Analysis

  • max time kernel
    151s
  • max time network
    155s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220901-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
  • submitted
    01-12-2022 00:59

General

  • Target

    8e45651905f70f9ba0bf329c8eb38c1c6c167694e3c8fd2a32f97c7933a4632e.exe

  • Size

    762KB

  • MD5

    0ed9af9dee28109f70002a762566413f

  • SHA1

    11b7c7c44006636a779cca150443841145d0db23

  • SHA256

    8e45651905f70f9ba0bf329c8eb38c1c6c167694e3c8fd2a32f97c7933a4632e

  • SHA512

    1ea7e142a7c46c3335711d1e06d471d82fda6a22bbf73ec87b27f9e86ab130ecbbe8130f09deb66bb33df95ca82f0a20e05849b20730491403ff46976777301b

  • SSDEEP

    12288:30jpc+Bl7sGIE196M/txC14ZLBsQJaBSY0bHqm2a0YkJJx+w2HOa90lHhQyZfnYa:4pJBNsEjlz84VBs8+X0bqyN6x+w2Hl94

Malware Config

Signatures

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

  • Executes dropped EXE 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 24 IoCs
  • Suspicious use of WriteProcessMemory 26 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\8e45651905f70f9ba0bf329c8eb38c1c6c167694e3c8fd2a32f97c7933a4632e.exe
    "C:\Users\Admin\AppData\Local\Temp\8e45651905f70f9ba0bf329c8eb38c1c6c167694e3c8fd2a32f97c7933a4632e.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:4896
    • C:\Windowswinlogon.exe
      C:\Windowswinlogon.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of SetThreadContext
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:4812
      • C:\Windows\SysWOW64\cmd.exe
        /c net stop MpsSvc
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:4864
        • C:\Windows\SysWOW64\net.exe
          net stop MpsSvc
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:4644
          • C:\Windows\SysWOW64\net1.exe
            C:\Windows\system32\net1 stop MpsSvc
            5⤵
              PID:848
        • C:\Windowswinlogon.exe
          C:\Windowswinlogon.exe
          3⤵
          • Executes dropped EXE
          • Suspicious use of AdjustPrivilegeToken
          PID:4876

    Network

    MITRE ATT&CK Matrix ATT&CK v6

    Persistence

    Registry Run Keys / Startup Folder

    1
    T1060

    Defense Evasion

    Modify Registry

    1
    T1112

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Windowswinlogon.exe
      Filesize

      762KB

      MD5

      0ed9af9dee28109f70002a762566413f

      SHA1

      11b7c7c44006636a779cca150443841145d0db23

      SHA256

      8e45651905f70f9ba0bf329c8eb38c1c6c167694e3c8fd2a32f97c7933a4632e

      SHA512

      1ea7e142a7c46c3335711d1e06d471d82fda6a22bbf73ec87b27f9e86ab130ecbbe8130f09deb66bb33df95ca82f0a20e05849b20730491403ff46976777301b

    • C:\Windowswinlogon.exe
      Filesize

      762KB

      MD5

      0ed9af9dee28109f70002a762566413f

      SHA1

      11b7c7c44006636a779cca150443841145d0db23

      SHA256

      8e45651905f70f9ba0bf329c8eb38c1c6c167694e3c8fd2a32f97c7933a4632e

      SHA512

      1ea7e142a7c46c3335711d1e06d471d82fda6a22bbf73ec87b27f9e86ab130ecbbe8130f09deb66bb33df95ca82f0a20e05849b20730491403ff46976777301b

    • C:\Windowswinlogon.exe
      Filesize

      762KB

      MD5

      0ed9af9dee28109f70002a762566413f

      SHA1

      11b7c7c44006636a779cca150443841145d0db23

      SHA256

      8e45651905f70f9ba0bf329c8eb38c1c6c167694e3c8fd2a32f97c7933a4632e

      SHA512

      1ea7e142a7c46c3335711d1e06d471d82fda6a22bbf73ec87b27f9e86ab130ecbbe8130f09deb66bb33df95ca82f0a20e05849b20730491403ff46976777301b

    • memory/848-143-0x0000000000000000-mapping.dmp
    • memory/4644-142-0x0000000000000000-mapping.dmp
    • memory/4812-132-0x0000000000000000-mapping.dmp
    • memory/4864-136-0x0000000000000000-mapping.dmp
    • memory/4876-141-0x0000000000400000-0x00000000004B1000-memory.dmp
      Filesize

      708KB

    • memory/4876-140-0x0000000000400000-0x00000000004B1000-memory.dmp
      Filesize

      708KB

    • memory/4876-138-0x0000000000400000-0x00000000004B1000-memory.dmp
      Filesize

      708KB

    • memory/4876-137-0x0000000000000000-mapping.dmp
    • memory/4876-144-0x0000000000400000-0x00000000004B1000-memory.dmp
      Filesize

      708KB

    • memory/4876-145-0x0000000000400000-0x00000000004B1000-memory.dmp
      Filesize

      708KB

    • memory/4896-134-0x0000000000550000-0x0000000000556000-memory.dmp
      Filesize

      24KB