darkcomet | b8022c1aa5f5f6220ffce8f3f473bb8078bbf171fa00e50823bc0c79946c1121

Virtualization/Sandbox Evasion

Processes:

DarkNight.exe

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	DarkNight.exe

Looks for VirtualBox Guest Additions in registry 2 TTPs 1 IoCs

evasion

Query Registry

Virtualization/Sandbox Evasion

Processes:

DarkNight.exe

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Oracle\VirtualBox Guest Additions	DarkNight.exe

Looks for VMWare Tools registry key 2 TTPs 1 IoCs

evasion

Query Registry

Virtualization/Sandbox Evasion

Processes:

DarkNight.exe

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\VMware, Inc.\VMware Tools	DarkNight.exe

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

Processes:

DarkNight.exe

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	DarkNight.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	DarkNight.exe

Themida packer 2 IoCs

Detects Themida, an advanced Windows software protection system.

themida

Processes:

resource	yara_rule
behavioral2/memory/1308-10-0x0000000000820000-0x00000000011C2000-memory.dmp	themida
behavioral2/memory/1308-11-0x0000000000820000-0x00000000011C2000-memory.dmp	themida

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

Processes:

DarkNight.exe

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	DarkNight.exe

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow	ioc
26	wtfismyip.com
27	wtfismyip.com

Maps connected drives based on registry 3 TTPs 2 IoCs

Disk information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

Processes:

DarkNight.exe

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	DarkNight.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0	DarkNight.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

DarkNight.exe

description	pid	Process	procid_target
PID 1308 set thread context of 3776	1308	DarkNight.exe	90

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

DarkNight.exe

pid	Process
1308	DarkNight.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

DarkNight.exeDarkNight.exeWMIC.exe

description	pid	Process
Token: SeDebugPrivilege	1308	DarkNight.exe
Token: SeIncreaseQuotaPrivilege	3776	DarkNight.exe
Token: SeSecurityPrivilege	3776	DarkNight.exe
Token: SeTakeOwnershipPrivilege	3776	DarkNight.exe
Token: SeLoadDriverPrivilege	3776	DarkNight.exe
Token: SeSystemProfilePrivilege	3776	DarkNight.exe
Token: SeSystemtimePrivilege	3776	DarkNight.exe
Token: SeProfSingleProcessPrivilege	3776	DarkNight.exe
Token: SeIncBasePriorityPrivilege	3776	DarkNight.exe
Token: SeCreatePagefilePrivilege	3776	DarkNight.exe
Token: SeBackupPrivilege	3776	DarkNight.exe
Token: SeRestorePrivilege	3776	DarkNight.exe
Token: SeShutdownPrivilege	3776	DarkNight.exe
Token: SeDebugPrivilege	3776	DarkNight.exe
Token: SeSystemEnvironmentPrivilege	3776	DarkNight.exe
Token: SeChangeNotifyPrivilege	3776	DarkNight.exe
Token: SeRemoteShutdownPrivilege	3776	DarkNight.exe
Token: SeUndockPrivilege	3776	DarkNight.exe
Token: SeManageVolumePrivilege	3776	DarkNight.exe
Token: SeImpersonatePrivilege	3776	DarkNight.exe
Token: SeCreateGlobalPrivilege	3776	DarkNight.exe
Token: 33	3776	DarkNight.exe
Token: 34	3776	DarkNight.exe
Token: 35	3776	DarkNight.exe
Token: 36	3776	DarkNight.exe
Token: SeIncreaseQuotaPrivilege	2600	WMIC.exe
Token: SeSecurityPrivilege	2600	WMIC.exe
Token: SeTakeOwnershipPrivilege	2600	WMIC.exe
Token: SeLoadDriverPrivilege	2600	WMIC.exe
Token: SeSystemProfilePrivilege	2600	WMIC.exe
Token: SeSystemtimePrivilege	2600	WMIC.exe
Token: SeProfSingleProcessPrivilege	2600	WMIC.exe
Token: SeIncBasePriorityPrivilege	2600	WMIC.exe
Token: SeCreatePagefilePrivilege	2600	WMIC.exe
Token: SeBackupPrivilege	2600	WMIC.exe
Token: SeRestorePrivilege	2600	WMIC.exe
Token: SeShutdownPrivilege	2600	WMIC.exe
Token: SeDebugPrivilege	2600	WMIC.exe
Token: SeSystemEnvironmentPrivilege	2600	WMIC.exe
Token: SeRemoteShutdownPrivilege	2600	WMIC.exe
Token: SeUndockPrivilege	2600	WMIC.exe
Token: SeManageVolumePrivilege	2600	WMIC.exe
Token: 33	2600	WMIC.exe
Token: 34	2600	WMIC.exe
Token: 35	2600	WMIC.exe
Token: 36	2600	WMIC.exe
Token: SeIncreaseQuotaPrivilege	2600	WMIC.exe
Token: SeSecurityPrivilege	2600	WMIC.exe
Token: SeTakeOwnershipPrivilege	2600	WMIC.exe
Token: SeLoadDriverPrivilege	2600	WMIC.exe
Token: SeSystemProfilePrivilege	2600	WMIC.exe
Token: SeSystemtimePrivilege	2600	WMIC.exe
Token: SeProfSingleProcessPrivilege	2600	WMIC.exe
Token: SeIncBasePriorityPrivilege	2600	WMIC.exe
Token: SeCreatePagefilePrivilege	2600	WMIC.exe
Token: SeBackupPrivilege	2600	WMIC.exe
Token: SeRestorePrivilege	2600	WMIC.exe
Token: SeShutdownPrivilege	2600	WMIC.exe
Token: SeDebugPrivilege	2600	WMIC.exe
Token: SeSystemEnvironmentPrivilege	2600	WMIC.exe
Token: SeRemoteShutdownPrivilege	2600	WMIC.exe
Token: SeUndockPrivilege	2600	WMIC.exe
Token: SeManageVolumePrivilege	2600	WMIC.exe
Token: 33	2600	WMIC.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

DarkNight.exe

pid	Process
3776	DarkNight.exe

Suspicious use of WriteProcessMemory 26 IoCs

Processes:

DarkNight.exeCMD.exeCMD.exe

description	pid	Process	procid_target
PID 1308 wrote to memory of 3776	1308	DarkNight.exe	90
PID 1308 wrote to memory of 3776	1308	DarkNight.exe	90
PID 1308 wrote to memory of 3776	1308	DarkNight.exe	90
PID 1308 wrote to memory of 3776	1308	DarkNight.exe	90
PID 1308 wrote to memory of 3776	1308	DarkNight.exe	90
PID 1308 wrote to memory of 3776	1308	DarkNight.exe	90
PID 1308 wrote to memory of 3776	1308	DarkNight.exe	90
PID 1308 wrote to memory of 3776	1308	DarkNight.exe	90
PID 1308 wrote to memory of 3776	1308	DarkNight.exe	90
PID 1308 wrote to memory of 3776	1308	DarkNight.exe	90
PID 1308 wrote to memory of 3776	1308	DarkNight.exe	90
PID 1308 wrote to memory of 3776	1308	DarkNight.exe	90
PID 1308 wrote to memory of 3776	1308	DarkNight.exe	90
PID 1308 wrote to memory of 3776	1308	DarkNight.exe	90
PID 1308 wrote to memory of 4544	1308	DarkNight.exe	92
PID 1308 wrote to memory of 4544	1308	DarkNight.exe	92
PID 1308 wrote to memory of 4544	1308	DarkNight.exe	92
PID 4544 wrote to memory of 2600	4544	CMD.exe	94
PID 4544 wrote to memory of 2600	4544	CMD.exe	94
PID 4544 wrote to memory of 2600	4544	CMD.exe	94
PID 1308 wrote to memory of 3420	1308	DarkNight.exe	95
PID 1308 wrote to memory of 3420	1308	DarkNight.exe	95
PID 1308 wrote to memory of 3420	1308	DarkNight.exe	95
PID 3420 wrote to memory of 812	3420	CMD.exe	97
PID 3420 wrote to memory of 812	3420	CMD.exe	97
PID 3420 wrote to memory of 812	3420	CMD.exe	97

C:\Users\Admin\AppData\Local\Temp\DarkNight.exe
"C:\Users\Admin\AppData\Local\Temp\DarkNight.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Looks for VirtualBox Guest Additions in registry
- Looks for VMWare Tools registry key
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Maps connected drives based on registry
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1308
- C:\Users\Admin\AppData\Local\Temp\DarkNight.exe
  C:\Users\Admin\AppData\Local\Temp\DarkNight.exe
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:3776
- C:\Windows\SysWOW64\CMD.exe
  "CMD.exe" /C WMIC COMPUTERSYSTEM GET MODEL
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4544
- - C:\Windows\SysWOW64\Wbem\WMIC.exe
    WMIC COMPUTERSYSTEM GET MODEL
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2600
- C:\Windows\SysWOW64\CMD.exe
  "CMD.exe" /C WMIC BIOS GET VERSION
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3420
- - C:\Windows\SysWOW64\Wbem\WMIC.exe
    WMIC BIOS GET VERSION
    3⤵
    PID:812

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

System Information Discovery

Virtualization/Sandbox Evasion