Analysis

  • max time kernel
    150s
  • max time network
    154s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    20/01/2024, 05:50

General

  • Target

    69a54a68512b406bb10f4ee129efb0a0.exe

  • Size

    1.0MB

  • MD5

    69a54a68512b406bb10f4ee129efb0a0

  • SHA1

    e9b60b8eae1d28b90f4b8c60e862d8a979640533

  • SHA256

    80b29c7ba8d66770d736268a9c1c145cb9e947bbba564953a63818f4b75057df

  • SHA512

    0d6a836ba5613aff5f08c5776b345b036e4f95b3db6dbeb03e84e3366d807ad7762d5a4c2919ca14b0d80e061b42bbfc90c055c3b4815f7fa042a80f866beb1b

  • SSDEEP

    24576:KlgFu58LljQYSa+Ze0Q7Jw1NCY+masfXfNMsgVIt:igFu5c7gZCVmVfXlMs2It

Malware Config

Signatures

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 3 IoCs
  • UPX packed file 19 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Uses the VBS compiler for execution 1 TTPs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • AutoIT Executable 15 IoCs

    AutoIT scripts compiled to PE executables.

  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 25 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 26 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\69a54a68512b406bb10f4ee129efb0a0.exe
    "C:\Users\Admin\AppData\Local\Temp\69a54a68512b406bb10f4ee129efb0a0.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of SetThreadContext
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4160
    • C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe
      "C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\4jxwvv0c.cmdline"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:2620
      • C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
        C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES692B.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC692A.tmp"
        3⤵
          PID:2532
      • C:\Users\Admin\AppData\Local\Temp\ƳƕƏƄȜ.exe
        "C:\Users\Admin\AppData\Local\Temp\ƳƕƏƄȜ.exe"
        2⤵
        • Executes dropped EXE
        • Adds Run key to start application
        PID:3060
      • C:\Users\Admin\AppData\Local\Temp\vbc.exe
        C:\Users\Admin\AppData\Local\Temp\vbc.exe
        2⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of SetWindowsHookEx
        PID:4980
      • C:\Users\Admin\AppData\Local\Temp\OWNBall07.5.exe
        "C:\Users\Admin\AppData\Local\Temp\OWNBall07.5.exe"
        2⤵
        • Executes dropped EXE
        • Suspicious behavior: GetForegroundWindowSpam
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        PID:548

    Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Users\Admin\AppData\Local\Temp\OWNBall07.5.exe

            Filesize

            215KB

            MD5

            140b803258b99fbca65c7b53eac293a9

            SHA1

            4d5e4977d2e4172fdc84d7097c867587c7ebc2ac

            SHA256

            6be5cd2f2ad1149373fa258e0dda41ec229c9bf93738bbf443cc8998d7e049fe

            SHA512

            adb95d332298fe87aab6b57aa733f6954701a6ccd5c4354033e553f047e7bdcbca82e306bed30575b4fed422f3f1d5fd8338456bc719105e0297b617b3add0a4

          • C:\Users\Admin\AppData\Local\Temp\OWNBall07.5.exe

            Filesize

            158KB

            MD5

            8efa6f5ede96903a18dc0523984a0175

            SHA1

            70dc1afa52a42d7049ec4b7b4b6c8d229f77b081

            SHA256

            e1d9ccab412ac2cb12ee0cb9ad876b8fc402ddfdf30143e27ff1ce3013e16020

            SHA512

            9569dd021a826ac611b5c2564e0f96bc3f98098e806938ad4221449578a046cd521187dcd604d351e079fe3dc63acbe2c200fdcf15d61f4065a2d3cbf6fc725d

          • C:\Users\Admin\AppData\Local\Temp\OWNBall07.5.exe

            Filesize

            248KB

            MD5

            3810438caa24ade28b6a997c3e768a4a

            SHA1

            229d27515421dd270bb562c8edc65b40812ccf48

            SHA256

            ea836626b803640aa0eb813040f4880d075ba77e38f92d2009e5e109e375ea0a

            SHA512

            70130ffcc326d49169baf80640e75b3d0d5aa4381bf66f1f52e005f39bd9d3b4d3adb89e29e3dfbe665dded8e1e0dcb2c2ab529b3bc9df66426fc2b71616f5d2

          • C:\Users\Admin\AppData\Local\Temp\RES692B.tmp

            Filesize

            1KB

            MD5

            1de1f6498e67a0a66fe8c822babe6106

            SHA1

            a1b5d2ad0df40b8b67bb7a088e58091bd68c711e

            SHA256

            c0f178b69a450268b4414fee38fb724a8cab206acd9f9e70e1a18fe74cf6715c

            SHA512

            61fc957f85083451ed8df88caab5a0c07262692ce9091abf89ff39710f3f0a2f04ebbd3fd66cf5fb0bb26a942baecc0056a95deade9a1464aa23d0e9531bfc1c

          • C:\Users\Admin\AppData\Local\Temp\vbc.exe

            Filesize

            34KB

            MD5

            e118330b4629b12368d91b9df6488be0

            SHA1

            ce90218c7e3b90df2a3409ec253048bb6472c2fd

            SHA256

            3a0f2936b8c45e8ba3458d69d7859a63844469e698652e15fb56639d32f40cc9

            SHA512

            ac91c04cb20223dbaaf594440cb778dff36e857921be427c8528ba4c6cdb3e8bf8e71e1ae8af7bde9c04ff5b97b379231625bc1a2b66aba2f98cd340cd8a94b0

          • C:\Users\Admin\AppData\Local\Temp\ƳƕƏƄȜ.exe

            Filesize

            4KB

            MD5

            7a2f72f37f477545307762f6d11273c0

            SHA1

            ffb4821621df853d8fa41b08648d0f0c648ef558

            SHA256

            06e6da1d819eb732fd880a4bd582fc97cfdeaa40dbcc4e569e5af4952771a00f

            SHA512

            af88afa5480b786fb765e836aed3ebddec138de701aad314f4832f27d185dec09447ac6bbf43a6a15cc3bfc8c7200b330647478d91fa4394d5c7d1792591263a

          • \??\c:\Users\Admin\AppData\Local\Temp\4jxwvv0c.0.cs

            Filesize

            1KB

            MD5

            ff633b592af11cb80f35b58901a1ec2d

            SHA1

            fb2e0a6beae8b9cd23102aabed44778e4f5eecf5

            SHA256

            e41802aa34ef5aae074052f7c774792cdedcd2d64cb3fed158a3a1c5554005ef

            SHA512

            3d4a1695af31238236a7211ce4df66b904fac151f9076972fc9e17a7b538abcaed96dc0def4e20b4d2bb9eb14ab50545bb7aa5f971c8cacf1d6243a66cc9b5c4

          • \??\c:\Users\Admin\AppData\Local\Temp\4jxwvv0c.cmdline

            Filesize

            263B

            MD5

            b2912fc010d5c5fd0e6df63667aecc8d

            SHA1

            2481efa02d421543f908cd85031dea5c0949267e

            SHA256

            ec4886c588c2b3da16674faaa8e1efaecbdf0ce25b2531435aaf8b76e43cabca

            SHA512

            d5bf248de81683183ac551c000b1a0afd0ca8d05b08465e9eb85e408cb99683aef6b6258b7332ec80e4cd1353c671ec6e87a3dae83500668d3d8212431b48d4b

          • \??\c:\Users\Admin\AppData\Local\Temp\CSC692A.tmp

            Filesize

            636B

            MD5

            cabe319c211b0235717de2ce3fa02ce0

            SHA1

            d7e876e7b1a3d957e91bd927756f782704258247

            SHA256

            81cda2f92eaab8bce309a65f24e1e0a5fe753e352f5f3de122c15dbd1fce4c7e

            SHA512

            0f6a8cc6dea5fc33389a2323c0ee43334fd73e91424dcded01d5feb700d3fc112996f9511a914552e942de7c5541d2e011aee3ae1c30b580060af4b8b5421cc6

          • memory/548-63-0x0000000000400000-0x00000000004C1000-memory.dmp

            Filesize

            772KB

          • memory/548-65-0x0000000000400000-0x00000000004C1000-memory.dmp

            Filesize

            772KB

          • memory/548-51-0x0000000000400000-0x00000000004C1000-memory.dmp

            Filesize

            772KB

          • memory/548-75-0x0000000000400000-0x00000000004C1000-memory.dmp

            Filesize

            772KB

          • memory/548-48-0x0000000000400000-0x00000000004C1000-memory.dmp

            Filesize

            772KB

          • memory/548-73-0x0000000000400000-0x00000000004C1000-memory.dmp

            Filesize

            772KB

          • memory/548-71-0x0000000000400000-0x00000000004C1000-memory.dmp

            Filesize

            772KB

          • memory/548-69-0x0000000000400000-0x00000000004C1000-memory.dmp

            Filesize

            772KB

          • memory/548-67-0x0000000000400000-0x00000000004C1000-memory.dmp

            Filesize

            772KB

          • memory/548-50-0x0000000000400000-0x00000000004C1000-memory.dmp

            Filesize

            772KB

          • memory/548-61-0x0000000000400000-0x00000000004C1000-memory.dmp

            Filesize

            772KB

          • memory/548-59-0x0000000000400000-0x00000000004C1000-memory.dmp

            Filesize

            772KB

          • memory/548-57-0x0000000000400000-0x00000000004C1000-memory.dmp

            Filesize

            772KB

          • memory/548-39-0x0000000000400000-0x00000000004C1000-memory.dmp

            Filesize

            772KB

          • memory/548-55-0x0000000000400000-0x00000000004C1000-memory.dmp

            Filesize

            772KB

          • memory/548-53-0x0000000000400000-0x00000000004C1000-memory.dmp

            Filesize

            772KB

          • memory/2620-8-0x00000000024D0000-0x00000000024E0000-memory.dmp

            Filesize

            64KB

          • memory/3060-21-0x0000000074740000-0x0000000074CF1000-memory.dmp

            Filesize

            5.7MB

          • memory/4160-0-0x0000000074740000-0x0000000074CF1000-memory.dmp

            Filesize

            5.7MB

          • memory/4160-1-0x0000000074740000-0x0000000074CF1000-memory.dmp

            Filesize

            5.7MB

          • memory/4160-41-0x0000000074740000-0x0000000074CF1000-memory.dmp

            Filesize

            5.7MB

          • memory/4160-2-0x0000000000E00000-0x0000000000E10000-memory.dmp

            Filesize

            64KB

          • memory/4980-22-0x0000000000400000-0x00000000004AF000-memory.dmp

            Filesize

            700KB

          • memory/4980-46-0x0000000000400000-0x00000000004AF000-memory.dmp

            Filesize

            700KB

          • memory/4980-56-0x0000000000400000-0x00000000004AF000-memory.dmp

            Filesize

            700KB

          • memory/4980-43-0x0000000000400000-0x00000000004AF000-memory.dmp

            Filesize

            700KB

          • memory/4980-58-0x0000000000400000-0x00000000004AF000-memory.dmp

            Filesize

            700KB

          • memory/4980-44-0x00000000022B0000-0x00000000022B1000-memory.dmp

            Filesize

            4KB

          • memory/4980-60-0x0000000000400000-0x00000000004AF000-memory.dmp

            Filesize

            700KB

          • memory/4980-45-0x0000000000400000-0x00000000004AF000-memory.dmp

            Filesize

            700KB

          • memory/4980-62-0x0000000000400000-0x00000000004AF000-memory.dmp

            Filesize

            700KB

          • memory/4980-49-0x0000000000400000-0x00000000004AF000-memory.dmp

            Filesize

            700KB

          • memory/4980-64-0x0000000000400000-0x00000000004AF000-memory.dmp

            Filesize

            700KB

          • memory/4980-54-0x0000000000400000-0x00000000004AF000-memory.dmp

            Filesize

            700KB

          • memory/4980-66-0x0000000000400000-0x00000000004AF000-memory.dmp

            Filesize

            700KB

          • memory/4980-47-0x0000000000400000-0x00000000004AF000-memory.dmp

            Filesize

            700KB

          • memory/4980-68-0x0000000000400000-0x00000000004AF000-memory.dmp

            Filesize

            700KB

          • memory/4980-42-0x0000000000400000-0x00000000004AF000-memory.dmp

            Filesize

            700KB

          • memory/4980-70-0x0000000000400000-0x00000000004AF000-memory.dmp

            Filesize

            700KB

          • memory/4980-52-0x0000000000400000-0x00000000004AF000-memory.dmp

            Filesize

            700KB

          • memory/4980-72-0x0000000000400000-0x00000000004AF000-memory.dmp

            Filesize

            700KB

          • memory/4980-38-0x0000000000400000-0x00000000004AF000-memory.dmp

            Filesize

            700KB

          • memory/4980-74-0x0000000000400000-0x00000000004AF000-memory.dmp

            Filesize

            700KB

          • memory/4980-27-0x0000000000400000-0x00000000004AF000-memory.dmp

            Filesize

            700KB