Analysis

  • max time kernel
    148s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240221-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240221-enlocale:en-usos:windows10-2004-x64system
  • submitted
    24/02/2024, 05:38

General

  • Target

    a113e103d28318c83c0d625de33e089b.exe

  • Size

    488KB

  • MD5

    a113e103d28318c83c0d625de33e089b

  • SHA1

    023dc01fcf484ee6f23fa7f7e943a78528b5ee21

  • SHA256

    051ca838d355275a998d6e3153244826c7c2fe090e775cd99063ddcce30277a5

  • SHA512

    b664d85b93807c0feb7e1f9449dd505c62176786c86ddf5ddf497a8804d424fe8b30ef9a05aa298d48409fccdbbfb38dc2a0f4375de6c35f420203c850561fc8

  • SSDEEP

    6144:l3H5tJ9MUsdOKKqLkMqIKdueMAgl7Qf2NaSUO9FsLeWhDER:l3HR79yVqIKseiukQOTsJh4R

Malware Config

Signatures

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

  • Modifies WinLogon for persistence 2 TTPs 1 IoCs
  • Checks BIOS information in registry 2 TTPs 2 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 2 IoCs
  • UPX packed file 29 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Maps connected drives based on registry 3 TTPs 4 IoCs

    Disk information is often read in order to detect sandboxing environments.

  • Suspicious use of SetThreadContext 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks processor information in registry 2 TTPs 8 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 2 IoCs
  • Modifies registry class 1 IoCs
  • Runs ping.exe 1 TTPs 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 48 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 25 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\a113e103d28318c83c0d625de33e089b.exe
    "C:\Users\Admin\AppData\Local\Temp\a113e103d28318c83c0d625de33e089b.exe"
    1⤵
    • Maps connected drives based on registry
    • Suspicious use of SetThreadContext
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2808
    • C:\Users\Admin\AppData\Local\Temp\a113e103d28318c83c0d625de33e089b.exe
      C:\Users\Admin\AppData\Local\Temp\a113e103d28318c83c0d625de33e089b.exe
      2⤵
      • Modifies WinLogon for persistence
      • Checks BIOS information in registry
      • Checks computer location settings
      • Adds Run key to start application
      • Checks processor information in registry
      • Enumerates system info in registry
      • Modifies registry class
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:3912
      • C:\Windows\SysWOW64\explorer.exe
        "C:\Windows\SysWOW64\explorer.exe"
        3⤵
          PID:4372
        • C:\Users\Admin\Documents\After.exe
          "C:\Users\Admin\Documents\After.exe"
          3⤵
          • Executes dropped EXE
          • Maps connected drives based on registry
          • Suspicious use of SetThreadContext
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:3572
          • C:\Users\Admin\Documents\After.exe
            C:\Users\Admin\Documents\After.exe
            4⤵
            • Checks BIOS information in registry
            • Executes dropped EXE
            • Checks processor information in registry
            • Enumerates system info in registry
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of SetWindowsHookEx
            PID:4324
        • C:\Windows\SysWOW64\ping.exe
          ping 127.0.0.1 -n 5 > NUL del "C:\Users\Admin\AppData\Local\Temp\a113e103d28318c83c0d625de33e089b.exe"
          3⤵
          • Runs ping.exe
          PID:548

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\Documents\After.exe

      Filesize

      488KB

      MD5

      a113e103d28318c83c0d625de33e089b

      SHA1

      023dc01fcf484ee6f23fa7f7e943a78528b5ee21

      SHA256

      051ca838d355275a998d6e3153244826c7c2fe090e775cd99063ddcce30277a5

      SHA512

      b664d85b93807c0feb7e1f9449dd505c62176786c86ddf5ddf497a8804d424fe8b30ef9a05aa298d48409fccdbbfb38dc2a0f4375de6c35f420203c850561fc8

    • memory/3912-2-0x0000000000400000-0x00000000004B5000-memory.dmp

      Filesize

      724KB

    • memory/3912-4-0x0000000000400000-0x00000000004B5000-memory.dmp

      Filesize

      724KB

    • memory/3912-5-0x0000000000400000-0x00000000004B5000-memory.dmp

      Filesize

      724KB

    • memory/3912-6-0x0000000000400000-0x00000000004B5000-memory.dmp

      Filesize

      724KB

    • memory/3912-7-0x0000000000400000-0x00000000004B5000-memory.dmp

      Filesize

      724KB

    • memory/3912-9-0x0000000000400000-0x00000000004B5000-memory.dmp

      Filesize

      724KB

    • memory/3912-8-0x0000000002730000-0x0000000002731000-memory.dmp

      Filesize

      4KB

    • memory/3912-71-0x0000000000400000-0x00000000004B5000-memory.dmp

      Filesize

      724KB

    • memory/4324-86-0x0000000000400000-0x00000000004B5000-memory.dmp

      Filesize

      724KB

    • memory/4324-90-0x0000000000400000-0x00000000004B5000-memory.dmp

      Filesize

      724KB

    • memory/4324-82-0x00000000009C0000-0x00000000009C1000-memory.dmp

      Filesize

      4KB

    • memory/4324-81-0x0000000000400000-0x00000000004B5000-memory.dmp

      Filesize

      724KB

    • memory/4324-83-0x0000000000400000-0x00000000004B5000-memory.dmp

      Filesize

      724KB

    • memory/4324-85-0x0000000000400000-0x00000000004B5000-memory.dmp

      Filesize

      724KB

    • memory/4324-84-0x0000000000400000-0x00000000004B5000-memory.dmp

      Filesize

      724KB

    • memory/4324-78-0x0000000000400000-0x00000000004B5000-memory.dmp

      Filesize

      724KB

    • memory/4324-87-0x0000000000400000-0x00000000004B5000-memory.dmp

      Filesize

      724KB

    • memory/4324-88-0x0000000000400000-0x00000000004B5000-memory.dmp

      Filesize

      724KB

    • memory/4324-89-0x0000000000400000-0x00000000004B5000-memory.dmp

      Filesize

      724KB

    • memory/4324-80-0x0000000000400000-0x00000000004B5000-memory.dmp

      Filesize

      724KB

    • memory/4324-91-0x0000000000400000-0x00000000004B5000-memory.dmp

      Filesize

      724KB

    • memory/4324-92-0x0000000000400000-0x00000000004B5000-memory.dmp

      Filesize

      724KB

    • memory/4324-93-0x0000000000400000-0x00000000004B5000-memory.dmp

      Filesize

      724KB

    • memory/4324-94-0x0000000000400000-0x00000000004B5000-memory.dmp

      Filesize

      724KB

    • memory/4324-95-0x0000000000400000-0x00000000004B5000-memory.dmp

      Filesize

      724KB

    • memory/4324-96-0x0000000000400000-0x00000000004B5000-memory.dmp

      Filesize

      724KB

    • memory/4324-97-0x0000000000400000-0x00000000004B5000-memory.dmp

      Filesize

      724KB

    • memory/4324-98-0x0000000000400000-0x00000000004B5000-memory.dmp

      Filesize

      724KB

    • memory/4324-99-0x0000000000400000-0x00000000004B5000-memory.dmp

      Filesize

      724KB

    • memory/4324-100-0x0000000000400000-0x00000000004B5000-memory.dmp

      Filesize

      724KB

    • memory/4324-101-0x0000000000400000-0x00000000004B5000-memory.dmp

      Filesize

      724KB