Analysis

  • max time kernel
    155s
  • max time network
    31s
  • platform
    windows7_x64
  • resource
    win7-20221111-en
  • resource tags

    arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
  • submitted
    02-12-2022 21:52

General

  • Target

    c9d9ff232e23f1e7231a091c86955c070caf3002553713a9c3ff41d4eba37f07.exe

  • Size

    596KB

  • MD5

    82b6847860a2fb6ae84badda650bec3c

  • SHA1

    fee9fcad16bef3b27a37696aa9d52bf5add80a6d

  • SHA256

    c9d9ff232e23f1e7231a091c86955c070caf3002553713a9c3ff41d4eba37f07

  • SHA512

    2d55988f51f0e1cf4c7f85020ac6f21c37dcf5846295541db98eee4acf2b7a1c70a3f5da1dbc75feeaf2f0105e0525d2d57ecaf0b8db4196dcc2c2c3dd209b7b

  • SSDEEP

    12288:6Fc1GUux1KgyM+23XN+GzKyUcAn21+srdO4gAblgKLsfPCPTPC:6Fc18v+2nN+3ytAnDwiKLEeTK

Malware Config

Extracted

Family

darkcomet

Botnet

Guest16

C2

127.0.0.1:1604

Mutex

DC_MUTEX-0PRSAK8

Attributes
  • gencode

    AU83b2dyG2P1

  • install

    false

  • offline_keylogger

    true

  • persistence

    false

Signatures

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious use of AdjustPrivilegeToken 23 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 13 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\c9d9ff232e23f1e7231a091c86955c070caf3002553713a9c3ff41d4eba37f07.exe
    "C:\Users\Admin\AppData\Local\Temp\c9d9ff232e23f1e7231a091c86955c070caf3002553713a9c3ff41d4eba37f07.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1156
    • C:\Users\Admin\AppData\Local\Temp\c9d9ff232e23f1e7231a091c86955c070caf3002553713a9c3ff41d4eba37f07.exe
      "C:\Users\Admin\AppData\Local\Temp\c9d9ff232e23f1e7231a091c86955c070caf3002553713a9c3ff41d4eba37f07.exe"
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      PID:1216

Network

MITRE ATT&CK Matrix ATT&CK v6

Discovery

System Information Discovery

1
T1082

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1216-56-0x0000000000400000-0x00000000004B2000-memory.dmp
    Filesize

    712KB

  • memory/1216-57-0x0000000000400000-0x00000000004B2000-memory.dmp
    Filesize

    712KB

  • memory/1216-59-0x0000000000400000-0x00000000004B2000-memory.dmp
    Filesize

    712KB

  • memory/1216-61-0x0000000000400000-0x00000000004B2000-memory.dmp
    Filesize

    712KB

  • memory/1216-63-0x0000000000400000-0x00000000004B2000-memory.dmp
    Filesize

    712KB

  • memory/1216-65-0x0000000000400000-0x00000000004B2000-memory.dmp
    Filesize

    712KB

  • memory/1216-66-0x0000000000400000-0x00000000004B2000-memory.dmp
    Filesize

    712KB

  • memory/1216-68-0x0000000000400000-0x00000000004B2000-memory.dmp
    Filesize

    712KB

  • memory/1216-70-0x0000000000400000-0x00000000004B2000-memory.dmp
    Filesize

    712KB

  • memory/1216-71-0x000000000048F888-mapping.dmp
  • memory/1216-72-0x0000000000400000-0x00000000004B2000-memory.dmp
    Filesize

    712KB

  • memory/1216-73-0x0000000075091000-0x0000000075093000-memory.dmp
    Filesize

    8KB

  • memory/1216-74-0x0000000000400000-0x00000000004B2000-memory.dmp
    Filesize

    712KB

  • memory/1216-75-0x0000000000400000-0x00000000004B2000-memory.dmp
    Filesize

    712KB

  • memory/1216-76-0x0000000000400000-0x00000000004B2000-memory.dmp
    Filesize

    712KB