Analysis

  • max time kernel
    150s
  • max time network
    123s
  • platform
    windows7_x64
  • resource
    win7-20231129-en
  • resource tags

    arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
  • submitted
    20/01/2024, 20:51

General

  • Target

    6b72b066e97055e859d4c4fe1e2ce84b.exe

  • Size

    251KB

  • MD5

    6b72b066e97055e859d4c4fe1e2ce84b

  • SHA1

    d5ad14292e12510c9389508220c288bb7a43b2be

  • SHA256

    8e5f1c5943a1f7d03bba72b77f532a3c46f314d1cf1eb4dd6e651b5168a90a76

  • SHA512

    cbe0d4f87beed4f0363c8a6b4451ea2307ea6d1c69122b462e938a839ce2f582338fe362137dd93ea1f792613b5b151a2278a88e3486dd1cd66ccf957af6c3e8

  • SSDEEP

    6144:ocNYS996KFifeVjBpeExgVTFSXFoMc5RhCaL37p:ocW7KEZlPzCy37p

Malware Config

Extracted

Family

darkcomet

Botnet

Guest16

C2

speeed.zapto.org:15963

speeed.hopto.org:15963

Mutex

DC_MUTEX-7CAR0WV

Attributes
  • InstallPath

    MSDCSC\msdcsc.exe

  • gencode

    rxLxJDdtvsZV

  • install

    true

  • offline_keylogger

    true

  • persistence

    true

  • reg_key

    MicroUpdate

Signatures

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

  • Modifies WinLogon for persistence 2 TTPs 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 2 IoCs
  • UPX packed file 5 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Adds Run key to start application 2 TTPs 3 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 10 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\6b72b066e97055e859d4c4fe1e2ce84b.exe
    "C:\Users\Admin\AppData\Local\Temp\6b72b066e97055e859d4c4fe1e2ce84b.exe"
    1⤵
    • Modifies WinLogon for persistence
    • Loads dropped DLL
    • Adds Run key to start application
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1720
    • C:\Users\Admin\Documents\MSDCSC\msdcsc.exe
      "C:\Users\Admin\Documents\MSDCSC\msdcsc.exe"
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of SetThreadContext
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2948
      • C:\Program Files (x86)\Internet Explorer\iexplore.exe
        "C:\Program Files (x86)\Internet Explorer\iexplore.exe"
        3⤵
        • Adds Run key to start application
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of SetWindowsHookEx
        PID:2836

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • \Users\Admin\Documents\MSDCSC\msdcsc.exe

          Filesize

          251KB

          MD5

          6b72b066e97055e859d4c4fe1e2ce84b

          SHA1

          d5ad14292e12510c9389508220c288bb7a43b2be

          SHA256

          8e5f1c5943a1f7d03bba72b77f532a3c46f314d1cf1eb4dd6e651b5168a90a76

          SHA512

          cbe0d4f87beed4f0363c8a6b4451ea2307ea6d1c69122b462e938a839ce2f582338fe362137dd93ea1f792613b5b151a2278a88e3486dd1cd66ccf957af6c3e8

        • memory/1720-0-0x0000000000400000-0x00000000004B7000-memory.dmp

          Filesize

          732KB

        • memory/1720-1-0x0000000000260000-0x0000000000261000-memory.dmp

          Filesize

          4KB

        • memory/1720-12-0x0000000004110000-0x00000000041C7000-memory.dmp

          Filesize

          732KB

        • memory/1720-17-0x0000000000400000-0x00000000004B7000-memory.dmp

          Filesize

          732KB

        • memory/2836-15-0x0000000000400000-0x00000000004B7000-memory.dmp

          Filesize

          732KB

        • memory/2948-13-0x0000000000260000-0x0000000000261000-memory.dmp

          Filesize

          4KB

        • memory/2948-16-0x0000000000400000-0x00000000004B7000-memory.dmp

          Filesize

          732KB