Overview

overview

10

Static

static

1

omgf.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    422s
  • max time network
    426s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230220-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
  • submitted
    08-04-2023 09:32

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    omgf.exe

  • Size

    334KB

  • MD5

    94417934059ba8724ff5933a244441da

  • SHA1

    3ac2b1bb84efd7284650ebb25c2a60d4665e8785

  • SHA256

    d530105c5a60d787d0060424b996e547f3db4b2cfd12d1320d56f3b59a2f34e3

  • SHA512

    3a7e6f666bbfc7b054f7d351c54915e16f57339628682fa5ac628619fb6b74e3216a53c79d861ac9f80e211f1df055e7f41f9bd4f83da49ef5883b854e8c2b68

  • SSDEEP

    6144:UMMWJH007FoGoyy3GSrsM/XII6aN2Z1sVd+SK6brDgNqpbn+UnCP8NBKKhcKXbJ:pJH0NGoyYYB7Z10s+DgNqR+T8NBKebJ

Score
10/10
darkcometguest16evasionpersistencerattrojan

Malware Config

Extracted

Family

darkcomet

Botnet

Guest16

C2

147.185.221.212:46856

Mutex

DC_MUTEX-F4BY55C

Attributes
  • InstallPath

    MSDCSC\msdcsc.exe

  • gencode

    K5uLvFjyQEWC

  • install

    true

  • offline_keylogger

    true

  • persistence

    true

  • reg_key

    MicroUpdate

Signatures

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

    trojanratdarkcomet
  • Modifies WinLogon for persistence 2 TTPs 2 IoCs
    persistence
  • Modifies firewall policy service 2 TTPs 8 IoCs
    evasion
  • Modifies security service 2 TTPs 3 IoCs
    evasion
  • Windows security bypass 2 TTPs 6 IoCs
    evasiontrojan
  • Disables RegEdit via registry modification 3 IoCs
    evasion
  • Disables Task Manager via registry modification
    evasion
  • Sets file to hidden 1 TTPs 2 IoCs

    Modifies file attributes to stop it showing in Explorer etc.

    evasion
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Windows security modification 2 TTPs 2 IoCs
    evasiontrojan
  • Adds Run key to start application 2 TTPs 4 IoCs
    persistence
  • Drops desktop.ini file(s) 1 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Modifies data under HKEY_USERS 52 IoCs
  • Modifies registry class 1 IoCs
  • Runs ping.exe 1 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • System policy modification 1 TTPs 3 IoCs
    evasion
  • Views/modifies file attributes 1 TTPs 2 IoCs
    evasion

Processes

  • C:\Users\Admin\AppData\Local\Temp\omgf.exe
    "C:\Users\Admin\AppData\Local\Temp\omgf.exe"
    1⤵
    • Modifies WinLogon for persistence
    • Checks computer location settings
    • Adds Run key to start application
    • Modifies registry class
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:748
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp\omgf.exe" +s +h
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:4272
      • C:\Windows\SysWOW64\attrib.exe
        attrib "C:\Users\Admin\AppData\Local\Temp\omgf.exe" +s +h
        3⤵
        • Sets file to hidden
        • Views/modifies file attributes
        PID:3424
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp" +s +h
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:4544
      • C:\Windows\SysWOW64\attrib.exe
        attrib "C:\Users\Admin\AppData\Local\Temp" +s +h
        3⤵
        • Sets file to hidden
        • Views/modifies file attributes
        PID:976
    • C:\Windows\SysWOW64\notepad.exe
      notepad
      2⤵
        PID:4552
      • C:\Users\Admin\Documents\MSDCSC\msdcsc.exe
        "C:\Users\Admin\Documents\MSDCSC\msdcsc.exe"
        2⤵
        • Modifies firewall policy service
        • Modifies security service
        • Windows security bypass
        • Disables RegEdit via registry modification
        • Executes dropped EXE
        • Windows security modification
        • Adds Run key to start application
        • Suspicious use of SetThreadContext
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        • System policy modification
        PID:3956
        • C:\Program Files (x86)\Internet Explorer\iexplore.exe
          "C:\Program Files (x86)\Internet Explorer\iexplore.exe"
          3⤵
          • Modifies WinLogon for persistence
          • Modifies firewall policy service
          • Modifies security service
          • Windows security bypass
          • Disables RegEdit via registry modification
          • Adds Run key to start application
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious behavior: GetForegroundWindowSpam
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:1432
          • C:\Windows\SysWOW64\notepad.exe
            notepad
            4⤵
              PID:2064
            • C:\Windows\SysWOW64\cmd.exe
              C:\Windows\system32\cmd.exe
              4⤵
              • Suspicious use of WriteProcessMemory
              PID:5000
              • C:\Windows\SysWOW64\PING.EXE
                ping 1.1.1.1
                5⤵
                • Runs ping.exe
                PID:4076
      • C:\Windows\system32\AUDIODG.EXE
        C:\Windows\system32\AUDIODG.EXE 0x4fc 0x4c8
        1⤵
          PID:1704
        • C:\Windows\system32\LogonUI.exe
          "LogonUI.exe" /flags:0x0 /state0:0xa3990055 /state1:0x41c64e6d
          1⤵
          • Drops desktop.ini file(s)
          • Modifies data under HKEY_USERS
          • Suspicious use of SetWindowsHookEx
          PID:664

        Network

        MITRE ATT&CK Matrix ATT&CK v6

        Initial Access

        Execution

        Persistence

        Winlogon Helper DLL

        1
        T1004

        Modify Existing Service

        2
        T1031

        Hidden Files and Directories

        2
        T1158

        Registry Run Keys / Startup Folder

        1
        T1060

        Privilege Escalation

        Defense Evasion

        Modify Registry

        7
        T1112

        Disabling Security Tools

        2
        T1089

        Hidden Files and Directories

        2
        T1158

        Credential Access

        Discovery

        Query Registry

        1
        T1012

        System Information Discovery

        2
        T1082

        Remote System Discovery

        1
        T1018

        Lateral Movement

        Collection

        Exfiltration

        Command and Control

        Impact

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\ProgramData\Microsoft\Windows\SystemData\S-1-5-21-1013461898-3711306144-4198452673-1000\ReadOnly\LockScreen_O\LockScreen___1280_0720_notdimmed.jpg
          Filesize

          307KB

          MD5

          54abf29e7e48fffbcc76271bafb47fec

          SHA1

          f37266fab79af8983080ee79ff2235c38206ab63

          SHA256

          5878638054f33e7f031d7f8c669e6090f2246c7a1daa6d5a03856b1da98023b3

          SHA512

          a667ca802c2f72f9bb69d2dd77170c73c815fae0ae193303a48abf59437a6fd8edbe71a0a5fb4ecbed5fa39841c4bba6e26e47b7011388950737c0f895fd8ed3

          Download Submit
        • C:\Users\Admin\AppData\Roaming\sample.wav
          Filesize

          685B

          MD5

          e57ab2c18b339c60ee5b9a6c6a1ecb87

          SHA1

          e0d2cd3205c204c613d3132b7f7d3830f9ee808f

          SHA256

          c7a517529485bd85eb4a4f614488295af87644aa2eb68b3f3b0800aa22db98aa

          SHA512

          fa6773df0c6d19f12f5815323341f24d08d4e843869b1907f63321bb34e15e2046b6d9344fca21a460f4230fb07d72e043606a61ac377542899ca9c8d81613b6

          Download Submit
        • C:\Users\Admin\Documents\MSDCSC\msdcsc.exe
          Filesize

          334KB

          MD5

          94417934059ba8724ff5933a244441da

          SHA1

          3ac2b1bb84efd7284650ebb25c2a60d4665e8785

          SHA256

          d530105c5a60d787d0060424b996e547f3db4b2cfd12d1320d56f3b59a2f34e3

          SHA512

          3a7e6f666bbfc7b054f7d351c54915e16f57339628682fa5ac628619fb6b74e3216a53c79d861ac9f80e211f1df055e7f41f9bd4f83da49ef5883b854e8c2b68

          Download Submit
        • C:\Users\Admin\Documents\MSDCSC\msdcsc.exe
          Filesize

          334KB

          MD5

          94417934059ba8724ff5933a244441da

          SHA1

          3ac2b1bb84efd7284650ebb25c2a60d4665e8785

          SHA256

          d530105c5a60d787d0060424b996e547f3db4b2cfd12d1320d56f3b59a2f34e3

          SHA512

          3a7e6f666bbfc7b054f7d351c54915e16f57339628682fa5ac628619fb6b74e3216a53c79d861ac9f80e211f1df055e7f41f9bd4f83da49ef5883b854e8c2b68

          Download Submit
        • C:\Users\Admin\Documents\MSDCSC\msdcsc.exe
          Filesize

          334KB

          MD5

          94417934059ba8724ff5933a244441da

          SHA1

          3ac2b1bb84efd7284650ebb25c2a60d4665e8785

          SHA256

          d530105c5a60d787d0060424b996e547f3db4b2cfd12d1320d56f3b59a2f34e3

          SHA512

          3a7e6f666bbfc7b054f7d351c54915e16f57339628682fa5ac628619fb6b74e3216a53c79d861ac9f80e211f1df055e7f41f9bd4f83da49ef5883b854e8c2b68

          Download Submit
        • memory/748-133-0x0000000000400000-0x00000000004E9000-memory.dmp
          Filesize

          932KB

          Download
        • memory/748-136-0x00000000022C0000-0x00000000022C1000-memory.dmp
          Filesize

          4KB

          Download
        • memory/748-200-0x0000000000400000-0x00000000004E9000-memory.dmp
          Filesize

          932KB

          Download
        • memory/1432-197-0x0000000000400000-0x00000000004E9000-memory.dmp
          Filesize

          932KB

          Download
        • memory/2064-199-0x00000000007F0000-0x00000000007F1000-memory.dmp
          Filesize

          4KB

          Download
        • memory/3956-198-0x0000000000400000-0x00000000004E9000-memory.dmp
          Filesize

          932KB

          Download
        • memory/4552-138-0x0000000000AB0000-0x0000000000AB1000-memory.dmp
          Filesize

          4KB

          Download