Analysis

  • max time kernel
    22s
  • max time network
    164s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    20/01/2024, 11:41

General

  • Target

    6a55e570c9897d5bcdb2da37c4d20e0b.exe

  • Size

    649KB

  • MD5

    6a55e570c9897d5bcdb2da37c4d20e0b

  • SHA1

    2742f1c6b4881aa16f02910ec46ea77de4b194da

  • SHA256

    3064890364e23210d8fa53391c004a4ad7a97d35bb20de13f12727b0a7398628

  • SHA512

    52b9952288476b32918fca301465f24007dc29f1818227399d7df7e78ea8d61ae0ffb02f661f8275a735ce033a099b640283fb07599013c7b76422a13a21a0be

  • SSDEEP

    12288:M6A84PaHhfD/tV9sj5NKR0pau9XGyu2qBVGLQyTPfhv:BAmBpVKHu0Mu9Xo20VGLVP5v

Malware Config

Signatures

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

  • Modifies WinLogon for persistence 2 TTPs 1 IoCs
  • Modifies security service 2 TTPs 1 IoCs
  • Windows security bypass 2 TTPs 2 IoCs
  • Sets file to hidden 1 TTPs 2 IoCs

    Modifies file attributes to stop it showing in Explorer etc.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Windows security modification 2 TTPs 2 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies registry class 1 IoCs
  • Runs ping.exe 1 TTPs 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 48 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 21 IoCs
  • System policy modification 1 TTPs 3 IoCs
  • Views/modifies file attributes 1 TTPs 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\6a55e570c9897d5bcdb2da37c4d20e0b.exe
    "C:\Users\Admin\AppData\Local\Temp\6a55e570c9897d5bcdb2da37c4d20e0b.exe"
    1⤵
    • Modifies WinLogon for persistence
    • Checks computer location settings
    • Adds Run key to start application
    • Modifies registry class
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4540
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp" +s +h
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:3692
      • C:\Windows\SysWOW64\attrib.exe
        attrib "C:\Users\Admin\AppData\Local\Temp" +s +h
        3⤵
        • Sets file to hidden
        • Views/modifies file attributes
        PID:1332
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp\6a55e570c9897d5bcdb2da37c4d20e0b.exe" +s +h
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:3620
      • C:\Windows\SysWOW64\attrib.exe
        attrib "C:\Users\Admin\AppData\Local\Temp\6a55e570c9897d5bcdb2da37c4d20e0b.exe" +s +h
        3⤵
        • Sets file to hidden
        • Views/modifies file attributes
        PID:5100
    • C:\Windupdt\winupdate.exe
      "C:\Windupdt\winupdate.exe"
      2⤵
      • Modifies security service
      • Windows security bypass
      • Executes dropped EXE
      • Windows security modification
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      • System policy modification
      PID:2536
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /k ping 127.0.0.1 -n 5 > NUL&del "C:\Users\Admin\AppData\Local\Temp\6a55e570c9897d5bcdb2da37c4d20e0b.exe"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:1860
  • C:\Windows\SysWOW64\PING.EXE
    ping 127.0.0.1 -n 5
    1⤵
    • Runs ping.exe
    PID:2676

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Windupdt\winupdate.exe

          Filesize

          384KB

          MD5

          4096999cdf78123c8099e51f5d668fb8

          SHA1

          910f2fa6caa58000ae2f9687ddb91a2d5ac164e6

          SHA256

          4e6e178dc4cc7880c466beb4d09396d8bec815fb92202f0a5744d12c54462223

          SHA512

          cfc0e79d3b50e340f0850fc72e30f35c3ee3c6eec7e23eacbd1ae532c3bdedbba45875a05ca7710cacbe39b52fc85dcf4fe26ea41397167179e6e7e678a62bb5

        • C:\Windupdt\winupdate.exe

          Filesize

          304KB

          MD5

          0c4112280c62a793909828d06acf32d2

          SHA1

          eb9540bad25b6e8d1577fea84a15526ad2a44bf6

          SHA256

          8c13d9f495cff0cc9bb4a46f96479db3d69c2e895a311028f106e51a8b95d53e

          SHA512

          8b967a900296714bfeea8e737cbca368f7e8a849f25bf6e4f0cd6c59faab85bab47b451667946148916f0d57527c83d1b375161040404d7feb3d051ace735059

        • C:\Windupdt\winupdate.exe

          Filesize

          308KB

          MD5

          1c8a0fd90dedb1ab5342ed2084ac161a

          SHA1

          847f16daa4def68f7b872188bf65b7d713c2b72d

          SHA256

          643d4b35db818a64260e5167d5cafebb5217320fb07b54618088a46930762031

          SHA512

          8bdbc74f10d35f9f13c8c42340f172a3696105dcceb797c399ea97108f442c823760375ae0d4a7291b20160306878cf356fa91dc29e968e77eb45378ed1e8761

        • memory/2536-40-0x0000000000400000-0x00000000004B4000-memory.dmp

          Filesize

          720KB

        • memory/2536-42-0x0000000000400000-0x00000000004B4000-memory.dmp

          Filesize

          720KB

        • memory/2536-35-0x0000000002710000-0x0000000002711000-memory.dmp

          Filesize

          4KB

        • memory/2536-36-0x0000000000400000-0x00000000004B4000-memory.dmp

          Filesize

          720KB

        • memory/2536-37-0x0000000000400000-0x00000000004B4000-memory.dmp

          Filesize

          720KB

        • memory/2536-38-0x0000000000400000-0x00000000004B4000-memory.dmp

          Filesize

          720KB

        • memory/2536-39-0x0000000000400000-0x00000000004B4000-memory.dmp

          Filesize

          720KB

        • memory/2536-49-0x0000000000400000-0x00000000004B4000-memory.dmp

          Filesize

          720KB

        • memory/2536-41-0x0000000000400000-0x00000000004B4000-memory.dmp

          Filesize

          720KB

        • memory/2536-48-0x0000000000400000-0x00000000004B4000-memory.dmp

          Filesize

          720KB

        • memory/2536-43-0x0000000000400000-0x00000000004B4000-memory.dmp

          Filesize

          720KB

        • memory/2536-44-0x0000000000400000-0x00000000004B4000-memory.dmp

          Filesize

          720KB

        • memory/2536-45-0x0000000000400000-0x00000000004B4000-memory.dmp

          Filesize

          720KB

        • memory/2536-46-0x0000000000400000-0x00000000004B4000-memory.dmp

          Filesize

          720KB

        • memory/2536-47-0x0000000000400000-0x00000000004B4000-memory.dmp

          Filesize

          720KB

        • memory/4540-34-0x0000000000400000-0x00000000004B4000-memory.dmp

          Filesize

          720KB

        • memory/4540-0-0x00000000022A0000-0x00000000022A1000-memory.dmp

          Filesize

          4KB