Malware Analysis Report

2024-08-06 17:55

Sample ID 240701-c6ldjateja
Target 2f5a4ef689e44124705c9f4c288e62ba7771b58e408aa9295db061eee333b8be_NeikiAnalytics.exe
SHA256 2f5a4ef689e44124705c9f4c288e62ba7771b58e408aa9295db061eee333b8be
Tags
darkcomet privateeye persistence rat trojan upx
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK Matrix

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

2f5a4ef689e44124705c9f4c288e62ba7771b58e408aa9295db061eee333b8be

Threat Level: Known bad

The file 2f5a4ef689e44124705c9f4c288e62ba7771b58e408aa9295db061eee333b8be_NeikiAnalytics.exe was found to be: Known bad.

Malicious Activity Summary

darkcomet privateeye persistence rat trojan upx

Darkcomet

Executes dropped EXE

Loads dropped DLL

UPX packed file

Adds Run key to start application

Suspicious use of SetThreadContext

Unsigned PE

Program crash

Enumerates physical storage devices

Suspicious use of WriteProcessMemory

Suspicious use of SetWindowsHookEx

Modifies registry key

Gathers network information

Suspicious use of AdjustPrivilegeToken

MITRE ATT&CK Matrix V13

Initial Access
TA0001
Execution
TA0002
Command and Scripting Interpreter
T1059
Persistence
TA0003
Boot or Logon Autostart Execution
T1547
Registry Run Keys / Startup Folder
T1547.001
Privilege Escalation
TA0004
Boot or Logon Autostart Execution
T1547
Registry Run Keys / Startup Folder
T1547.001
Defense Evasion
TA0005
Modify Registry
T1112
Credential Access
TA0006
Discovery
TA0007
System Information Discovery
T1082
Lateral Movement
TA0008
Collection
TA0009
Exfiltration
TA0010
Command and Control
TA0011
Impact
TA0040
Resource Development
TA0042
Reconnaissance
TA0043

Analysis: static1

Detonation Overview

Reported

2024-07-01 02:41

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-07-01 02:41

Reported

2024-07-01 02:43

Platform

win7-20240221-en

Max time kernel

150s

Max time network

121s

Command Line

"C:\Users\Admin\AppData\Local\Temp\2f5a4ef689e44124705c9f4c288e62ba7771b58e408aa9295db061eee333b8be_NeikiAnalytics.exe"

Signatures

Darkcomet

trojan rat darkcomet

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\winupd.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\winupd.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\winupd.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\2f5a4ef689e44124705c9f4c288e62ba7771b58e408aa9295db061eee333b8be_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2f5a4ef689e44124705c9f4c288e62ba7771b58e408aa9295db061eee333b8be_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\winupd.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\winupd.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Windows\CurrentVersion\Run\WinUpdate = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\winupd.exe -notray" C:\Windows\SysWOW64\reg.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 1928 set thread context of 2188 N/A C:\Users\Admin\AppData\Local\Temp\2f5a4ef689e44124705c9f4c288e62ba7771b58e408aa9295db061eee333b8be_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\2f5a4ef689e44124705c9f4c288e62ba7771b58e408aa9295db061eee333b8be_NeikiAnalytics.exe
PID 2660 set thread context of 2556 N/A C:\Users\Admin\AppData\Roaming\Microsoft\winupd.exe C:\Users\Admin\AppData\Roaming\Microsoft\winupd.exe
PID 2660 set thread context of 2600 N/A C:\Users\Admin\AppData\Roaming\Microsoft\winupd.exe C:\Users\Admin\AppData\Roaming\Microsoft\winupd.exe

Enumerates physical storage devices

Gathers network information

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\ipconfig.exe N/A

Modifies registry key

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\reg.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeIncreaseQuotaPrivilege N/A C:\Users\Admin\AppData\Roaming\Microsoft\winupd.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Roaming\Microsoft\winupd.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Users\Admin\AppData\Roaming\Microsoft\winupd.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Users\Admin\AppData\Roaming\Microsoft\winupd.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Users\Admin\AppData\Roaming\Microsoft\winupd.exe N/A
Token: SeSystemtimePrivilege N/A C:\Users\Admin\AppData\Roaming\Microsoft\winupd.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Users\Admin\AppData\Roaming\Microsoft\winupd.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Roaming\Microsoft\winupd.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\AppData\Roaming\Microsoft\winupd.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Roaming\Microsoft\winupd.exe N/A
Token: SeRestorePrivilege N/A C:\Users\Admin\AppData\Roaming\Microsoft\winupd.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Roaming\Microsoft\winupd.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\Microsoft\winupd.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Users\Admin\AppData\Roaming\Microsoft\winupd.exe N/A
Token: SeChangeNotifyPrivilege N/A C:\Users\Admin\AppData\Roaming\Microsoft\winupd.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Users\Admin\AppData\Roaming\Microsoft\winupd.exe N/A
Token: SeUndockPrivilege N/A C:\Users\Admin\AppData\Roaming\Microsoft\winupd.exe N/A
Token: SeManageVolumePrivilege N/A C:\Users\Admin\AppData\Roaming\Microsoft\winupd.exe N/A
Token: SeImpersonatePrivilege N/A C:\Users\Admin\AppData\Roaming\Microsoft\winupd.exe N/A
Token: SeCreateGlobalPrivilege N/A C:\Users\Admin\AppData\Roaming\Microsoft\winupd.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Roaming\Microsoft\winupd.exe N/A
Token: 34 N/A C:\Users\Admin\AppData\Roaming\Microsoft\winupd.exe N/A
Token: 35 N/A C:\Users\Admin\AppData\Roaming\Microsoft\winupd.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\2f5a4ef689e44124705c9f4c288e62ba7771b58e408aa9295db061eee333b8be_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2f5a4ef689e44124705c9f4c288e62ba7771b58e408aa9295db061eee333b8be_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\winupd.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\winupd.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\winupd.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1928 wrote to memory of 2188 N/A C:\Users\Admin\AppData\Local\Temp\2f5a4ef689e44124705c9f4c288e62ba7771b58e408aa9295db061eee333b8be_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\2f5a4ef689e44124705c9f4c288e62ba7771b58e408aa9295db061eee333b8be_NeikiAnalytics.exe
PID 1928 wrote to memory of 2188 N/A C:\Users\Admin\AppData\Local\Temp\2f5a4ef689e44124705c9f4c288e62ba7771b58e408aa9295db061eee333b8be_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\2f5a4ef689e44124705c9f4c288e62ba7771b58e408aa9295db061eee333b8be_NeikiAnalytics.exe
PID 1928 wrote to memory of 2188 N/A C:\Users\Admin\AppData\Local\Temp\2f5a4ef689e44124705c9f4c288e62ba7771b58e408aa9295db061eee333b8be_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\2f5a4ef689e44124705c9f4c288e62ba7771b58e408aa9295db061eee333b8be_NeikiAnalytics.exe
PID 1928 wrote to memory of 2188 N/A C:\Users\Admin\AppData\Local\Temp\2f5a4ef689e44124705c9f4c288e62ba7771b58e408aa9295db061eee333b8be_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\2f5a4ef689e44124705c9f4c288e62ba7771b58e408aa9295db061eee333b8be_NeikiAnalytics.exe
PID 1928 wrote to memory of 2188 N/A C:\Users\Admin\AppData\Local\Temp\2f5a4ef689e44124705c9f4c288e62ba7771b58e408aa9295db061eee333b8be_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\2f5a4ef689e44124705c9f4c288e62ba7771b58e408aa9295db061eee333b8be_NeikiAnalytics.exe
PID 1928 wrote to memory of 2188 N/A C:\Users\Admin\AppData\Local\Temp\2f5a4ef689e44124705c9f4c288e62ba7771b58e408aa9295db061eee333b8be_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\2f5a4ef689e44124705c9f4c288e62ba7771b58e408aa9295db061eee333b8be_NeikiAnalytics.exe
PID 1928 wrote to memory of 2188 N/A C:\Users\Admin\AppData\Local\Temp\2f5a4ef689e44124705c9f4c288e62ba7771b58e408aa9295db061eee333b8be_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\2f5a4ef689e44124705c9f4c288e62ba7771b58e408aa9295db061eee333b8be_NeikiAnalytics.exe
PID 1928 wrote to memory of 2188 N/A C:\Users\Admin\AppData\Local\Temp\2f5a4ef689e44124705c9f4c288e62ba7771b58e408aa9295db061eee333b8be_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\2f5a4ef689e44124705c9f4c288e62ba7771b58e408aa9295db061eee333b8be_NeikiAnalytics.exe
PID 1928 wrote to memory of 2188 N/A C:\Users\Admin\AppData\Local\Temp\2f5a4ef689e44124705c9f4c288e62ba7771b58e408aa9295db061eee333b8be_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\2f5a4ef689e44124705c9f4c288e62ba7771b58e408aa9295db061eee333b8be_NeikiAnalytics.exe
PID 2188 wrote to memory of 2660 N/A C:\Users\Admin\AppData\Local\Temp\2f5a4ef689e44124705c9f4c288e62ba7771b58e408aa9295db061eee333b8be_NeikiAnalytics.exe C:\Users\Admin\AppData\Roaming\Microsoft\winupd.exe
PID 2188 wrote to memory of 2660 N/A C:\Users\Admin\AppData\Local\Temp\2f5a4ef689e44124705c9f4c288e62ba7771b58e408aa9295db061eee333b8be_NeikiAnalytics.exe C:\Users\Admin\AppData\Roaming\Microsoft\winupd.exe
PID 2188 wrote to memory of 2660 N/A C:\Users\Admin\AppData\Local\Temp\2f5a4ef689e44124705c9f4c288e62ba7771b58e408aa9295db061eee333b8be_NeikiAnalytics.exe C:\Users\Admin\AppData\Roaming\Microsoft\winupd.exe
PID 2188 wrote to memory of 2660 N/A C:\Users\Admin\AppData\Local\Temp\2f5a4ef689e44124705c9f4c288e62ba7771b58e408aa9295db061eee333b8be_NeikiAnalytics.exe C:\Users\Admin\AppData\Roaming\Microsoft\winupd.exe
PID 2660 wrote to memory of 2556 N/A C:\Users\Admin\AppData\Roaming\Microsoft\winupd.exe C:\Users\Admin\AppData\Roaming\Microsoft\winupd.exe
PID 2660 wrote to memory of 2556 N/A C:\Users\Admin\AppData\Roaming\Microsoft\winupd.exe C:\Users\Admin\AppData\Roaming\Microsoft\winupd.exe
PID 2660 wrote to memory of 2556 N/A C:\Users\Admin\AppData\Roaming\Microsoft\winupd.exe C:\Users\Admin\AppData\Roaming\Microsoft\winupd.exe
PID 2660 wrote to memory of 2556 N/A C:\Users\Admin\AppData\Roaming\Microsoft\winupd.exe C:\Users\Admin\AppData\Roaming\Microsoft\winupd.exe
PID 2660 wrote to memory of 2556 N/A C:\Users\Admin\AppData\Roaming\Microsoft\winupd.exe C:\Users\Admin\AppData\Roaming\Microsoft\winupd.exe
PID 2660 wrote to memory of 2556 N/A C:\Users\Admin\AppData\Roaming\Microsoft\winupd.exe C:\Users\Admin\AppData\Roaming\Microsoft\winupd.exe
PID 2660 wrote to memory of 2556 N/A C:\Users\Admin\AppData\Roaming\Microsoft\winupd.exe C:\Users\Admin\AppData\Roaming\Microsoft\winupd.exe
PID 2660 wrote to memory of 2556 N/A C:\Users\Admin\AppData\Roaming\Microsoft\winupd.exe C:\Users\Admin\AppData\Roaming\Microsoft\winupd.exe
PID 2660 wrote to memory of 2556 N/A C:\Users\Admin\AppData\Roaming\Microsoft\winupd.exe C:\Users\Admin\AppData\Roaming\Microsoft\winupd.exe
PID 2660 wrote to memory of 2600 N/A C:\Users\Admin\AppData\Roaming\Microsoft\winupd.exe C:\Users\Admin\AppData\Roaming\Microsoft\winupd.exe
PID 2660 wrote to memory of 2600 N/A C:\Users\Admin\AppData\Roaming\Microsoft\winupd.exe C:\Users\Admin\AppData\Roaming\Microsoft\winupd.exe
PID 2660 wrote to memory of 2600 N/A C:\Users\Admin\AppData\Roaming\Microsoft\winupd.exe C:\Users\Admin\AppData\Roaming\Microsoft\winupd.exe
PID 2660 wrote to memory of 2600 N/A C:\Users\Admin\AppData\Roaming\Microsoft\winupd.exe C:\Users\Admin\AppData\Roaming\Microsoft\winupd.exe
PID 2660 wrote to memory of 2600 N/A C:\Users\Admin\AppData\Roaming\Microsoft\winupd.exe C:\Users\Admin\AppData\Roaming\Microsoft\winupd.exe
PID 2660 wrote to memory of 2600 N/A C:\Users\Admin\AppData\Roaming\Microsoft\winupd.exe C:\Users\Admin\AppData\Roaming\Microsoft\winupd.exe
PID 2660 wrote to memory of 2600 N/A C:\Users\Admin\AppData\Roaming\Microsoft\winupd.exe C:\Users\Admin\AppData\Roaming\Microsoft\winupd.exe
PID 2660 wrote to memory of 2600 N/A C:\Users\Admin\AppData\Roaming\Microsoft\winupd.exe C:\Users\Admin\AppData\Roaming\Microsoft\winupd.exe
PID 2556 wrote to memory of 2396 N/A C:\Users\Admin\AppData\Roaming\Microsoft\winupd.exe C:\Windows\SysWOW64\ipconfig.exe
PID 2556 wrote to memory of 2396 N/A C:\Users\Admin\AppData\Roaming\Microsoft\winupd.exe C:\Windows\SysWOW64\ipconfig.exe
PID 2556 wrote to memory of 2396 N/A C:\Users\Admin\AppData\Roaming\Microsoft\winupd.exe C:\Windows\SysWOW64\ipconfig.exe
PID 2556 wrote to memory of 2396 N/A C:\Users\Admin\AppData\Roaming\Microsoft\winupd.exe C:\Windows\SysWOW64\ipconfig.exe
PID 2556 wrote to memory of 2396 N/A C:\Users\Admin\AppData\Roaming\Microsoft\winupd.exe C:\Windows\SysWOW64\ipconfig.exe
PID 2556 wrote to memory of 2396 N/A C:\Users\Admin\AppData\Roaming\Microsoft\winupd.exe C:\Windows\SysWOW64\ipconfig.exe
PID 2396 wrote to memory of 2580 N/A C:\Windows\SysWOW64\ipconfig.exe C:\Windows\SysWOW64\cmd.exe
PID 2396 wrote to memory of 2580 N/A C:\Windows\SysWOW64\ipconfig.exe C:\Windows\SysWOW64\cmd.exe
PID 2396 wrote to memory of 2580 N/A C:\Windows\SysWOW64\ipconfig.exe C:\Windows\SysWOW64\cmd.exe
PID 2396 wrote to memory of 2580 N/A C:\Windows\SysWOW64\ipconfig.exe C:\Windows\SysWOW64\cmd.exe
PID 2580 wrote to memory of 2900 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2580 wrote to memory of 2900 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2580 wrote to memory of 2900 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2580 wrote to memory of 2900 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe

Processes

C:\Users\Admin\AppData\Local\Temp\2f5a4ef689e44124705c9f4c288e62ba7771b58e408aa9295db061eee333b8be_NeikiAnalytics.exe

"C:\Users\Admin\AppData\Local\Temp\2f5a4ef689e44124705c9f4c288e62ba7771b58e408aa9295db061eee333b8be_NeikiAnalytics.exe"

C:\Users\Admin\AppData\Local\Temp\2f5a4ef689e44124705c9f4c288e62ba7771b58e408aa9295db061eee333b8be_NeikiAnalytics.exe

"C:\Users\Admin\AppData\Local\Temp\2f5a4ef689e44124705c9f4c288e62ba7771b58e408aa9295db061eee333b8be_NeikiAnalytics.exe"

C:\Users\Admin\AppData\Roaming\Microsoft\winupd.exe

C:\Users\Admin\AppData\Roaming\Microsoft\winupd.exe -notray

C:\Users\Admin\AppData\Roaming\Microsoft\winupd.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\winupd.exe"

C:\Users\Admin\AppData\Roaming\Microsoft\winupd.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\winupd.exe"

C:\Windows\SysWOW64\ipconfig.exe

"C:\Windows\system32\ipconfig.exe"

C:\Windows\SysWOW64\cmd.exe

cmd /c ""C:\Users\Admin\AppData\Local\Temp\KGUSJTML.bat" "

C:\Windows\SysWOW64\reg.exe

REG ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v WinUpdate /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Microsoft\winupd.exe -notray" /f

Network

Country Destination Domain Proto
US 8.8.8.8:53 ratblackshades.no-ip.biz udp

Files

memory/1928-2-0x0000000000400000-0x0000000000414000-memory.dmp

memory/2188-3-0x0000000000400000-0x0000000000407000-memory.dmp

memory/2188-7-0x0000000000400000-0x0000000000407000-memory.dmp

memory/2188-13-0x0000000000400000-0x0000000000407000-memory.dmp

memory/2188-11-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

memory/2188-5-0x0000000000400000-0x0000000000407000-memory.dmp

memory/1928-15-0x0000000000400000-0x0000000000483000-memory.dmp

memory/1928-19-0x0000000000400000-0x0000000000483000-memory.dmp

memory/2188-22-0x0000000000400000-0x0000000000407000-memory.dmp

memory/1928-21-0x0000000000400000-0x0000000000414000-memory.dmp

memory/1928-20-0x0000000000400000-0x0000000000483000-memory.dmp

\Users\Admin\AppData\Roaming\Microsoft\winupd.exe

MD5 b08d51cd0c63ca631317c638e5f61159
SHA1 eca842e20dd46157b5f955ca18fff57d3c6ed899
SHA256 0d593b3b01a2ffb97936a20ae733457171a6bdf3325eec445ee5a78f99d1567d
SHA512 4e8bae101d3c024105104388fddaf3ff12d2c14404dfb5b7db0a61666faf253876d476d06a335f45d3deb0b5cb286f7cace80979ec3005ac081513449e82b1f7

memory/2660-36-0x0000000000400000-0x0000000000483000-memory.dmp

memory/2188-67-0x0000000000400000-0x0000000000407000-memory.dmp

memory/2600-64-0x0000000000400000-0x00000000004B7000-memory.dmp

memory/2660-63-0x0000000000400000-0x0000000000483000-memory.dmp

memory/2600-61-0x0000000000400000-0x00000000004B7000-memory.dmp

memory/2660-62-0x0000000000400000-0x0000000000483000-memory.dmp

memory/2600-59-0x0000000000400000-0x00000000004B7000-memory.dmp

memory/2600-56-0x0000000000400000-0x00000000004B7000-memory.dmp

memory/2600-54-0x0000000000400000-0x00000000004B7000-memory.dmp

memory/2600-52-0x0000000000400000-0x00000000004B7000-memory.dmp

memory/2600-73-0x0000000000400000-0x00000000004B7000-memory.dmp

memory/2396-71-0x0000000000080000-0x0000000000081000-memory.dmp

memory/2600-75-0x0000000000400000-0x00000000004B7000-memory.dmp

memory/2600-78-0x0000000000400000-0x00000000004B7000-memory.dmp

memory/2600-77-0x0000000000400000-0x00000000004B7000-memory.dmp

memory/2556-80-0x0000000000400000-0x0000000000407000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\KGUSJTML.bat

MD5 cac890d00365d07b9ca89def17cc3a36
SHA1 6fa99679ede791c16b5d3e6d243a98e8bbdb7eab
SHA256 4f98ddee89760080a5c8a93666d2f5c97be52b741265ef4d1ce9aaebf05f12da
SHA512 124dc0b18e13425bde43bcbbe2a99005928e398bffcb458d498aac9e754bc5b92b703270667800876c60b0801343f2de8c6b9a1eebafd80bb4f6d5dc295dd9f1

memory/2600-76-0x0000000000400000-0x00000000004B7000-memory.dmp

memory/2600-74-0x0000000000400000-0x00000000004B7000-memory.dmp

memory/2600-82-0x0000000000400000-0x00000000004B7000-memory.dmp

memory/2600-83-0x0000000000400000-0x00000000004B7000-memory.dmp

memory/2600-84-0x0000000000400000-0x00000000004B7000-memory.dmp

memory/2600-85-0x0000000000400000-0x00000000004B7000-memory.dmp

memory/2600-86-0x0000000000400000-0x00000000004B7000-memory.dmp

memory/2600-87-0x0000000000400000-0x00000000004B7000-memory.dmp

memory/2600-88-0x0000000000400000-0x00000000004B7000-memory.dmp

memory/2600-89-0x0000000000400000-0x00000000004B7000-memory.dmp

memory/2600-90-0x0000000000400000-0x00000000004B7000-memory.dmp

memory/2600-91-0x0000000000400000-0x00000000004B7000-memory.dmp

memory/2600-92-0x0000000000400000-0x00000000004B7000-memory.dmp

memory/2600-93-0x0000000000400000-0x00000000004B7000-memory.dmp

memory/2600-94-0x0000000000400000-0x00000000004B7000-memory.dmp

memory/2600-95-0x0000000000400000-0x00000000004B7000-memory.dmp

memory/2600-96-0x0000000000400000-0x00000000004B7000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-07-01 02:41

Reported

2024-07-01 02:44

Platform

win10v2004-20240508-en

Max time kernel

146s

Max time network

152s

Command Line

"C:\Users\Admin\AppData\Local\Temp\2f5a4ef689e44124705c9f4c288e62ba7771b58e408aa9295db061eee333b8be_NeikiAnalytics.exe"

Signatures

Darkcomet

trojan rat darkcomet

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\winupd.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\winupd.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\winupd.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 3128 set thread context of 4776 N/A C:\Users\Admin\AppData\Local\Temp\2f5a4ef689e44124705c9f4c288e62ba7771b58e408aa9295db061eee333b8be_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\2f5a4ef689e44124705c9f4c288e62ba7771b58e408aa9295db061eee333b8be_NeikiAnalytics.exe
PID 1200 set thread context of 4552 N/A C:\Users\Admin\AppData\Roaming\Microsoft\winupd.exe C:\Users\Admin\AppData\Roaming\Microsoft\winupd.exe
PID 1200 set thread context of 4948 N/A C:\Users\Admin\AppData\Roaming\Microsoft\winupd.exe C:\Users\Admin\AppData\Roaming\Microsoft\winupd.exe

Enumerates physical storage devices

Program crash

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\ipconfig.exe

Gathers network information

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\ipconfig.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeIncreaseQuotaPrivilege N/A C:\Users\Admin\AppData\Roaming\Microsoft\winupd.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Roaming\Microsoft\winupd.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Users\Admin\AppData\Roaming\Microsoft\winupd.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Users\Admin\AppData\Roaming\Microsoft\winupd.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Users\Admin\AppData\Roaming\Microsoft\winupd.exe N/A
Token: SeSystemtimePrivilege N/A C:\Users\Admin\AppData\Roaming\Microsoft\winupd.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Users\Admin\AppData\Roaming\Microsoft\winupd.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Roaming\Microsoft\winupd.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\AppData\Roaming\Microsoft\winupd.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Roaming\Microsoft\winupd.exe N/A
Token: SeRestorePrivilege N/A C:\Users\Admin\AppData\Roaming\Microsoft\winupd.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Roaming\Microsoft\winupd.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\Microsoft\winupd.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Users\Admin\AppData\Roaming\Microsoft\winupd.exe N/A
Token: SeChangeNotifyPrivilege N/A C:\Users\Admin\AppData\Roaming\Microsoft\winupd.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Users\Admin\AppData\Roaming\Microsoft\winupd.exe N/A
Token: SeUndockPrivilege N/A C:\Users\Admin\AppData\Roaming\Microsoft\winupd.exe N/A
Token: SeManageVolumePrivilege N/A C:\Users\Admin\AppData\Roaming\Microsoft\winupd.exe N/A
Token: SeImpersonatePrivilege N/A C:\Users\Admin\AppData\Roaming\Microsoft\winupd.exe N/A
Token: SeCreateGlobalPrivilege N/A C:\Users\Admin\AppData\Roaming\Microsoft\winupd.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Roaming\Microsoft\winupd.exe N/A
Token: 34 N/A C:\Users\Admin\AppData\Roaming\Microsoft\winupd.exe N/A
Token: 35 N/A C:\Users\Admin\AppData\Roaming\Microsoft\winupd.exe N/A
Token: 36 N/A C:\Users\Admin\AppData\Roaming\Microsoft\winupd.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\2f5a4ef689e44124705c9f4c288e62ba7771b58e408aa9295db061eee333b8be_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2f5a4ef689e44124705c9f4c288e62ba7771b58e408aa9295db061eee333b8be_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\winupd.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\winupd.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\winupd.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3128 wrote to memory of 4776 N/A C:\Users\Admin\AppData\Local\Temp\2f5a4ef689e44124705c9f4c288e62ba7771b58e408aa9295db061eee333b8be_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\2f5a4ef689e44124705c9f4c288e62ba7771b58e408aa9295db061eee333b8be_NeikiAnalytics.exe
PID 3128 wrote to memory of 4776 N/A C:\Users\Admin\AppData\Local\Temp\2f5a4ef689e44124705c9f4c288e62ba7771b58e408aa9295db061eee333b8be_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\2f5a4ef689e44124705c9f4c288e62ba7771b58e408aa9295db061eee333b8be_NeikiAnalytics.exe
PID 3128 wrote to memory of 4776 N/A C:\Users\Admin\AppData\Local\Temp\2f5a4ef689e44124705c9f4c288e62ba7771b58e408aa9295db061eee333b8be_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\2f5a4ef689e44124705c9f4c288e62ba7771b58e408aa9295db061eee333b8be_NeikiAnalytics.exe
PID 3128 wrote to memory of 4776 N/A C:\Users\Admin\AppData\Local\Temp\2f5a4ef689e44124705c9f4c288e62ba7771b58e408aa9295db061eee333b8be_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\2f5a4ef689e44124705c9f4c288e62ba7771b58e408aa9295db061eee333b8be_NeikiAnalytics.exe
PID 3128 wrote to memory of 4776 N/A C:\Users\Admin\AppData\Local\Temp\2f5a4ef689e44124705c9f4c288e62ba7771b58e408aa9295db061eee333b8be_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\2f5a4ef689e44124705c9f4c288e62ba7771b58e408aa9295db061eee333b8be_NeikiAnalytics.exe
PID 3128 wrote to memory of 4776 N/A C:\Users\Admin\AppData\Local\Temp\2f5a4ef689e44124705c9f4c288e62ba7771b58e408aa9295db061eee333b8be_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\2f5a4ef689e44124705c9f4c288e62ba7771b58e408aa9295db061eee333b8be_NeikiAnalytics.exe
PID 3128 wrote to memory of 4776 N/A C:\Users\Admin\AppData\Local\Temp\2f5a4ef689e44124705c9f4c288e62ba7771b58e408aa9295db061eee333b8be_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\2f5a4ef689e44124705c9f4c288e62ba7771b58e408aa9295db061eee333b8be_NeikiAnalytics.exe
PID 3128 wrote to memory of 4776 N/A C:\Users\Admin\AppData\Local\Temp\2f5a4ef689e44124705c9f4c288e62ba7771b58e408aa9295db061eee333b8be_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\2f5a4ef689e44124705c9f4c288e62ba7771b58e408aa9295db061eee333b8be_NeikiAnalytics.exe
PID 4776 wrote to memory of 1200 N/A C:\Users\Admin\AppData\Local\Temp\2f5a4ef689e44124705c9f4c288e62ba7771b58e408aa9295db061eee333b8be_NeikiAnalytics.exe C:\Users\Admin\AppData\Roaming\Microsoft\winupd.exe
PID 4776 wrote to memory of 1200 N/A C:\Users\Admin\AppData\Local\Temp\2f5a4ef689e44124705c9f4c288e62ba7771b58e408aa9295db061eee333b8be_NeikiAnalytics.exe C:\Users\Admin\AppData\Roaming\Microsoft\winupd.exe
PID 4776 wrote to memory of 1200 N/A C:\Users\Admin\AppData\Local\Temp\2f5a4ef689e44124705c9f4c288e62ba7771b58e408aa9295db061eee333b8be_NeikiAnalytics.exe C:\Users\Admin\AppData\Roaming\Microsoft\winupd.exe
PID 1200 wrote to memory of 4552 N/A C:\Users\Admin\AppData\Roaming\Microsoft\winupd.exe C:\Users\Admin\AppData\Roaming\Microsoft\winupd.exe
PID 1200 wrote to memory of 4552 N/A C:\Users\Admin\AppData\Roaming\Microsoft\winupd.exe C:\Users\Admin\AppData\Roaming\Microsoft\winupd.exe
PID 1200 wrote to memory of 4552 N/A C:\Users\Admin\AppData\Roaming\Microsoft\winupd.exe C:\Users\Admin\AppData\Roaming\Microsoft\winupd.exe
PID 1200 wrote to memory of 4552 N/A C:\Users\Admin\AppData\Roaming\Microsoft\winupd.exe C:\Users\Admin\AppData\Roaming\Microsoft\winupd.exe
PID 1200 wrote to memory of 4552 N/A C:\Users\Admin\AppData\Roaming\Microsoft\winupd.exe C:\Users\Admin\AppData\Roaming\Microsoft\winupd.exe
PID 1200 wrote to memory of 4552 N/A C:\Users\Admin\AppData\Roaming\Microsoft\winupd.exe C:\Users\Admin\AppData\Roaming\Microsoft\winupd.exe
PID 1200 wrote to memory of 4552 N/A C:\Users\Admin\AppData\Roaming\Microsoft\winupd.exe C:\Users\Admin\AppData\Roaming\Microsoft\winupd.exe
PID 1200 wrote to memory of 4552 N/A C:\Users\Admin\AppData\Roaming\Microsoft\winupd.exe C:\Users\Admin\AppData\Roaming\Microsoft\winupd.exe
PID 1200 wrote to memory of 4948 N/A C:\Users\Admin\AppData\Roaming\Microsoft\winupd.exe C:\Users\Admin\AppData\Roaming\Microsoft\winupd.exe
PID 1200 wrote to memory of 4948 N/A C:\Users\Admin\AppData\Roaming\Microsoft\winupd.exe C:\Users\Admin\AppData\Roaming\Microsoft\winupd.exe
PID 1200 wrote to memory of 4948 N/A C:\Users\Admin\AppData\Roaming\Microsoft\winupd.exe C:\Users\Admin\AppData\Roaming\Microsoft\winupd.exe
PID 1200 wrote to memory of 4948 N/A C:\Users\Admin\AppData\Roaming\Microsoft\winupd.exe C:\Users\Admin\AppData\Roaming\Microsoft\winupd.exe
PID 1200 wrote to memory of 4948 N/A C:\Users\Admin\AppData\Roaming\Microsoft\winupd.exe C:\Users\Admin\AppData\Roaming\Microsoft\winupd.exe
PID 1200 wrote to memory of 4948 N/A C:\Users\Admin\AppData\Roaming\Microsoft\winupd.exe C:\Users\Admin\AppData\Roaming\Microsoft\winupd.exe
PID 1200 wrote to memory of 4948 N/A C:\Users\Admin\AppData\Roaming\Microsoft\winupd.exe C:\Users\Admin\AppData\Roaming\Microsoft\winupd.exe
PID 1200 wrote to memory of 4948 N/A C:\Users\Admin\AppData\Roaming\Microsoft\winupd.exe C:\Users\Admin\AppData\Roaming\Microsoft\winupd.exe
PID 4552 wrote to memory of 4568 N/A C:\Users\Admin\AppData\Roaming\Microsoft\winupd.exe C:\Windows\SysWOW64\ipconfig.exe
PID 4552 wrote to memory of 4568 N/A C:\Users\Admin\AppData\Roaming\Microsoft\winupd.exe C:\Windows\SysWOW64\ipconfig.exe
PID 4552 wrote to memory of 4568 N/A C:\Users\Admin\AppData\Roaming\Microsoft\winupd.exe C:\Windows\SysWOW64\ipconfig.exe
PID 4552 wrote to memory of 4568 N/A C:\Users\Admin\AppData\Roaming\Microsoft\winupd.exe C:\Windows\SysWOW64\ipconfig.exe
PID 4552 wrote to memory of 4568 N/A C:\Users\Admin\AppData\Roaming\Microsoft\winupd.exe C:\Windows\SysWOW64\ipconfig.exe

Processes

C:\Users\Admin\AppData\Local\Temp\2f5a4ef689e44124705c9f4c288e62ba7771b58e408aa9295db061eee333b8be_NeikiAnalytics.exe

"C:\Users\Admin\AppData\Local\Temp\2f5a4ef689e44124705c9f4c288e62ba7771b58e408aa9295db061eee333b8be_NeikiAnalytics.exe"

C:\Users\Admin\AppData\Local\Temp\2f5a4ef689e44124705c9f4c288e62ba7771b58e408aa9295db061eee333b8be_NeikiAnalytics.exe

"C:\Users\Admin\AppData\Local\Temp\2f5a4ef689e44124705c9f4c288e62ba7771b58e408aa9295db061eee333b8be_NeikiAnalytics.exe"

C:\Users\Admin\AppData\Roaming\Microsoft\winupd.exe

C:\Users\Admin\AppData\Roaming\Microsoft\winupd.exe -notray

C:\Users\Admin\AppData\Roaming\Microsoft\winupd.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\winupd.exe"

C:\Users\Admin\AppData\Roaming\Microsoft\winupd.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\winupd.exe"

C:\Windows\SysWOW64\ipconfig.exe

"C:\Windows\system32\ipconfig.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4568 -ip 4568

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4568 -s 272

Network

Country Destination Domain Proto
US 8.8.8.8:53 ratblackshades.no-ip.biz udp
US 8.8.8.8:53 ratblackshades.no-ip.biz udp
US 8.8.8.8:53 ratblackshades.no-ip.biz udp
US 8.8.8.8:53 ratblackshades.no-ip.biz udp
US 8.8.8.8:53 ratblackshades.no-ip.biz udp
US 8.8.8.8:53 ratblackshades.no-ip.biz udp
US 8.8.8.8:53 ratblackshades.no-ip.biz udp
US 8.8.8.8:53 ratblackshades.no-ip.biz udp

Files

memory/4776-8-0x0000000000400000-0x0000000000407000-memory.dmp

memory/3128-7-0x0000000000400000-0x0000000000483000-memory.dmp

memory/3128-9-0x0000000000400000-0x0000000000414000-memory.dmp

memory/3128-6-0x0000000000400000-0x0000000000483000-memory.dmp

memory/4776-3-0x0000000000400000-0x0000000000407000-memory.dmp

memory/3128-2-0x0000000000400000-0x0000000000414000-memory.dmp

C:\Users\Admin\AppData\Roaming\Microsoft\winupd.exe

MD5 b3ca8cc7f4ccd395b1d9f50c74162758
SHA1 49b35e0dae74a31ff2fac0517fa46417790e369c
SHA256 f5faec4d7c1681a1f5533602572d7be6fa694829b23148bd29128451105a5f31
SHA512 63ac0b53f3d1d1ddb6d1e670a100529de2b54a113d48d55e13097c26b296085532b5a13d5d9ba8b26c91558bd6f1a33a58d026a6dcef1bc49d018bef4a7e9b2c

memory/4776-19-0x0000000000400000-0x0000000000407000-memory.dmp

memory/1200-28-0x0000000000400000-0x0000000000483000-memory.dmp

memory/4948-29-0x0000000000400000-0x00000000004B7000-memory.dmp

memory/4948-31-0x0000000000400000-0x00000000004B7000-memory.dmp

memory/4948-35-0x0000000000400000-0x00000000004B7000-memory.dmp

memory/4948-34-0x0000000000400000-0x00000000004B7000-memory.dmp

memory/4948-37-0x0000000000400000-0x00000000004B7000-memory.dmp

memory/4948-36-0x0000000000400000-0x00000000004B7000-memory.dmp

memory/4948-25-0x0000000000400000-0x00000000004B7000-memory.dmp

memory/4552-38-0x0000000000400000-0x0000000000407000-memory.dmp

memory/4948-40-0x0000000000400000-0x00000000004B7000-memory.dmp

memory/4948-41-0x0000000000400000-0x00000000004B7000-memory.dmp

memory/4948-42-0x0000000000400000-0x00000000004B7000-memory.dmp

memory/4948-43-0x0000000000400000-0x00000000004B7000-memory.dmp

memory/4948-44-0x0000000000400000-0x00000000004B7000-memory.dmp

memory/4948-45-0x0000000000400000-0x00000000004B7000-memory.dmp

memory/4948-46-0x0000000000400000-0x00000000004B7000-memory.dmp

memory/4948-47-0x0000000000400000-0x00000000004B7000-memory.dmp

memory/4948-48-0x0000000000400000-0x00000000004B7000-memory.dmp