Analysis

  • max time kernel
    150s
  • max time network
    152s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    25/02/2024, 06:31

General

  • Target

    a31d59e190008f0a3a2abc334c6ce9f9.exe

  • Size

    828KB

  • MD5

    a31d59e190008f0a3a2abc334c6ce9f9

  • SHA1

    37456e8559512dff814b09f9ca3710517148f8f2

  • SHA256

    27e663cc439cf3ff7b2f66260a851c8cf0ea5292d259bd1c22171685017dbd4c

  • SHA512

    47bdeb93ec8e8b659d3279c43524b4410bb91fc8b96e6f3a8044f189d91269b9e0d3fa236063f2fc05c12cf73777079f6e84f4b935e8122c095e85e525b49d75

  • SSDEEP

    24576:Gqv5LEymyQvPvS8cZTouk1wRhZ2Bq8aChQ:GqBL1AXvA0B1lw8/hQ

Malware Config

Signatures

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

  • Modifies WinLogon for persistence 2 TTPs 1 IoCs
  • Executes dropped EXE 3 IoCs
  • Loads dropped DLL 2 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Writes to the Master Boot Record (MBR) 1 TTPs 2 IoCs

    Bootkits write to the MBR to gain persistence at a level below the operating system.

  • Suspicious use of SetThreadContext 4 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of AdjustPrivilegeToken 46 IoCs
  • Suspicious use of SetWindowsHookEx 5 IoCs
  • Suspicious use of WriteProcessMemory 48 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\a31d59e190008f0a3a2abc334c6ce9f9.exe
    "C:\Users\Admin\AppData\Local\Temp\a31d59e190008f0a3a2abc334c6ce9f9.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1848
    • C:\Users\Admin\AppData\Local\Temp\a31d59e190008f0a3a2abc334c6ce9f9.exe
      "C:\Users\Admin\AppData\Local\Temp\a31d59e190008f0a3a2abc334c6ce9f9.exe"
      2⤵
      • Writes to the Master Boot Record (MBR)
      • Suspicious use of SetThreadContext
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2368
      • C:\Users\Admin\AppData\Local\Temp\a31d59e190008f0a3a2abc334c6ce9f9.exe
        "C:\Users\Admin\AppData\Local\Temp\a31d59e190008f0a3a2abc334c6ce9f9.exe"
        3⤵
        • Modifies WinLogon for persistence
        • Loads dropped DLL
        • Adds Run key to start application
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:2964
        • C:\Users\Admin\Documents\MSDCSC\msdcsc.exe
          "C:\Users\Admin\Documents\MSDCSC\msdcsc.exe"
          4⤵
          • Executes dropped EXE
          • Suspicious use of SetThreadContext
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:2560
          • C:\Users\Admin\Documents\MSDCSC\msdcsc.exe
            "C:\Users\Admin\Documents\MSDCSC\msdcsc.exe"
            5⤵
            • Executes dropped EXE
            • Writes to the Master Boot Record (MBR)
            • Suspicious use of SetThreadContext
            • Suspicious use of SetWindowsHookEx
            • Suspicious use of WriteProcessMemory
            PID:2444
            • C:\Users\Admin\Documents\MSDCSC\msdcsc.exe
              "C:\Users\Admin\Documents\MSDCSC\msdcsc.exe"
              6⤵
              • Executes dropped EXE
              • Suspicious use of AdjustPrivilegeToken
              • Suspicious use of SetWindowsHookEx
              PID:2832

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • \Users\Admin\Documents\MSDCSC\msdcsc.exe

    Filesize

    828KB

    MD5

    a31d59e190008f0a3a2abc334c6ce9f9

    SHA1

    37456e8559512dff814b09f9ca3710517148f8f2

    SHA256

    27e663cc439cf3ff7b2f66260a851c8cf0ea5292d259bd1c22171685017dbd4c

    SHA512

    47bdeb93ec8e8b659d3279c43524b4410bb91fc8b96e6f3a8044f189d91269b9e0d3fa236063f2fc05c12cf73777079f6e84f4b935e8122c095e85e525b49d75

  • memory/2368-2-0x0000000000400000-0x00000000004AD000-memory.dmp

    Filesize

    692KB

  • memory/2368-4-0x0000000000400000-0x00000000004AD000-memory.dmp

    Filesize

    692KB

  • memory/2368-6-0x0000000000400000-0x00000000004AD000-memory.dmp

    Filesize

    692KB

  • memory/2368-10-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

    Filesize

    4KB

  • memory/2368-12-0x0000000000400000-0x00000000004AD000-memory.dmp

    Filesize

    692KB

  • memory/2368-14-0x0000000000400000-0x00000000004AD000-memory.dmp

    Filesize

    692KB

  • memory/2368-37-0x0000000000400000-0x00000000004AD000-memory.dmp

    Filesize

    692KB

  • memory/2444-99-0x0000000000400000-0x00000000004AD000-memory.dmp

    Filesize

    692KB

  • memory/2832-106-0x0000000000400000-0x00000000004AF000-memory.dmp

    Filesize

    700KB

  • memory/2832-100-0x00000000001D0000-0x00000000001D1000-memory.dmp

    Filesize

    4KB

  • memory/2832-98-0x0000000000400000-0x00000000004AF000-memory.dmp

    Filesize

    700KB

  • memory/2964-29-0x0000000000400000-0x00000000004AF000-memory.dmp

    Filesize

    700KB

  • memory/2964-41-0x0000000000400000-0x00000000004AF000-memory.dmp

    Filesize

    700KB

  • memory/2964-35-0x0000000000400000-0x00000000004AF000-memory.dmp

    Filesize

    700KB

  • memory/2964-36-0x0000000000400000-0x00000000004AF000-memory.dmp

    Filesize

    700KB

  • memory/2964-27-0x0000000000400000-0x00000000004AF000-memory.dmp

    Filesize

    700KB

  • memory/2964-39-0x0000000000400000-0x00000000004AF000-memory.dmp

    Filesize

    700KB

  • memory/2964-40-0x0000000000400000-0x00000000004AF000-memory.dmp

    Filesize

    700KB

  • memory/2964-31-0x0000000000400000-0x00000000004AF000-memory.dmp

    Filesize

    700KB

  • memory/2964-42-0x0000000000280000-0x0000000000281000-memory.dmp

    Filesize

    4KB

  • memory/2964-25-0x0000000000400000-0x00000000004AF000-memory.dmp

    Filesize

    700KB

  • memory/2964-53-0x0000000000400000-0x00000000004AF000-memory.dmp

    Filesize

    700KB

  • memory/2964-23-0x0000000000400000-0x00000000004AF000-memory.dmp

    Filesize

    700KB

  • memory/2964-21-0x0000000000400000-0x00000000004AF000-memory.dmp

    Filesize

    700KB

  • memory/2964-19-0x0000000000400000-0x00000000004AF000-memory.dmp

    Filesize

    700KB

  • memory/2964-17-0x0000000000400000-0x00000000004AF000-memory.dmp

    Filesize

    700KB