Analysis

  • max time kernel
    150s
  • max time network
    122s
  • platform
    windows7_x64
  • resource
    win7-20240220-en
  • resource tags

    arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
  • submitted
    24/02/2024, 06:24

General

  • Target

    a12a55725a718d2a60609ee4abbbb445.exe

  • Size

    902KB

  • MD5

    a12a55725a718d2a60609ee4abbbb445

  • SHA1

    d429ca448c7ac0363280c10d82e36f92beff2614

  • SHA256

    8928b45380323bdcfd83430c2f76bd5ea9b5d011b4b3c4e575dc13d98cb04f5d

  • SHA512

    71730d78380a1bc455ec3e0eceb191041b8e64e8abf400f02b898e995d8f89574751c69ab8c4a42527469b78f661271aad652cfc063688401257a129c54cbe90

  • SSDEEP

    12288:lZKhDHZODNZyY5qMeR59vz9jflkMY0rLnY9L73iW:8D5ONZyY5Fe39zHkMDrLY57SW

Malware Config

Extracted

Family

darkcomet

Botnet

1.2

C2

ahmedb123.no-ip.info:100

Mutex

DCMIN_MUTEX-78CGXEQ

Attributes
  • gencode

    lcvuN82zr4Gu

  • install

    false

  • offline_keylogger

    true

  • persistence

    false

Signatures

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

  • Drops startup file 2 IoCs
  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 3 IoCs
  • Uses the VBS compiler for execution 1 TTPs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Runs ping.exe 1 TTPs 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 23 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 33 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\a12a55725a718d2a60609ee4abbbb445.exe
    "C:\Users\Admin\AppData\Local\Temp\a12a55725a718d2a60609ee4abbbb445.exe"
    1⤵
    • Loads dropped DLL
    • Adds Run key to start application
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:2552
    • C:\Users\Admin\AppData\Local\Temp\plugtemp\Microsoft Office.exe
      "C:\Users\Admin\AppData\Local\Temp\\plugtemp\Microsoft Office.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      PID:2512
    • C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
      "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\brs23-ga.cmdline"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:2408
      • C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
        C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES17A7.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc17A6.tmp"
        3⤵
          PID:2372
      • C:\Users\Admin\AppData\Roaming\a12a55725a718d2a60609ee4abbbb4451.exe
        "C:\Users\Admin\AppData\Roaming\a12a55725a718d2a60609ee4abbbb4451.exe"
        2⤵
        • Drops startup file
        • Executes dropped EXE
        PID:2488
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /C ping 1.1.1.1 -n 1 -w 3000 > Nul & Del "C:\Users\Admin\AppData\Local\Temp\a12a55725a718d2a60609ee4abbbb445.exe"
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:1800
        • C:\Windows\SysWOW64\PING.EXE
          ping 1.1.1.1 -n 1 -w 3000
          3⤵
          • Runs ping.exe
          PID:2672

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\RES17A7.tmp

      Filesize

      1KB

      MD5

      a8c43f6c3303e85813ad456c50734074

      SHA1

      f622d952d843d1da77b3a078203e20721dd11e0b

      SHA256

      d0a82ad3ec98957cf626ec3a513a09947b97a874c64edb4052f54e080ed74bb9

      SHA512

      b0a78d5357de8a3c550fa7ba125a4c03eb44b7efad44eef61c853f4db6dd638def2982d68bf4163af21c5439555e4429558d69e43351b4fd1d18187648865136

    • C:\Users\Admin\AppData\Local\Temp\brs23-ga.0.vb

      Filesize

      336B

      MD5

      c2252ef57f687d457944080f94288704

      SHA1

      eb46293069494d72dd95cc1a94a0d8b9637ead05

      SHA256

      bfe7a40827afd7051edc6dc0262ef77d99ef437783b621cae8874d132898cd45

      SHA512

      ea57e6f61171cbee3f73ef0ef350db9e4ddfce44cc513c1b1dde8bb4e7007bdf2a29754a9fe279398fbd188dcc0fe278525733dbc74fa4e5474fe384bf9f429b

    • C:\Users\Admin\AppData\Local\Temp\brs23-ga.cmdline

      Filesize

      221B

      MD5

      7b4b2d9f5b0e3ea6f2c4fb3fcdbdff95

      SHA1

      0755e1e459638b74d367e69a9859372310e63b37

      SHA256

      3f1ab6e67d51ec8fcb1943bfe559b16cb169865eaeaee50b4e7a6fee3087b70f

      SHA512

      2798cc1146bc01517eb83fb0946df3b3a2cce386e30b9bb7b144cddc6c28d177c15379b7276a5ab73ac9cd748f7d4df2a485a0a56c83894fc4aa915d3d6e64d1

    • C:\Users\Admin\AppData\Local\Temp\vbc17A6.tmp

      Filesize

      748B

      MD5

      1a72a5149e0b64b0dec97862c05507f9

      SHA1

      daf3596436d8fc0870276d2db1e7c4411f85bc12

      SHA256

      7e67b10eaad4f0ef01f9d1f7e24e33ed4d03559434545fc350b8f4905c398984

      SHA512

      cda0d39904a285fac076e7acec7982a5c5b950b3ca92352a5b9e3802054fb8dd80c68c80408cda306d439bd5cca5071d7b865745e98c4887303873e87326f298

    • C:\Users\Admin\AppData\Roaming\a12a55725a718d2a60609ee4abbbb445.exe

      Filesize

      902KB

      MD5

      a12a55725a718d2a60609ee4abbbb445

      SHA1

      d429ca448c7ac0363280c10d82e36f92beff2614

      SHA256

      8928b45380323bdcfd83430c2f76bd5ea9b5d011b4b3c4e575dc13d98cb04f5d

      SHA512

      71730d78380a1bc455ec3e0eceb191041b8e64e8abf400f02b898e995d8f89574751c69ab8c4a42527469b78f661271aad652cfc063688401257a129c54cbe90

    • C:\Users\Admin\AppData\Roaming\a12a55725a718d2a60609ee4abbbb4451.exe

      Filesize

      6KB

      MD5

      ca46e339b8d38edcc5d34ef61b8fac3d

      SHA1

      61323d491cad81f8dfdec83dd30c13e01cbc2572

      SHA256

      57aa3b6858347dcd8b247c1b68473657f8bfd2e733d22cdca01a571c6ac32101

      SHA512

      246ae3e0114b81718424dff3ffcad5bc47eb3f02d2ac3ffba94a1a1f36d4dd9d5da7c71a2ac5fa000cd8cf422bab6e261f759e0c8ec04cfe4f4ed3a5c1f8d74d

    • \Users\Admin\AppData\Local\Temp\plugtemp\Microsoft Office.exe

      Filesize

      1.1MB

      MD5

      34aa912defa18c2c129f1e09d75c1d7e

      SHA1

      9c3046324657505a30ecd9b1fdb46c05bde7d470

      SHA256

      6df94b7fa33f1b87142adc39b3db0613fc520d9e7a5fd6a5301dd7f51f8d0386

      SHA512

      d1ea9368f5d7166180612fd763c87afb647d088498887961f5e7fb0a10f4a808bd5928e8a3666d70ff794093c51ecca8816f75dd47652fd4eb23dce7f9aa1f98

    • memory/2408-40-0x0000000001EF0000-0x0000000001F30000-memory.dmp

      Filesize

      256KB

    • memory/2488-60-0x0000000074EC0000-0x000000007546B000-memory.dmp

      Filesize

      5.7MB

    • memory/2488-58-0x0000000074EC0000-0x000000007546B000-memory.dmp

      Filesize

      5.7MB

    • memory/2488-55-0x00000000005C0000-0x0000000000600000-memory.dmp

      Filesize

      256KB

    • memory/2488-54-0x0000000074EC0000-0x000000007546B000-memory.dmp

      Filesize

      5.7MB

    • memory/2512-24-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

      Filesize

      4KB

    • memory/2512-66-0x0000000000400000-0x00000000004B0000-memory.dmp

      Filesize

      704KB

    • memory/2512-28-0x0000000000400000-0x00000000004B0000-memory.dmp

      Filesize

      704KB

    • memory/2512-29-0x0000000000400000-0x00000000004B0000-memory.dmp

      Filesize

      704KB

    • memory/2512-31-0x0000000000400000-0x00000000004B0000-memory.dmp

      Filesize

      704KB

    • memory/2512-30-0x0000000000400000-0x00000000004B0000-memory.dmp

      Filesize

      704KB

    • memory/2512-33-0x0000000000400000-0x00000000004B0000-memory.dmp

      Filesize

      704KB

    • memory/2512-32-0x0000000000400000-0x00000000004B0000-memory.dmp

      Filesize

      704KB

    • memory/2512-35-0x0000000000280000-0x0000000000281000-memory.dmp

      Filesize

      4KB

    • memory/2512-76-0x0000000000400000-0x00000000004B0000-memory.dmp

      Filesize

      704KB

    • memory/2512-22-0x0000000000400000-0x00000000004B0000-memory.dmp

      Filesize

      704KB

    • memory/2512-20-0x0000000000400000-0x00000000004B0000-memory.dmp

      Filesize

      704KB

    • memory/2512-18-0x0000000000400000-0x00000000004B0000-memory.dmp

      Filesize

      704KB

    • memory/2512-16-0x0000000000400000-0x00000000004B0000-memory.dmp

      Filesize

      704KB

    • memory/2512-14-0x0000000000400000-0x00000000004B0000-memory.dmp

      Filesize

      704KB

    • memory/2512-12-0x0000000000400000-0x00000000004B0000-memory.dmp

      Filesize

      704KB

    • memory/2512-10-0x0000000000400000-0x00000000004B0000-memory.dmp

      Filesize

      704KB

    • memory/2512-8-0x0000000000400000-0x00000000004B0000-memory.dmp

      Filesize

      704KB

    • memory/2512-75-0x0000000000400000-0x00000000004B0000-memory.dmp

      Filesize

      704KB

    • memory/2512-74-0x0000000000400000-0x00000000004B0000-memory.dmp

      Filesize

      704KB

    • memory/2512-73-0x0000000000400000-0x00000000004B0000-memory.dmp

      Filesize

      704KB

    • memory/2512-62-0x0000000000400000-0x00000000004B0000-memory.dmp

      Filesize

      704KB

    • memory/2512-63-0x0000000000400000-0x00000000004B0000-memory.dmp

      Filesize

      704KB

    • memory/2512-64-0x0000000000400000-0x00000000004B0000-memory.dmp

      Filesize

      704KB

    • memory/2512-65-0x0000000000400000-0x00000000004B0000-memory.dmp

      Filesize

      704KB

    • memory/2512-26-0x0000000000400000-0x00000000004B0000-memory.dmp

      Filesize

      704KB

    • memory/2512-67-0x0000000000400000-0x00000000004B0000-memory.dmp

      Filesize

      704KB

    • memory/2512-68-0x0000000000400000-0x00000000004B0000-memory.dmp

      Filesize

      704KB

    • memory/2512-69-0x0000000000400000-0x00000000004B0000-memory.dmp

      Filesize

      704KB

    • memory/2512-70-0x0000000000400000-0x00000000004B0000-memory.dmp

      Filesize

      704KB

    • memory/2512-71-0x0000000000400000-0x00000000004B0000-memory.dmp

      Filesize

      704KB

    • memory/2512-72-0x0000000000400000-0x00000000004B0000-memory.dmp

      Filesize

      704KB

    • memory/2552-61-0x0000000074EC0000-0x000000007546B000-memory.dmp

      Filesize

      5.7MB

    • memory/2552-1-0x0000000074EC0000-0x000000007546B000-memory.dmp

      Filesize

      5.7MB

    • memory/2552-2-0x0000000000AD0000-0x0000000000B10000-memory.dmp

      Filesize

      256KB

    • memory/2552-0-0x0000000074EC0000-0x000000007546B000-memory.dmp

      Filesize

      5.7MB