Analysis

  • max time kernel
    150s
  • max time network
    155s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240221-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240221-enlocale:en-usos:windows10-2004-x64system
  • submitted
    24/02/2024, 06:24

General

  • Target

    a12a55725a718d2a60609ee4abbbb445.exe

  • Size

    902KB

  • MD5

    a12a55725a718d2a60609ee4abbbb445

  • SHA1

    d429ca448c7ac0363280c10d82e36f92beff2614

  • SHA256

    8928b45380323bdcfd83430c2f76bd5ea9b5d011b4b3c4e575dc13d98cb04f5d

  • SHA512

    71730d78380a1bc455ec3e0eceb191041b8e64e8abf400f02b898e995d8f89574751c69ab8c4a42527469b78f661271aad652cfc063688401257a129c54cbe90

  • SSDEEP

    12288:lZKhDHZODNZyY5qMeR59vz9jflkMY0rLnY9L73iW:8D5ONZyY5Fe39zHkMDrLY57SW

Malware Config

Extracted

Family

darkcomet

Botnet

1.2

C2

ahmedb123.no-ip.info:100

Mutex

DCMIN_MUTEX-78CGXEQ

Attributes
  • gencode

    lcvuN82zr4Gu

  • install

    false

  • offline_keylogger

    true

  • persistence

    false

Signatures

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file 2 IoCs
  • Executes dropped EXE 2 IoCs
  • Uses the VBS compiler for execution 1 TTPs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Runs ping.exe 1 TTPs 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 24 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 29 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\a12a55725a718d2a60609ee4abbbb445.exe
    "C:\Users\Admin\AppData\Local\Temp\a12a55725a718d2a60609ee4abbbb445.exe"
    1⤵
    • Checks computer location settings
    • Adds Run key to start application
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:2860
    • C:\Users\Admin\AppData\Local\Temp\plugtemp\Microsoft Office.exe
      "C:\Users\Admin\AppData\Local\Temp\\plugtemp\Microsoft Office.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      PID:868
    • C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
      "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\pq92skjx.cmdline"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:3168
      • C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
        C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES6EA8.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc89BD032B62EB4EBF8E7DE94FE74E14B5.TMP"
        3⤵
          PID:2660
      • C:\Users\Admin\AppData\Roaming\a12a55725a718d2a60609ee4abbbb4451.exe
        "C:\Users\Admin\AppData\Roaming\a12a55725a718d2a60609ee4abbbb4451.exe"
        2⤵
        • Drops startup file
        • Executes dropped EXE
        PID:4796
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /C ping 1.1.1.1 -n 1 -w 3000 > Nul & Del "C:\Users\Admin\AppData\Local\Temp\a12a55725a718d2a60609ee4abbbb445.exe"
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:2584
        • C:\Windows\SysWOW64\PING.EXE
          ping 1.1.1.1 -n 1 -w 3000
          3⤵
          • Runs ping.exe
          PID:4776

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\RES6EA8.tmp

      Filesize

      1KB

      MD5

      675d49b973583edba9076b9a6fd024f7

      SHA1

      885e5e27f90555d11ae30670dd962d3072fb9e78

      SHA256

      a2500bc9b5ba2012d769954cd68249d44238d7d03309edcf283275c8876e8b82

      SHA512

      cc53b9d9d0485f6729b27ef304dc0e07e3ac5de1722f7723a73c45f22d90392f2733a612335ab486ef71cf641c61d800fee6515e5af43c8dd83a6af00f3015b7

    • C:\Users\Admin\AppData\Local\Temp\plugtemp\Microsoft Office.exe

      Filesize

      1.1MB

      MD5

      d881de17aa8f2e2c08cbb7b265f928f9

      SHA1

      08936aebc87decf0af6e8eada191062b5e65ac2a

      SHA256

      b3a37093609f9a20ad60b85a9fa9de2ba674cba9b5bd687729440c70ba619ca0

      SHA512

      5f23bfb1b8740247b36ed0ab741738c7d4c949736129e767213e321607d1ccd3e3a8428e4ba44bd28a275b5e3f6206285b1a522514b7ef7ea5e698d90a713d34

    • C:\Users\Admin\AppData\Local\Temp\pq92skjx.0.vb

      Filesize

      336B

      MD5

      c2252ef57f687d457944080f94288704

      SHA1

      eb46293069494d72dd95cc1a94a0d8b9637ead05

      SHA256

      bfe7a40827afd7051edc6dc0262ef77d99ef437783b621cae8874d132898cd45

      SHA512

      ea57e6f61171cbee3f73ef0ef350db9e4ddfce44cc513c1b1dde8bb4e7007bdf2a29754a9fe279398fbd188dcc0fe278525733dbc74fa4e5474fe384bf9f429b

    • C:\Users\Admin\AppData\Local\Temp\pq92skjx.cmdline

      Filesize

      221B

      MD5

      1034477c1b5be2dfb055e2099f1652ff

      SHA1

      a37ef8d38e80839d1f27edf2ab500e07f0ad85d1

      SHA256

      0e6b23b64974e5b725196b3029d73d46a4ab58210e62f54b17c419b90af3df06

      SHA512

      e15d1e97da005f174f105c896888790f4b0b390c75b4a40550f4cf416542ff676459b267f680aa7b7c827aa57ca624f839274f788c190941c99de43d7e1be59a

    • C:\Users\Admin\AppData\Local\Temp\vbc89BD032B62EB4EBF8E7DE94FE74E14B5.TMP

      Filesize

      748B

      MD5

      1a72a5149e0b64b0dec97862c05507f9

      SHA1

      daf3596436d8fc0870276d2db1e7c4411f85bc12

      SHA256

      7e67b10eaad4f0ef01f9d1f7e24e33ed4d03559434545fc350b8f4905c398984

      SHA512

      cda0d39904a285fac076e7acec7982a5c5b950b3ca92352a5b9e3802054fb8dd80c68c80408cda306d439bd5cca5071d7b865745e98c4887303873e87326f298

    • C:\Users\Admin\AppData\Roaming\a12a55725a718d2a60609ee4abbbb445.exe

      Filesize

      902KB

      MD5

      a12a55725a718d2a60609ee4abbbb445

      SHA1

      d429ca448c7ac0363280c10d82e36f92beff2614

      SHA256

      8928b45380323bdcfd83430c2f76bd5ea9b5d011b4b3c4e575dc13d98cb04f5d

      SHA512

      71730d78380a1bc455ec3e0eceb191041b8e64e8abf400f02b898e995d8f89574751c69ab8c4a42527469b78f661271aad652cfc063688401257a129c54cbe90

    • C:\Users\Admin\AppData\Roaming\a12a55725a718d2a60609ee4abbbb4451.exe

      Filesize

      6KB

      MD5

      b8d4e4655a5b96d1d4bbef121c4cad6c

      SHA1

      0732100715de94800f43b1f161c09a39141a8bdc

      SHA256

      0dded2fdd38a2881c575befeaea84fa981ef7e6a54f308079345db9485f032ac

      SHA512

      53d7d58d85278dd709e1b51e1e4c64da1956966eb4d8ba8306ff9e3f5d34b38d250fc2311e06cdae9699090731ca9fe36807c3a62944f568a54c85f4c3566d12

    • memory/868-15-0x0000000000400000-0x00000000004B0000-memory.dmp

      Filesize

      704KB

    • memory/868-46-0x0000000000400000-0x00000000004B0000-memory.dmp

      Filesize

      704KB

    • memory/868-14-0x0000000002280000-0x0000000002281000-memory.dmp

      Filesize

      4KB

    • memory/868-19-0x0000000000400000-0x00000000004B0000-memory.dmp

      Filesize

      704KB

    • memory/868-12-0x0000000000400000-0x00000000004B0000-memory.dmp

      Filesize

      704KB

    • memory/868-54-0x0000000000400000-0x00000000004B0000-memory.dmp

      Filesize

      704KB

    • memory/868-10-0x0000000000400000-0x00000000004B0000-memory.dmp

      Filesize

      704KB

    • memory/868-9-0x0000000000400000-0x00000000004B0000-memory.dmp

      Filesize

      704KB

    • memory/868-6-0x0000000000400000-0x00000000004B0000-memory.dmp

      Filesize

      704KB

    • memory/868-53-0x0000000000400000-0x00000000004B0000-memory.dmp

      Filesize

      704KB

    • memory/868-52-0x0000000000400000-0x00000000004B0000-memory.dmp

      Filesize

      704KB

    • memory/868-51-0x0000000000400000-0x00000000004B0000-memory.dmp

      Filesize

      704KB

    • memory/868-50-0x0000000000400000-0x00000000004B0000-memory.dmp

      Filesize

      704KB

    • memory/868-49-0x0000000000400000-0x00000000004B0000-memory.dmp

      Filesize

      704KB

    • memory/868-41-0x0000000000400000-0x00000000004B0000-memory.dmp

      Filesize

      704KB

    • memory/868-42-0x0000000000400000-0x00000000004B0000-memory.dmp

      Filesize

      704KB

    • memory/868-43-0x0000000000400000-0x00000000004B0000-memory.dmp

      Filesize

      704KB

    • memory/868-44-0x0000000000400000-0x00000000004B0000-memory.dmp

      Filesize

      704KB

    • memory/868-45-0x0000000000400000-0x00000000004B0000-memory.dmp

      Filesize

      704KB

    • memory/868-48-0x0000000000400000-0x00000000004B0000-memory.dmp

      Filesize

      704KB

    • memory/868-47-0x0000000000400000-0x00000000004B0000-memory.dmp

      Filesize

      704KB

    • memory/2860-0-0x0000000074890000-0x0000000074E41000-memory.dmp

      Filesize

      5.7MB

    • memory/2860-40-0x0000000074890000-0x0000000074E41000-memory.dmp

      Filesize

      5.7MB

    • memory/2860-2-0x00000000010F0000-0x0000000001100000-memory.dmp

      Filesize

      64KB

    • memory/2860-1-0x0000000074890000-0x0000000074E41000-memory.dmp

      Filesize

      5.7MB

    • memory/3168-21-0x0000000002300000-0x0000000002310000-memory.dmp

      Filesize

      64KB

    • memory/4796-37-0x0000000074890000-0x0000000074E41000-memory.dmp

      Filesize

      5.7MB

    • memory/4796-36-0x0000000074890000-0x0000000074E41000-memory.dmp

      Filesize

      5.7MB