Analysis

  • max time kernel
    142s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    20/01/2024, 20:51

General

  • Target

    6b72b066e97055e859d4c4fe1e2ce84b.exe

  • Size

    251KB

  • MD5

    6b72b066e97055e859d4c4fe1e2ce84b

  • SHA1

    d5ad14292e12510c9389508220c288bb7a43b2be

  • SHA256

    8e5f1c5943a1f7d03bba72b77f532a3c46f314d1cf1eb4dd6e651b5168a90a76

  • SHA512

    cbe0d4f87beed4f0363c8a6b4451ea2307ea6d1c69122b462e938a839ce2f582338fe362137dd93ea1f792613b5b151a2278a88e3486dd1cd66ccf957af6c3e8

  • SSDEEP

    6144:ocNYS996KFifeVjBpeExgVTFSXFoMc5RhCaL37p:ocW7KEZlPzCy37p

Malware Config

Extracted

Family

darkcomet

Botnet

Guest16

C2

speeed.zapto.org:15963

speeed.hopto.org:15963

Mutex

DC_MUTEX-7CAR0WV

Attributes
  • InstallPath

    MSDCSC\msdcsc.exe

  • gencode

    rxLxJDdtvsZV

  • install

    true

  • offline_keylogger

    true

  • persistence

    true

  • reg_key

    MicroUpdate

Signatures

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

  • Modifies WinLogon for persistence 2 TTPs 1 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • UPX packed file 5 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Adds Run key to start application 2 TTPs 2 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies registry class 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\6b72b066e97055e859d4c4fe1e2ce84b.exe
    "C:\Users\Admin\AppData\Local\Temp\6b72b066e97055e859d4c4fe1e2ce84b.exe"
    1⤵
    • Modifies WinLogon for persistence
    • Checks computer location settings
    • Adds Run key to start application
    • Modifies registry class
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3660
    • C:\Users\Admin\Documents\MSDCSC\msdcsc.exe
      "C:\Users\Admin\Documents\MSDCSC\msdcsc.exe"
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of SetThreadContext
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:4860
      • C:\Program Files (x86)\Internet Explorer\iexplore.exe
        "C:\Program Files (x86)\Internet Explorer\iexplore.exe"
        3⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:4268

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\Documents\MSDCSC\msdcsc.exe

          Filesize

          251KB

          MD5

          6b72b066e97055e859d4c4fe1e2ce84b

          SHA1

          d5ad14292e12510c9389508220c288bb7a43b2be

          SHA256

          8e5f1c5943a1f7d03bba72b77f532a3c46f314d1cf1eb4dd6e651b5168a90a76

          SHA512

          cbe0d4f87beed4f0363c8a6b4451ea2307ea6d1c69122b462e938a839ce2f582338fe362137dd93ea1f792613b5b151a2278a88e3486dd1cd66ccf957af6c3e8

        • memory/3660-0-0x0000000000400000-0x00000000004B7000-memory.dmp

          Filesize

          732KB

        • memory/3660-1-0x0000000000AB0000-0x0000000000AB1000-memory.dmp

          Filesize

          4KB

        • memory/3660-65-0x0000000000400000-0x00000000004B7000-memory.dmp

          Filesize

          732KB

        • memory/4268-63-0x0000000000400000-0x00000000004B7000-memory.dmp

          Filesize

          732KB

        • memory/4860-62-0x00000000008D0000-0x00000000008D1000-memory.dmp

          Filesize

          4KB

        • memory/4860-64-0x0000000000400000-0x00000000004B7000-memory.dmp

          Filesize

          732KB