Analysis
- max time kernel
149s - max time network
153s - platform
windows10-2004_x64 - resource
win10v2004-20240226-en - resource tags
- submitted
27/02/2024, 03:21
General
- Target a8168495604b644d5233c1fef2bb33c2.exe
- Size 755KB
- Sample240227-dws63afa84
- SHA256 e16f3f5edd1a95f1c0eec61785682b0cb8279712eceae1799d2fa50cb812c25f
Malware Config
Extracted
-
darkcomet
-
Guest16
-
127.0.0.1:1604
-
DC_MUTEX-F54S21D
-
gencode
HaNmd8AneoiP
-
install
false
-
offline_keylogger
true
-
persistence
false
Signatures
- Darkcomet
DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
- Suspicious use of SetThreadContext 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious use of AdjustPrivilegeToken 24 IoCs
- Suspicious use of SetWindowsHookEx 2 IoCs
- Suspicious use of WriteProcessMemory 14 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\a8168495604b644d5233c1fef2bb33c2.exe"C:\Users\Admin\AppData\Local\Temp\a8168495604b644d5233c1fef2bb33c2.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\a8168495604b644d5233c1fef2bb33c2.exeC:\Users\Admin\AppData\Local\Temp\a8168495604b644d5233c1fef2bb33c2.exe2⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4092 --field-trial-handle=3136,i,3192284747741020952,1225278682167953346,262144 --variations-seed-version /prefetch:81⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
memory/4476-17-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/4476-14-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/4476-34-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/4476-33-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/4476-30-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/4476-10-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/4476-11-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/4476-20-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/4476-18-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/4476-16-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/4476-27-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/4476-26-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/4476-12-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/4476-25-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/4476-22-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/4476-23-0x00000000023F0000-0x00000000023F1000-memory.dmp
memory/4476-24-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/4952-21-0x0000000000400000-0x0000000000431000-memory.dmp
memory/4952-0-0x0000000000400000-0x0000000000431000-memory.dmp
memory/4952-1-0x0000000000400000-0x0000000000431000-memory.dmp
memory/4952-5-0x0000000000400000-0x0000000000431000-memory.dmp
memory/4952-4-0x0000000000400000-0x0000000000431000-memory.dmp
memory/4952-2-0x0000000000400000-0x0000000000431000-memory.dmp