Analysis

  • max time kernel
    120s
  • max time network
    121s
  • platform
    windows7_x64
  • resource
    win7-20231215-en
  • resource tags

    arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
  • submitted
    20/01/2024, 14:11

General

  • Target

    6aa399068d8103d8e7e44c76a04a927f.exe

  • Size

    852KB

  • MD5

    6aa399068d8103d8e7e44c76a04a927f

  • SHA1

    286e985bbbb1aa4568bcc4f36d2c55c80cdc7e34

  • SHA256

    3d849011f1bda6edb5e9eebfb1c639fb0d5d4dc20cfc7605401e661a0ef1ebd2

  • SHA512

    3606ee585d4efee337b69b259c2179e021eb79fc1f76139502c1b4d4ff3a68f6f507af583c1686701f1835747b48a042fb19ddfdda0a916e2f76e1887e4f30e3

  • SSDEEP

    12288:6Ull2QkqHQOzbACXu2eq0yKcRENhm3k60doCcuesI+J2a0gwiKgfpZpjn8kNBDXo:66vNXuain63k60uro2FgwONDBBrCbM2

Malware Config

Signatures

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

  • Modifies WinLogon for persistence 2 TTPs 1 IoCs
  • Drops file in Drivers directory 1 IoCs
  • Checks BIOS information in registry 2 TTPs 1 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Uses the VBS compiler for execution 1 TTPs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Checks processor information in registry 2 TTPs 4 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 23 IoCs
  • Suspicious use of WriteProcessMemory 20 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\6aa399068d8103d8e7e44c76a04a927f.exe
    "C:\Users\Admin\AppData\Local\Temp\6aa399068d8103d8e7e44c76a04a927f.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:1684
    • C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
      C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
      2⤵
      • Modifies WinLogon for persistence
      • Drops file in Drivers directory
      • Checks BIOS information in registry
      • Loads dropped DLL
      • Adds Run key to start application
      • Checks processor information in registry
      • Enumerates system info in registry
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2664
      • C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windupdt\winupdate.exe
        "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windupdt\winupdate.exe"
        3⤵
        • Executes dropped EXE
        PID:2708

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windupdt\winupdate.exe

          Filesize

          237KB

          MD5

          4326c5bcbaf649fd8bc88ef80532c4a5

          SHA1

          bbddc8b8cb109bf39b90ff19d3a37146af690f49

          SHA256

          8e8be1be8c5159db747dcd1454addfd82644e74ddb0375f35ff52f831c429887

          SHA512

          6ea384987b96a0d684822af4d130aad3385eda01b618172d76fa4c048340b908b73425f5d9d52ca7a10481eb553bd09ed0d8bdb24a3c6e48d5e3f6b55492e0b7

        • C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windupdt\winupdate.exe

          Filesize

          186KB

          MD5

          028ba1b5349e19e13e8aaa82c07ee968

          SHA1

          bfabce674641a7733facbaf462e8c8628b2d5acc

          SHA256

          2c56a9575c13e93fdb87c9d0b790ae313c61895e40627541d1ba8c5012b47959

          SHA512

          1287d524033bdfc394460398ced6ae937f56647e5364f85ef8a3fc9ba6db9f87498f29656eb2b647583dcc295c61da1d969fe991fc7f541f784891e7dfc88078

        • C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windupdt\winupdate.exe

          Filesize

          155KB

          MD5

          fde07b7deb47f1739dd6879f3505ebc5

          SHA1

          c5325e9d9eb9f5766061fa88ff55fee70bbd6a4f

          SHA256

          c455c9e8977b4f912bcf7bba61d089aa444101f11ab8a2e5052ad46e637de9cb

          SHA512

          3a50a603743e68f4d3cbcda2c4be31bdf0394fd2bce3408fee3568241f6336bd0e82911e63ebc93febd08adf11373b9c969d734f9dcd2dc41dc34881a357b3ab

        • \ProgramData\Microsoft\Windows\Start Menu\Programs\Windupdt\winupdate.exe

          Filesize

          422KB

          MD5

          a141a3effac6f617f8614a0586c8d406

          SHA1

          72b8dad141ab1ea1ed51ebcf2b7d834f49ed037b

          SHA256

          50b6c15871317bfaa0376230cb537cc8fcfee7277570c34895179dabce8ac776

          SHA512

          ef18f56ae40a4193a4d87d1ad6dd3d426dcd47c895920bd6205274601e853383a34b613c72dca1412d448ab8173892309226c4f537326f1e301e01404429036b

        • memory/1684-1-0x0000000000B20000-0x0000000000B60000-memory.dmp

          Filesize

          256KB

        • memory/1684-0-0x0000000074DC0000-0x000000007536B000-memory.dmp

          Filesize

          5.7MB

        • memory/1684-2-0x0000000074DC0000-0x000000007536B000-memory.dmp

          Filesize

          5.7MB

        • memory/1684-27-0x0000000074DC0000-0x000000007536B000-memory.dmp

          Filesize

          5.7MB

        • memory/2664-21-0x0000000000400000-0x00000000004D9000-memory.dmp

          Filesize

          868KB

        • memory/2664-26-0x0000000000400000-0x00000000004D9000-memory.dmp

          Filesize

          868KB

        • memory/2664-17-0x0000000000400000-0x00000000004D9000-memory.dmp

          Filesize

          868KB

        • memory/2664-22-0x0000000000400000-0x00000000004D9000-memory.dmp

          Filesize

          868KB

        • memory/2664-11-0x0000000000400000-0x00000000004D9000-memory.dmp

          Filesize

          868KB

        • memory/2664-19-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

          Filesize

          4KB

        • memory/2664-13-0x0000000000400000-0x00000000004D9000-memory.dmp

          Filesize

          868KB

        • memory/2664-15-0x0000000000400000-0x00000000004D9000-memory.dmp

          Filesize

          868KB

        • memory/2664-30-0x0000000000400000-0x00000000004D9000-memory.dmp

          Filesize

          868KB

        • memory/2664-29-0x0000000000340000-0x0000000000341000-memory.dmp

          Filesize

          4KB

        • memory/2664-28-0x0000000000400000-0x00000000004D9000-memory.dmp

          Filesize

          868KB

        • memory/2664-3-0x0000000000400000-0x00000000004D9000-memory.dmp

          Filesize

          868KB

        • memory/2664-39-0x0000000000400000-0x00000000004D9000-memory.dmp

          Filesize

          868KB

        • memory/2664-9-0x0000000000400000-0x00000000004D9000-memory.dmp

          Filesize

          868KB

        • memory/2664-5-0x0000000000400000-0x00000000004D9000-memory.dmp

          Filesize

          868KB

        • memory/2664-7-0x0000000000400000-0x00000000004D9000-memory.dmp

          Filesize

          868KB