Analysis

  • max time kernel
    147s
  • max time network
    154s
  • platform
    windows7_x64
  • resource
    win7-20220812-en
  • resource tags

    arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
  • submitted
    27-11-2022 10:12

General

  • Target

    f582179374bde1f836cb2d8f98f4d6de71e23bfa120d503a3a3eb8e0e9d6ac52.exe

  • Size

    1.2MB

  • MD5

    6966f74e9d8f1a376ea379f9fcc206a2

  • SHA1

    3686d3a9a07ed9f9bda256df9cd2e5604c84de2f

  • SHA256

    f582179374bde1f836cb2d8f98f4d6de71e23bfa120d503a3a3eb8e0e9d6ac52

  • SHA512

    0cf914ae8cf954000a526584c01028409188a19ed4b2910618ed458fa76e3fcf5f0df6fb32b8e9b256535f2d07ebee834c7e5357fd3e597b6803bbd0dd1e0336

  • SSDEEP

    12288:C+0Qo6Vv9vkeeP2d+1bmXlZeGB3EHPiiyPP+Mxb1:C+0Z6Vdkeea+1i0iiyPFxZ

Malware Config

Extracted

Family

darkcomet

Botnet

Infected

C2

dcnew.ddns.net:1604

Mutex

DC_MUTEX-R5E5D6N

Attributes
  • InstallPath

    WindowsDefencler\WindowsDefencler.exe

  • gencode

    J8TDDtLHxoYC

  • install

    true

  • offline_keylogger

    true

  • password

    00000

  • persistence

    true

  • reg_key

    WindowsDefencler

Signatures

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

  • Modifies WinLogon for persistence 2 TTPs 3 IoCs
  • Executes dropped EXE 4 IoCs
  • Sets file to hidden 1 TTPs 2 IoCs

    Modifies file attributes to stop it showing in Explorer etc.

  • Drops startup file 5 IoCs
  • Loads dropped DLL 6 IoCs
  • Adds Run key to start application 2 TTPs 11 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Creates scheduled task(s) 1 TTPs 6 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Kills process with taskkill 3 IoCs
  • Modifies registry class 10 IoCs
  • Suspicious use of AdjustPrivilegeToken 28 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Views/modifies file attributes 1 TTPs 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\f582179374bde1f836cb2d8f98f4d6de71e23bfa120d503a3a3eb8e0e9d6ac52.exe
    "C:\Users\Admin\AppData\Local\Temp\f582179374bde1f836cb2d8f98f4d6de71e23bfa120d503a3a3eb8e0e9d6ac52.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:1660
    • C:\Windows\SysWOW64\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\FB_14AA.tmp.vbs"
      2⤵
      • Modifies WinLogon for persistence
      • Drops startup file
      • Adds Run key to start application
      • Modifies registry class
      PID:1828
      • C:\Windows\SysWOW64\taskkill.exe
        "C:\Windows\System32\taskkill.exe" /F /IM SpyTheSpy.exe
        3⤵
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:1104
      • C:\Windows\SysWOW64\taskkill.exe
        "C:\Windows\System32\taskkill.exe" /F /IM TiGeR-Firewall.exe
        3⤵
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:1580
      • C:\Windows\SysWOW64\taskkill.exe
        "C:\Windows\System32\taskkill.exe" /F /IM bavtray.exe
        3⤵
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:1604
      • C:\Windows\SysWOW64\schtasks.exe
        "C:\Windows\System32\schtasks.exe" /create /sc ONLOGON /RL HIGHEST /tn Windows Defencler-DoOoM.vbe /tr "C:\Users\Admin\AppData\Roaming\System\Windows Defencler-DoOoMs.vbs"
        3⤵
        • Creates scheduled task(s)
        PID:1788
      • C:\Windows\SysWOW64\schtasks.exe
        "C:\Windows\System32\schtasks.exe" /create /sc ONLOGON /RL HIGHEST /tn Windows Defencler-DoOoM.vbe /tr "C:\Users\Admin\AppData\Roaming\System\Windows Defencler-DoOoMs.vbs"
        3⤵
        • Creates scheduled task(s)
        PID:1084
      • C:\Windows\SysWOW64\schtasks.exe
        "C:\Windows\System32\schtasks.exe" /create /sc ONLOGON /RL HIGHEST /tn Windows Defencler-DoOoM.vbe /tr "C:\Users\Admin\AppData\Roaming\System\Windows Defencler-DoOoMs.vbs"
        3⤵
        • Creates scheduled task(s)
        PID:1580
      • C:\Windows\SysWOW64\schtasks.exe
        "C:\Windows\System32\schtasks.exe" /create /sc ONLOGON /RL HIGHEST /tn Windows Defencler-DoOoM.vbe /tr "C:\Users\Admin\AppData\Roaming\System\Windows Defencler-DoOoMs.vbs"
        3⤵
        • Creates scheduled task(s)
        PID:1812
      • C:\Windows\SysWOW64\schtasks.exe
        "C:\Windows\System32\schtasks.exe" /create /sc ONLOGON /RL HIGHEST /tn Windows Defencler-DoOoM.vbe /tr "C:\Users\Admin\AppData\Roaming\System\Windows Defencler-DoOoMs.vbs"
        3⤵
        • Creates scheduled task(s)
        PID:1580
      • C:\Windows\SysWOW64\schtasks.exe
        "C:\Windows\System32\schtasks.exe" /create /sc ONLOGON /RL HIGHEST /tn Windows Defencler-DoOoM.vbe /tr "C:\Users\Admin\AppData\Roaming\System\Windows Defencler-DoOoMs.vbs"
        3⤵
        • Creates scheduled task(s)
        PID:456
    • C:\Windows\SysWOW64\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\FB_18EF.tmp.vbs"
      2⤵
      • Drops startup file
      • Adds Run key to start application
      PID:1076
    • C:\Users\Admin\AppData\Local\Temp\FB_197D.tmp.exe
      "C:\Users\Admin\AppData\Local\Temp\FB_197D.tmp.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious use of SetThreadContext
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:976
      • C:\Users\Admin\AppData\Local\Temp\FB_197D.tmp.exe
        C:\Users\Admin\AppData\Local\Temp\FB_197D.tmp.exe
        3⤵
        • Modifies WinLogon for persistence
        • Executes dropped EXE
        • Loads dropped DLL
        • Adds Run key to start application
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:568
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp\FB_197D.tmp.exe" +s +h
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:1168
          • C:\Windows\SysWOW64\attrib.exe
            attrib "C:\Users\Admin\AppData\Local\Temp\FB_197D.tmp.exe" +s +h
            5⤵
            • Sets file to hidden
            • Views/modifies file attributes
            PID:848
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp" +s +h
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:1336
          • C:\Windows\SysWOW64\attrib.exe
            attrib "C:\Users\Admin\AppData\Local\Temp" +s +h
            5⤵
            • Sets file to hidden
            • Views/modifies file attributes
            PID:1840
        • C:\Windows\SysWOW64\notepad.exe
          notepad
          4⤵
            PID:612
          • C:\Users\Admin\AppData\Local\Temp\WindowsDefencler\WindowsDefencler.exe
            "C:\Users\Admin\AppData\Local\Temp\WindowsDefencler\WindowsDefencler.exe"
            4⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • Suspicious use of SetThreadContext
            • Suspicious use of AdjustPrivilegeToken
            PID:1756
            • C:\Users\Admin\AppData\Local\Temp\WindowsDefencler\WindowsDefencler.exe
              C:\Users\Admin\AppData\Local\Temp\WindowsDefencler\WindowsDefencler.exe
              5⤵
              • Executes dropped EXE
              PID:1544

    Network

    MITRE ATT&CK Matrix ATT&CK v6

    Execution

    Scheduled Task

    1
    T1053

    Persistence

    Winlogon Helper DLL

    1
    T1004

    Hidden Files and Directories

    2
    T1158

    Registry Run Keys / Startup Folder

    1
    T1060

    Scheduled Task

    1
    T1053

    Privilege Escalation

    Scheduled Task

    1
    T1053

    Defense Evasion

    Modify Registry

    2
    T1112

    Hidden Files and Directories

    2
    T1158

    Discovery

    System Information Discovery

    1
    T1082

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\FB_14AA.tmp.vbs
      Filesize

      535KB

      MD5

      c192fc4bc4e0fbd5aeb10a6dd1352d51

      SHA1

      753144fbb384f7245ffb769d3bb35e0aa800d27d

      SHA256

      4d1105930217a87b178d5d116b54d3bd94c1d8e61d258022e41232307c88c3fd

      SHA512

      1dbae48badfb7d073b47d27f3dd953bb3b11f88b9517eb92c46499d5ec59a8f9c116689cede68966f39d366a85513bf109de8cfabacf7697f3f0a67b044a030e

    • C:\Users\Admin\AppData\Local\Temp\FB_18EF.tmp.vbs
      Filesize

      208KB

      MD5

      d5ede071cdc5b5ff7fad809976515ad0

      SHA1

      f1141aefa5de1572442b66c14ce33448a3658017

      SHA256

      5f9e6543647483d66f53e6ce296321e4ca649d806c26700fbd2da828f2788850

      SHA512

      cc617f626bde4ce30d7639752c63e26b10ee2b4feb05c627d0b963e3d392f1546cedf2d508bec764f95f7e49158a55844d7c56a7c34f18c13ff27b2834facbd4

    • C:\Users\Admin\AppData\Local\Temp\FB_197D.tmp.exe
      Filesize

      479KB

      MD5

      b529c526c39d32ee04e26e1769b2797f

      SHA1

      236584b8cbcba90c1b331863725d028c3bfea2c2

      SHA256

      e186527d9b0a7c37e045bc021b59b4283330d7ba0196a598d27aa2601be9ad62

      SHA512

      0b1511640daa85fa19688225d12e46f45ea94bc4771c7b44044666e47b022dd633d8f0da1f7fd6788cf048c94897bfa884b7e847375d538c4fbe66b41f1421db

    • C:\Users\Admin\AppData\Local\Temp\FB_197D.tmp.exe
      Filesize

      479KB

      MD5

      b529c526c39d32ee04e26e1769b2797f

      SHA1

      236584b8cbcba90c1b331863725d028c3bfea2c2

      SHA256

      e186527d9b0a7c37e045bc021b59b4283330d7ba0196a598d27aa2601be9ad62

      SHA512

      0b1511640daa85fa19688225d12e46f45ea94bc4771c7b44044666e47b022dd633d8f0da1f7fd6788cf048c94897bfa884b7e847375d538c4fbe66b41f1421db

    • C:\Users\Admin\AppData\Local\Temp\FB_197D.tmp.exe
      Filesize

      479KB

      MD5

      b529c526c39d32ee04e26e1769b2797f

      SHA1

      236584b8cbcba90c1b331863725d028c3bfea2c2

      SHA256

      e186527d9b0a7c37e045bc021b59b4283330d7ba0196a598d27aa2601be9ad62

      SHA512

      0b1511640daa85fa19688225d12e46f45ea94bc4771c7b44044666e47b022dd633d8f0da1f7fd6788cf048c94897bfa884b7e847375d538c4fbe66b41f1421db

    • C:\Users\Admin\AppData\Local\Temp\WindowsDefencler\WindowsDefencler.exe
      Filesize

      479KB

      MD5

      b529c526c39d32ee04e26e1769b2797f

      SHA1

      236584b8cbcba90c1b331863725d028c3bfea2c2

      SHA256

      e186527d9b0a7c37e045bc021b59b4283330d7ba0196a598d27aa2601be9ad62

      SHA512

      0b1511640daa85fa19688225d12e46f45ea94bc4771c7b44044666e47b022dd633d8f0da1f7fd6788cf048c94897bfa884b7e847375d538c4fbe66b41f1421db

    • C:\Users\Admin\AppData\Local\Temp\WindowsDefencler\WindowsDefencler.exe
      Filesize

      479KB

      MD5

      b529c526c39d32ee04e26e1769b2797f

      SHA1

      236584b8cbcba90c1b331863725d028c3bfea2c2

      SHA256

      e186527d9b0a7c37e045bc021b59b4283330d7ba0196a598d27aa2601be9ad62

      SHA512

      0b1511640daa85fa19688225d12e46f45ea94bc4771c7b44044666e47b022dd633d8f0da1f7fd6788cf048c94897bfa884b7e847375d538c4fbe66b41f1421db

    • C:\Users\Admin\AppData\Local\Temp\WindowsDefencler\WindowsDefencler.exe
      Filesize

      479KB

      MD5

      b529c526c39d32ee04e26e1769b2797f

      SHA1

      236584b8cbcba90c1b331863725d028c3bfea2c2

      SHA256

      e186527d9b0a7c37e045bc021b59b4283330d7ba0196a598d27aa2601be9ad62

      SHA512

      0b1511640daa85fa19688225d12e46f45ea94bc4771c7b44044666e47b022dd633d8f0da1f7fd6788cf048c94897bfa884b7e847375d538c4fbe66b41f1421db

    • C:\Users\Admin\AppData\Roaming\svchost.exe
      Filesize

      479KB

      MD5

      b529c526c39d32ee04e26e1769b2797f

      SHA1

      236584b8cbcba90c1b331863725d028c3bfea2c2

      SHA256

      e186527d9b0a7c37e045bc021b59b4283330d7ba0196a598d27aa2601be9ad62

      SHA512

      0b1511640daa85fa19688225d12e46f45ea94bc4771c7b44044666e47b022dd633d8f0da1f7fd6788cf048c94897bfa884b7e847375d538c4fbe66b41f1421db

    • \Users\Admin\AppData\Local\Temp\FB_197D.tmp.exe
      Filesize

      479KB

      MD5

      b529c526c39d32ee04e26e1769b2797f

      SHA1

      236584b8cbcba90c1b331863725d028c3bfea2c2

      SHA256

      e186527d9b0a7c37e045bc021b59b4283330d7ba0196a598d27aa2601be9ad62

      SHA512

      0b1511640daa85fa19688225d12e46f45ea94bc4771c7b44044666e47b022dd633d8f0da1f7fd6788cf048c94897bfa884b7e847375d538c4fbe66b41f1421db

    • \Users\Admin\AppData\Local\Temp\FB_197D.tmp.exe
      Filesize

      479KB

      MD5

      b529c526c39d32ee04e26e1769b2797f

      SHA1

      236584b8cbcba90c1b331863725d028c3bfea2c2

      SHA256

      e186527d9b0a7c37e045bc021b59b4283330d7ba0196a598d27aa2601be9ad62

      SHA512

      0b1511640daa85fa19688225d12e46f45ea94bc4771c7b44044666e47b022dd633d8f0da1f7fd6788cf048c94897bfa884b7e847375d538c4fbe66b41f1421db

    • \Users\Admin\AppData\Local\Temp\FB_197D.tmp.exe
      Filesize

      479KB

      MD5

      b529c526c39d32ee04e26e1769b2797f

      SHA1

      236584b8cbcba90c1b331863725d028c3bfea2c2

      SHA256

      e186527d9b0a7c37e045bc021b59b4283330d7ba0196a598d27aa2601be9ad62

      SHA512

      0b1511640daa85fa19688225d12e46f45ea94bc4771c7b44044666e47b022dd633d8f0da1f7fd6788cf048c94897bfa884b7e847375d538c4fbe66b41f1421db

    • \Users\Admin\AppData\Local\Temp\WindowsDefencler\WindowsDefencler.exe
      Filesize

      479KB

      MD5

      b529c526c39d32ee04e26e1769b2797f

      SHA1

      236584b8cbcba90c1b331863725d028c3bfea2c2

      SHA256

      e186527d9b0a7c37e045bc021b59b4283330d7ba0196a598d27aa2601be9ad62

      SHA512

      0b1511640daa85fa19688225d12e46f45ea94bc4771c7b44044666e47b022dd633d8f0da1f7fd6788cf048c94897bfa884b7e847375d538c4fbe66b41f1421db

    • \Users\Admin\AppData\Local\Temp\WindowsDefencler\WindowsDefencler.exe
      Filesize

      479KB

      MD5

      b529c526c39d32ee04e26e1769b2797f

      SHA1

      236584b8cbcba90c1b331863725d028c3bfea2c2

      SHA256

      e186527d9b0a7c37e045bc021b59b4283330d7ba0196a598d27aa2601be9ad62

      SHA512

      0b1511640daa85fa19688225d12e46f45ea94bc4771c7b44044666e47b022dd633d8f0da1f7fd6788cf048c94897bfa884b7e847375d538c4fbe66b41f1421db

    • \Users\Admin\AppData\Local\Temp\WindowsDefencler\WindowsDefencler.exe
      Filesize

      479KB

      MD5

      b529c526c39d32ee04e26e1769b2797f

      SHA1

      236584b8cbcba90c1b331863725d028c3bfea2c2

      SHA256

      e186527d9b0a7c37e045bc021b59b4283330d7ba0196a598d27aa2601be9ad62

      SHA512

      0b1511640daa85fa19688225d12e46f45ea94bc4771c7b44044666e47b022dd633d8f0da1f7fd6788cf048c94897bfa884b7e847375d538c4fbe66b41f1421db

    • memory/456-104-0x0000000000000000-mapping.dmp
    • memory/568-82-0x0000000000400000-0x000000000050C000-memory.dmp
      Filesize

      1.0MB

    • memory/568-69-0x0000000000400000-0x000000000050C000-memory.dmp
      Filesize

      1.0MB

    • memory/568-72-0x0000000000400000-0x000000000050C000-memory.dmp
      Filesize

      1.0MB

    • memory/568-75-0x0000000000400000-0x000000000050C000-memory.dmp
      Filesize

      1.0MB

    • memory/568-70-0x000000000048F888-mapping.dmp
    • memory/612-80-0x0000000000000000-mapping.dmp
    • memory/848-78-0x0000000000000000-mapping.dmp
    • memory/976-61-0x0000000000000000-mapping.dmp
    • memory/976-67-0x0000000073CD0000-0x000000007427B000-memory.dmp
      Filesize

      5.7MB

    • memory/976-73-0x0000000073CD0000-0x000000007427B000-memory.dmp
      Filesize

      5.7MB

    • memory/1076-56-0x0000000000000000-mapping.dmp
    • memory/1084-100-0x0000000000000000-mapping.dmp
    • memory/1104-96-0x0000000000000000-mapping.dmp
    • memory/1168-76-0x0000000000000000-mapping.dmp
    • memory/1336-77-0x0000000000000000-mapping.dmp
    • memory/1544-93-0x000000000048F888-mapping.dmp
    • memory/1580-103-0x0000000000000000-mapping.dmp
    • memory/1580-101-0x0000000000000000-mapping.dmp
    • memory/1580-97-0x0000000000000000-mapping.dmp
    • memory/1604-98-0x0000000000000000-mapping.dmp
    • memory/1660-54-0x0000000075F51000-0x0000000075F53000-memory.dmp
      Filesize

      8KB

    • memory/1756-89-0x0000000071910000-0x0000000071EBB000-memory.dmp
      Filesize

      5.7MB

    • memory/1756-95-0x0000000071910000-0x0000000071EBB000-memory.dmp
      Filesize

      5.7MB

    • memory/1756-85-0x0000000000000000-mapping.dmp
    • memory/1788-99-0x0000000000000000-mapping.dmp
    • memory/1812-102-0x0000000000000000-mapping.dmp
    • memory/1828-55-0x0000000000000000-mapping.dmp
    • memory/1840-79-0x0000000000000000-mapping.dmp