Analysis

  • max time kernel
    131s
  • max time network
    143s
  • platform
    windows7_x64
  • resource
    win7-20231215-en
  • resource tags

    arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
  • submitted
    20/01/2024, 18:09

General

  • Target

    6b18a6b20832fb7929ccb4b3043f3218.exe

  • Size

    964KB

  • MD5

    6b18a6b20832fb7929ccb4b3043f3218

  • SHA1

    6f35aca55396af3e9f8e6939c4ee1bfb3f5bc69a

  • SHA256

    70635ba75fdb495bb4c0209f26176f0c0d40fd294c8b39898f18742f2e55ce20

  • SHA512

    f69815bc4bead7481be0ecaa43eb53b32c26a5502e40f4b3f68789534cf501246528a35e86bf3b092aed4864691192527414c7c949327c7610e1659377b230f9

  • SSDEEP

    24576:CMFvr6fMVQXwU23E/0iprDKUHSIHzOIfbfxRwv6lRu9xitRHsn:CMFO+QXwb3xGmDIHzOIfjblRuCto

Malware Config

Extracted

Family

darkcomet

Botnet

Guest16

C2

84.72.27.213:1604

Mutex

DC_MUTEX-3WNETRQ

Attributes
  • InstallPath

    MSDCSC\msdcsc.exe

  • gencode

    RJVLW58TNDYF

  • install

    true

  • offline_keylogger

    true

  • persistence

    false

  • reg_key

    MicroUpdate

Signatures

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

  • Modifies WinLogon for persistence 2 TTPs 1 IoCs
  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 3 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Writes to the Master Boot Record (MBR) 1 TTPs 3 IoCs

    Bootkits write to the MBR to gain persistence at a level below the operating system.

  • Suspicious use of SetThreadContext 4 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 49 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\6b18a6b20832fb7929ccb4b3043f3218.exe
    "C:\Users\Admin\AppData\Local\Temp\6b18a6b20832fb7929ccb4b3043f3218.exe"
    1⤵
    • Writes to the Master Boot Record (MBR)
    • Suspicious use of SetThreadContext
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2612
    • C:\Users\Admin\AppData\Local\Temp\6b18a6b20832fb7929ccb4b3043f3218.exe
      "C:\Users\Admin\AppData\Local\Temp\6b18a6b20832fb7929ccb4b3043f3218.exe"
      2⤵
      • Modifies WinLogon for persistence
      • Loads dropped DLL
      • Adds Run key to start application
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:1940
      • C:\Users\Admin\Documents\MSDCSC\msdcsc.exe
        "C:\Users\Admin\Documents\MSDCSC\msdcsc.exe"
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Writes to the Master Boot Record (MBR)
        • Suspicious use of SetThreadContext
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:2748
        • C:\Users\Admin\Documents\MSDCSC\msdcsc.exe
          "C:\Users\Admin\Documents\MSDCSC\msdcsc.exe"
          4⤵
          • Executes dropped EXE
          • Suspicious use of SetThreadContext
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:2536
          • C:\Program Files (x86)\Internet Explorer\iexplore.exe
            "C:\Program Files (x86)\Internet Explorer\iexplore.exe"
            5⤵
            • Writes to the Master Boot Record (MBR)
            • Suspicious use of SetThreadContext
            • Suspicious use of SetWindowsHookEx
            • Suspicious use of WriteProcessMemory
            PID:2528
  • C:\Program Files (x86)\Internet Explorer\iexplore.exe
    "C:\Program Files (x86)\Internet Explorer\iexplore.exe"
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    PID:2560

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\Documents\MSDCSC\msdcsc.exe

          Filesize

          964KB

          MD5

          6b18a6b20832fb7929ccb4b3043f3218

          SHA1

          6f35aca55396af3e9f8e6939c4ee1bfb3f5bc69a

          SHA256

          70635ba75fdb495bb4c0209f26176f0c0d40fd294c8b39898f18742f2e55ce20

          SHA512

          f69815bc4bead7481be0ecaa43eb53b32c26a5502e40f4b3f68789534cf501246528a35e86bf3b092aed4864691192527414c7c949327c7610e1659377b230f9

        • C:\Users\Admin\Documents\MSDCSC\msdcsc.exe

          Filesize

          823KB

          MD5

          7617c14e04407e82bbec55f07f6e3f55

          SHA1

          c9704a54b9077790394868c0b04f0e34ae3805ef

          SHA256

          c259d6579356f15594eaf963c5e620ae15f16ab84a3715d66390f94997f4f68c

          SHA512

          5272bf36b1f43c0a03c60e7d23afe2b15ba2a5f927260f25db46b22353d1c2445b4e4bf82fa2ae83b1ee2d17256f9be42f73124a69897e5ea414ee51236ad3cb

        • \Users\Admin\Documents\MSDCSC\msdcsc.exe

          Filesize

          917KB

          MD5

          c9a40619dfdc1dada43c412323a32069

          SHA1

          667962426ebd67c057ad286f91e8f91b9c20e3bf

          SHA256

          da8b4dac71272c87c9340886ca40a70e24fd566d4ac7b3a8b3072d7789af9f35

          SHA512

          01ee538fc6cb872d1e4c0f65e53cb38cae975236003e1dae86641950ddab15e548ae0468527d66b5f8ed8534020cadb1c0fb8e6fdccbc456bd8c72cb025a3bf9

        • \Users\Admin\Documents\MSDCSC\msdcsc.exe

          Filesize

          920KB

          MD5

          fc65b192df46c0032665308e99e38a8e

          SHA1

          08ea4b9c54456f97b2502e615dc84f0e9d6c5e98

          SHA256

          71e059fa78fa9f26226e1714295507cf4282dc73899a36a559fe65e5365c32a7

          SHA512

          c76a76acdba663b5859a5a4af70e400a1676cd87c57a19d9c80a3817b3927f88c4322bd96ff17783caff7d1cbea49ac9de274beb361b4a1943bf34d764227afc

        • memory/1940-23-0x0000000000400000-0x00000000004F2000-memory.dmp

          Filesize

          968KB

        • memory/1940-10-0x0000000000400000-0x00000000004F2000-memory.dmp

          Filesize

          968KB

        • memory/1940-14-0x0000000000400000-0x00000000004F2000-memory.dmp

          Filesize

          968KB

        • memory/1940-16-0x0000000000400000-0x00000000004F2000-memory.dmp

          Filesize

          968KB

        • memory/1940-18-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

          Filesize

          4KB

        • memory/1940-20-0x0000000000400000-0x00000000004F2000-memory.dmp

          Filesize

          968KB

        • memory/1940-21-0x0000000000400000-0x00000000004F2000-memory.dmp

          Filesize

          968KB

        • memory/1940-22-0x0000000000400000-0x00000000004F2000-memory.dmp

          Filesize

          968KB

        • memory/1940-2-0x0000000000400000-0x00000000004F2000-memory.dmp

          Filesize

          968KB

        • memory/1940-24-0x0000000000400000-0x00000000004F2000-memory.dmp

          Filesize

          968KB

        • memory/1940-25-0x0000000000240000-0x0000000000241000-memory.dmp

          Filesize

          4KB

        • memory/1940-12-0x0000000000400000-0x00000000004F2000-memory.dmp

          Filesize

          968KB

        • memory/1940-8-0x0000000000400000-0x00000000004F2000-memory.dmp

          Filesize

          968KB

        • memory/1940-6-0x0000000000400000-0x00000000004F2000-memory.dmp

          Filesize

          968KB

        • memory/1940-36-0x0000000000400000-0x00000000004F2000-memory.dmp

          Filesize

          968KB

        • memory/1940-4-0x0000000000400000-0x00000000004F2000-memory.dmp

          Filesize

          968KB

        • memory/2528-67-0x0000000000400000-0x00000000004F1000-memory.dmp

          Filesize

          964KB

        • memory/2536-63-0x0000000000400000-0x00000000004F2000-memory.dmp

          Filesize

          968KB

        • memory/2536-64-0x0000000000400000-0x00000000004F2000-memory.dmp

          Filesize

          968KB

        • memory/2536-68-0x0000000000400000-0x00000000004F2000-memory.dmp

          Filesize

          968KB

        • memory/2536-66-0x00000000001D0000-0x00000000001D1000-memory.dmp

          Filesize

          4KB

        • memory/2536-65-0x0000000000400000-0x00000000004F2000-memory.dmp

          Filesize

          968KB