Analysis
-
max time kernel
147s -
max time network
121s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
-
submitted
22/12/2023, 15:24
General
-
Target
ты дома.exe
-
Size
251KB
-
MD5
2fa47c27c03a240ab92480e616bffd7d
-
SHA1
2ced379a1e1c430d6605a07c1238c304432a88c8
-
SHA256
fde727b0848e5a0f8052a0307924d286ffcf0647cbdee84718c60ba9407eae8d
-
SHA512
6c35aecadcb29231273d5e6fb8b992c8ce20bec06a21b881c091b38c791685e30f0eb82aac3b32716a4500b32440c780b1be0fcee3500ecf3ceacb3209f9417c
-
SSDEEP
6144:ocNYS996KFifeVjBpeExgVTFSXFoMc5RhCaL37N:ocW7KEZlPzCy37N
Score
10/10
Malware Config
Extracted
Family
darkcomet
Botnet
Guest16
C2
192.168.0.164:27016
192.168.0.164:10048
Mutex
DC_MUTEX-LKMPZA5
Attributes
-
gencode
JBDnv2PpiyDx
-
install
false
-
offline_keylogger
true
-
persistence
false
Signatures
-
Darkcomet
DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
-
Modifies firewall policy service 2 TTPs 3 IoCs
-
Disables RegEdit via registry modification 1 IoCs
-
Disables Task Manager via registry modification
-
UPX packed file 6 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of AdjustPrivilegeToken 24 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\ты дома.exe"C:\Users\Admin\AppData\Local\Temp\ты дома.exe"1⤵
- Modifies firewall policy service
- Disables RegEdit via registry modification
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
732KB
-
Filesize
4KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB