Analysis

  • max time kernel
    150s
  • max time network
    151s
  • platform
    windows7_x64
  • resource
    win7-20240704-en
  • resource tags

    arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
  • submitted
    26-07-2024 02:05

General

  • Target

    af42c9c8dbe06b86b405ebafd55d3683ef50756422193154797c089d6fc056fe.exe

  • Size

    691KB

  • MD5

    e2d5c62c52be4b7a373943783d03d8b1

  • SHA1

    3a115983e2ac0b94982ad5c9e701225151875ca6

  • SHA256

    af42c9c8dbe06b86b405ebafd55d3683ef50756422193154797c089d6fc056fe

  • SHA512

    78d179ac338bb9e78909aadb1ffa7cc7fc4b9c4136dc1fb14e8c63916f6b7da93722aa7dccf7afdc05548d3657ea7c95608a4a60fee6a3b09418b78f5074b64e

  • SSDEEP

    12288:Y9HFJ9rJxRX1uVVjoaWSoynxdO1FVBaOiRZTERfIhNkNCCLo9EkNC/O:MZ1xuVVjfFoynPaVBUR8f+kN10Ed

Malware Config

Extracted

Family

darkcomet

Botnet

Guest16

C2

jvjv2044duck33.duckdns.org:1604

Mutex

DC_MUTEX-U9J0V31

Attributes
  • InstallPath

    MSDCSC\msdcsc.exe

  • gencode

    4xYePg256T0S

  • install

    true

  • offline_keylogger

    true

  • persistence

    true

  • reg_key

    WindowsTemp

Signatures

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

  • Modifies WinLogon for persistence 2 TTPs 1 IoCs
  • Sets file to hidden 1 TTPs 2 IoCs

    Modifies file attributes to stop it showing in Explorer etc.

  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 3 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 46 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 47 IoCs
  • Views/modifies file attributes 1 TTPs 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\af42c9c8dbe06b86b405ebafd55d3683ef50756422193154797c089d6fc056fe.exe
    "C:\Users\Admin\AppData\Local\Temp\af42c9c8dbe06b86b405ebafd55d3683ef50756422193154797c089d6fc056fe.exe"
    1⤵
    • Modifies WinLogon for persistence
    • Loads dropped DLL
    • Adds Run key to start application
    • System Location Discovery: System Language Discovery
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1952
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp\af42c9c8dbe06b86b405ebafd55d3683ef50756422193154797c089d6fc056fe.exe" +s +h
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2284
      • C:\Windows\SysWOW64\attrib.exe
        attrib "C:\Users\Admin\AppData\Local\Temp\af42c9c8dbe06b86b405ebafd55d3683ef50756422193154797c089d6fc056fe.exe" +s +h
        3⤵
        • Sets file to hidden
        • System Location Discovery: System Language Discovery
        • Views/modifies file attributes
        PID:2616
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp" +s +h
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2448
      • C:\Windows\SysWOW64\attrib.exe
        attrib "C:\Users\Admin\AppData\Local\Temp" +s +h
        3⤵
        • Sets file to hidden
        • System Location Discovery: System Language Discovery
        • Views/modifies file attributes
        PID:3064
    • C:\Users\Admin\AppData\Local\Temp\ULTIMAMULTI2024.EXE
      "C:\Users\Admin\AppData\Local\Temp\ULTIMAMULTI2024.EXE"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:2800
    • C:\Users\Admin\Documents\MSDCSC\msdcsc.exe
      "C:\Users\Admin\Documents\MSDCSC\msdcsc.exe"
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2916
      • C:\Windows\SysWOW64\notepad.exe
        notepad
        3⤵
        • System Location Discovery: System Language Discovery
        PID:1036

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • \Users\Admin\AppData\Local\Temp\ULTIMAMULTI2024.EXE

    Filesize

    33KB

    MD5

    0a1c8bdec0475a012049ae3eb0e7a0ef

    SHA1

    21e7736e539d9f3af66bdcb22b21cf7882aa531e

    SHA256

    b58e20b5e2888cc7b0716bb858be28ff328d35e487f5c64dadc73cf6c3dd5df8

    SHA512

    1c05f9daf94bb063238c42798ecc024afb6ca48d627e5d25d1898fc238283d96eb3b9fa3c7a4065fa2a805945dad0a9039c1807a35fdf5280d32afc35db857f5

  • \Users\Admin\Documents\MSDCSC\msdcsc.exe

    Filesize

    691KB

    MD5

    e2d5c62c52be4b7a373943783d03d8b1

    SHA1

    3a115983e2ac0b94982ad5c9e701225151875ca6

    SHA256

    af42c9c8dbe06b86b405ebafd55d3683ef50756422193154797c089d6fc056fe

    SHA512

    78d179ac338bb9e78909aadb1ffa7cc7fc4b9c4136dc1fb14e8c63916f6b7da93722aa7dccf7afdc05548d3657ea7c95608a4a60fee6a3b09418b78f5074b64e

  • memory/1036-20-0x00000000000C0000-0x00000000000C1000-memory.dmp

    Filesize

    4KB

  • memory/1036-58-0x00000000001E0000-0x00000000001E1000-memory.dmp

    Filesize

    4KB

  • memory/1952-2-0x0000000000240000-0x0000000000241000-memory.dmp

    Filesize

    4KB

  • memory/1952-59-0x0000000000400000-0x00000000004BA000-memory.dmp

    Filesize

    744KB

  • memory/2800-10-0x0000000000AF0000-0x0000000000B00000-memory.dmp

    Filesize

    64KB

  • memory/2916-60-0x0000000000400000-0x00000000004BA000-memory.dmp

    Filesize

    744KB

  • memory/2916-62-0x0000000000400000-0x00000000004BA000-memory.dmp

    Filesize

    744KB

  • memory/2916-66-0x0000000000400000-0x00000000004BA000-memory.dmp

    Filesize

    744KB