Analysis

  • max time kernel
    150s
  • max time network
    123s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    24/02/2024, 05:38

General

  • Target

    a113e103d28318c83c0d625de33e089b.exe

  • Size

    488KB

  • MD5

    a113e103d28318c83c0d625de33e089b

  • SHA1

    023dc01fcf484ee6f23fa7f7e943a78528b5ee21

  • SHA256

    051ca838d355275a998d6e3153244826c7c2fe090e775cd99063ddcce30277a5

  • SHA512

    b664d85b93807c0feb7e1f9449dd505c62176786c86ddf5ddf497a8804d424fe8b30ef9a05aa298d48409fccdbbfb38dc2a0f4375de6c35f420203c850561fc8

  • SSDEEP

    6144:l3H5tJ9MUsdOKKqLkMqIKdueMAgl7Qf2NaSUO9FsLeWhDER:l3HR79yVqIKseiukQOTsJh4R

Malware Config

Signatures

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

  • Modifies WinLogon for persistence 2 TTPs 1 IoCs
  • Checks BIOS information in registry 2 TTPs 2 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 3 IoCs
  • UPX packed file 29 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Maps connected drives based on registry 3 TTPs 6 IoCs

    Disk information is often read in order to detect sandboxing environments.

  • Suspicious use of SetThreadContext 4 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks processor information in registry 2 TTPs 8 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 2 IoCs
  • Runs ping.exe 1 TTPs 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 46 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 41 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\a113e103d28318c83c0d625de33e089b.exe
    "C:\Users\Admin\AppData\Local\Temp\a113e103d28318c83c0d625de33e089b.exe"
    1⤵
    • Maps connected drives based on registry
    • Suspicious use of SetThreadContext
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:3024
    • C:\Users\Admin\AppData\Local\Temp\a113e103d28318c83c0d625de33e089b.exe
      C:\Users\Admin\AppData\Local\Temp\a113e103d28318c83c0d625de33e089b.exe
      2⤵
      • Modifies WinLogon for persistence
      • Checks BIOS information in registry
      • Loads dropped DLL
      • Adds Run key to start application
      • Suspicious use of SetThreadContext
      • Checks processor information in registry
      • Enumerates system info in registry
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2528
      • C:\Windows\SysWOW64\explorer.exe
        "C:\Windows\SysWOW64\explorer.exe"
        3⤵
        • Maps connected drives based on registry
        • Suspicious use of SetThreadContext
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:2748
        • C:\Windows\SysWOW64\explorer.exe
          C:\Windows\SysWOW64\explorer.exe
          4⤵
            PID:2568
        • C:\Users\Admin\Documents\After.exe
          "C:\Users\Admin\Documents\After.exe"
          3⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Maps connected drives based on registry
          • Suspicious use of SetThreadContext
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:2596
          • C:\Users\Admin\Documents\After.exe
            C:\Users\Admin\Documents\After.exe
            4⤵
            • Checks BIOS information in registry
            • Executes dropped EXE
            • Checks processor information in registry
            • Enumerates system info in registry
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of SetWindowsHookEx
            PID:2168
        • C:\Windows\SysWOW64\ping.exe
          ping 127.0.0.1 -n 5 > NUL del "C:\Users\Admin\AppData\Local\Temp\a113e103d28318c83c0d625de33e089b.exe"
          3⤵
          • Runs ping.exe
          PID:2456

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • \Users\Admin\Documents\After.exe

      Filesize

      488KB

      MD5

      a113e103d28318c83c0d625de33e089b

      SHA1

      023dc01fcf484ee6f23fa7f7e943a78528b5ee21

      SHA256

      051ca838d355275a998d6e3153244826c7c2fe090e775cd99063ddcce30277a5

      SHA512

      b664d85b93807c0feb7e1f9449dd505c62176786c86ddf5ddf497a8804d424fe8b30ef9a05aa298d48409fccdbbfb38dc2a0f4375de6c35f420203c850561fc8

    • memory/2168-55-0x0000000000400000-0x00000000004B5000-memory.dmp

      Filesize

      724KB

    • memory/2168-54-0x0000000000400000-0x00000000004B5000-memory.dmp

      Filesize

      724KB

    • memory/2168-64-0x0000000000400000-0x00000000004B5000-memory.dmp

      Filesize

      724KB

    • memory/2168-63-0x0000000000400000-0x00000000004B5000-memory.dmp

      Filesize

      724KB

    • memory/2168-62-0x0000000000400000-0x00000000004B5000-memory.dmp

      Filesize

      724KB

    • memory/2168-61-0x0000000000400000-0x00000000004B5000-memory.dmp

      Filesize

      724KB

    • memory/2168-60-0x0000000000400000-0x00000000004B5000-memory.dmp

      Filesize

      724KB

    • memory/2168-59-0x0000000000400000-0x00000000004B5000-memory.dmp

      Filesize

      724KB

    • memory/2168-58-0x0000000000400000-0x00000000004B5000-memory.dmp

      Filesize

      724KB

    • memory/2168-47-0x0000000000400000-0x00000000004B5000-memory.dmp

      Filesize

      724KB

    • memory/2168-56-0x0000000000400000-0x00000000004B5000-memory.dmp

      Filesize

      724KB

    • memory/2168-52-0x0000000000400000-0x00000000004B5000-memory.dmp

      Filesize

      724KB

    • memory/2168-53-0x0000000000400000-0x00000000004B5000-memory.dmp

      Filesize

      724KB

    • memory/2168-41-0x0000000000400000-0x00000000004B5000-memory.dmp

      Filesize

      724KB

    • memory/2168-43-0x0000000000400000-0x00000000004B5000-memory.dmp

      Filesize

      724KB

    • memory/2168-44-0x0000000000250000-0x0000000000251000-memory.dmp

      Filesize

      4KB

    • memory/2168-46-0x0000000000400000-0x00000000004B5000-memory.dmp

      Filesize

      724KB

    • memory/2168-45-0x0000000000400000-0x00000000004B5000-memory.dmp

      Filesize

      724KB

    • memory/2168-57-0x0000000000400000-0x00000000004B5000-memory.dmp

      Filesize

      724KB

    • memory/2168-48-0x0000000000400000-0x00000000004B5000-memory.dmp

      Filesize

      724KB

    • memory/2168-49-0x0000000000400000-0x00000000004B5000-memory.dmp

      Filesize

      724KB

    • memory/2168-50-0x0000000000400000-0x00000000004B5000-memory.dmp

      Filesize

      724KB

    • memory/2168-51-0x0000000000400000-0x00000000004B5000-memory.dmp

      Filesize

      724KB

    • memory/2528-5-0x0000000000400000-0x00000000004B5000-memory.dmp

      Filesize

      724KB

    • memory/2528-33-0x0000000000400000-0x00000000004B5000-memory.dmp

      Filesize

      724KB

    • memory/2528-2-0x0000000000400000-0x00000000004B5000-memory.dmp

      Filesize

      724KB

    • memory/2528-4-0x0000000000400000-0x00000000004B5000-memory.dmp

      Filesize

      724KB

    • memory/2528-9-0x0000000000400000-0x00000000004B5000-memory.dmp

      Filesize

      724KB

    • memory/2528-8-0x0000000000250000-0x0000000000251000-memory.dmp

      Filesize

      4KB

    • memory/2528-6-0x0000000000400000-0x00000000004B5000-memory.dmp

      Filesize

      724KB

    • memory/2528-7-0x0000000000400000-0x00000000004B5000-memory.dmp

      Filesize

      724KB

    • memory/2748-22-0x0000000000400000-0x000000000047B000-memory.dmp

      Filesize

      492KB

    • memory/2748-18-0x0000000000400000-0x000000000047B000-memory.dmp

      Filesize

      492KB

    • memory/2748-16-0x0000000000400000-0x000000000047B000-memory.dmp

      Filesize

      492KB

    • memory/2748-14-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

      Filesize

      4KB

    • memory/2748-12-0x0000000000400000-0x000000000047B000-memory.dmp

      Filesize

      492KB