microsoft\windowsupdate.com
        "C:\Windows\system32\Microsoft\windowsupdate.com"
        2⤵
        • Executes dropped EXE
        • Adds Run key to start application
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of SetWindowsHookEx
        PID:3936

    Network

    MITRE ATT&CK Matrix ATT&CK v6

    Initial Access

    Execution

    Persistence

    Winlogon Helper DLL

    1
    T1004

    Registry Run Keys / Startup Folder

    1
    T1060

    Privilege Escalation

    Defense Evasion

    Modify Registry

    2
    T1112

    Credential Access

    Discovery

    Query Registry

    1
    T1012

    System Information Discovery

    2
    T1082

    Lateral Movement

    Collection

    Exfiltration

    Command and Control

    Impact

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Windows\SysWOW64\Microsoft\windowsupdate.com
      Filesize

      658KB

      MD5

      3127bfcb04c1efdf78534610c0f6e46b

      SHA1

      fd0e2e9ea3b1563706145362f9fccb610653d6f9

      SHA256

      f3d6caf5d3485c17526bf4249621c74e01d90a9ab3ee4f33c17249c982bf3d18

      SHA512

      36119a3e441efc57b2e96e7a7bcb8c3902eec6bb5faf418fc9859ae351e667a0ced45a765ce634dc01e3a1662bddb7a15ea40ac979bd5496935f006e7a0880f1

      Download Submit
    • C:\Windows\SysWOW64\Microsoft\windowsupdate.com
      Filesize

      658KB

      MD5

      3127bfcb04c1efdf78534610c0f6e46b

      SHA1

      fd0e2e9ea3b1563706145362f9fccb610653d6f9

      SHA256

      f3d6caf5d3485c17526bf4249621c74e01d90a9ab3ee4f33c17249c982bf3d18

      SHA512

      36119a3e441efc57b2e96e7a7bcb8c3902eec6bb5faf418fc9859ae351e667a0ced45a765ce634dc01e3a1662bddb7a15ea40ac979bd5496935f006e7a0880f1

      Download Submit
    • memory/3376-132-0x0000000000000000-mapping.dmp
      Download
    • memory/3936-133-0x0000000000000000-mapping.dmp
      Download