Overview

overview

10

Static

static

c9d13f8443...4e.exe

windows7-x64

10

c9d13f8443...4e.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    151s
  • max time network
    41s
  • platform
    windows7_x64
  • resource
    win7-20220812-en
  • resource tags

    arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
  • submitted
    30-11-2022 21:31

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    c9d13f8443f6eb98d12689b1c30988ffef51a62addb33aeef025918e7a69624e.exe

  • Size

    976KB

  • MD5

    6b9b69e761a41dadcc0adf3b63a43a3c

  • SHA1

    3835417599394198e15c474174dbc2a4b82c5aac

  • SHA256

    c9d13f8443f6eb98d12689b1c30988ffef51a62addb33aeef025918e7a69624e

  • SHA512

    4bb478839a526c81659e210b77d0ea51356f8f3db25f051a9013856a64a50392ffcc5c1fa988cd6968038ef1daed7eba37382f48e7c63a413506f16e068d6e1d

  • SSDEEP

    12288:v/5FWIEv6ZsSNobjXETyTcNgw7E+vGK/wiBnqAFTIMafJzq0QOvRn5a/3ikz16s7:H5FWv6NNobjET/rgfAws6Mabng5lunJc

Score
10/10
darkcometvictimaevasionrattrojan

Malware Config

Extracted

Family

darkcomet

Botnet

victima

C2

127.0.0.1:81

Mutex

DC_MUTEX-D5BBZXB

Attributes
  • gencode

    zbG3XCPRHaix

  • install

    false

  • offline_keylogger

    false

  • persistence

    false

Signatures

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

    trojanratdarkcomet
  • Identifies Wine through registry keys 2 TTPs 1 IoCs

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion
  • Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 23 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\c9d13f8443f6eb98d12689b1c30988ffef51a62addb33aeef025918e7a69624e.exe
    "C:\Users\Admin\AppData\Local\Temp\c9d13f8443f6eb98d12689b1c30988ffef51a62addb33aeef025918e7a69624e.exe"
    1⤵
    • Identifies Wine through registry keys
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:364

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

1
T1497

Credential Access

Discovery

Query Registry

1
T1012

Virtualization/Sandbox Evasion

1
T1497

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/364-54-0x0000000000400000-0x0000000000628000-memory.dmp
    Filesize

    2.2MB

    Download
  • memory/364-55-0x0000000076681000-0x0000000076683000-memory.dmp
    Filesize

    8KB

    Download
  • memory/364-56-0x0000000000400000-0x0000000000628000-memory.dmp
    Filesize

    2.2MB

    Download
  • memory/364-57-0x0000000000400000-0x0000000000628000-memory.dmp
    Filesize

    2.2MB

    Download
  • memory/364-58-0x0000000000400000-0x0000000000628000-memory.dmp
    Filesize

    2.2MB

    Download
  • memory/364-59-0x0000000000400000-0x0000000000628000-memory.dmp
    Filesize

    2.2MB

    Download