Analysis
-
max time kernel
448s -
max time network
454s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
-
submitted
04-01-2024 14:44
General
-
Target
stub.exe
-
Size
658KB
-
MD5
680392868a764e811d03ae60c604cb39
-
SHA1
a2d4db80fa9869ab3ff5e8655e18fdda61d0ac26
-
SHA256
2839b0c1800dd17a164fe8f179e9e4769829eee74d89a45552133cbdf28fb6cc
-
SHA512
4baebbd8d47630689c8ea020cd7debb4fae18bfa50e9915ab0851976545bca2d99920b2732f1c18d77500a060f103e4bdc72266a8525437d27397a738ebdaac1
-
SSDEEP
12288:i9HFJ9rJxRX1uVVjoaWSoynxdO1FVBaOiRZTERfIhNkNCCLo9Ek5C/hv:OZ1xuVVjfFoynPaVBUR8f+kN10EBV
Score
10/10
Malware Config
Extracted
Family
darkcomet
Botnet
Guest16_min
C2
sp1oorat.ddns.net:1604
Mutex
DCMIN_MUTEX-R0P3PJW
Attributes
-
gencode
LKklt4MiodXP
-
install
false
-
offline_keylogger
true
-
persistence
false
Signatures
-
Darkcomet
DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
-
Drops file in Drivers directory 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of AdjustPrivilegeToken 23 IoCs
-
Suspicious use of FindShellTrayWindow 6 IoCs
-
Suspicious use of SetWindowsHookEx 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\stub.exe"C:\Users\Admin\AppData\Local\Temp\stub.exe"1⤵
- Drops file in Drivers directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\DllHost.exeC:\Windows\SysWOW64\DllHost.exe /Processid:{3F6B5E16-092A-41ED-930B-0B4125D91D4E}1⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
-
Filesize
712KB
-
Filesize
4KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB