Analysis

  • max time kernel
    150s
  • max time network
    109s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240709-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
  • submitted
    26-07-2024 02:05

General

  • Target

    af42c9c8dbe06b86b405ebafd55d3683ef50756422193154797c089d6fc056fe.exe

  • Size

    691KB

  • MD5

    e2d5c62c52be4b7a373943783d03d8b1

  • SHA1

    3a115983e2ac0b94982ad5c9e701225151875ca6

  • SHA256

    af42c9c8dbe06b86b405ebafd55d3683ef50756422193154797c089d6fc056fe

  • SHA512

    78d179ac338bb9e78909aadb1ffa7cc7fc4b9c4136dc1fb14e8c63916f6b7da93722aa7dccf7afdc05548d3657ea7c95608a4a60fee6a3b09418b78f5074b64e

  • SSDEEP

    12288:Y9HFJ9rJxRX1uVVjoaWSoynxdO1FVBaOiRZTERfIhNkNCCLo9EkNC/O:MZ1xuVVjfFoynPaVBUR8f+kN10Ed

Malware Config

Extracted

Family

darkcomet

Botnet

Guest16

C2

jvjv2044duck33.duckdns.org:1604

Mutex

DC_MUTEX-U9J0V31

Attributes
  • InstallPath

    MSDCSC\msdcsc.exe

  • gencode

    4xYePg256T0S

  • install

    true

  • offline_keylogger

    true

  • persistence

    true

  • reg_key

    WindowsTemp

Signatures

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

  • Modifies WinLogon for persistence 2 TTPs 1 IoCs
  • Sets file to hidden 1 TTPs 2 IoCs

    Modifies file attributes to stop it showing in Explorer etc.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies registry class 1 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 48 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 40 IoCs
  • Views/modifies file attributes 1 TTPs 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\af42c9c8dbe06b86b405ebafd55d3683ef50756422193154797c089d6fc056fe.exe
    "C:\Users\Admin\AppData\Local\Temp\af42c9c8dbe06b86b405ebafd55d3683ef50756422193154797c089d6fc056fe.exe"
    1⤵
    • Modifies WinLogon for persistence
    • Checks computer location settings
    • Adds Run key to start application
    • System Location Discovery: System Language Discovery
    • Modifies registry class
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:436
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp\af42c9c8dbe06b86b405ebafd55d3683ef50756422193154797c089d6fc056fe.exe" +s +h
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:3668
      • C:\Windows\SysWOW64\attrib.exe
        attrib "C:\Users\Admin\AppData\Local\Temp\af42c9c8dbe06b86b405ebafd55d3683ef50756422193154797c089d6fc056fe.exe" +s +h
        3⤵
        • Sets file to hidden
        • System Location Discovery: System Language Discovery
        • Views/modifies file attributes
        PID:4228
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp" +s +h
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2528
      • C:\Windows\SysWOW64\attrib.exe
        attrib "C:\Users\Admin\AppData\Local\Temp" +s +h
        3⤵
        • Sets file to hidden
        • System Location Discovery: System Language Discovery
        • Views/modifies file attributes
        PID:4780
    • C:\Users\Admin\AppData\Local\Temp\ULTIMAMULTI2024.EXE
      "C:\Users\Admin\AppData\Local\Temp\ULTIMAMULTI2024.EXE"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:3052
    • C:\Users\Admin\Documents\MSDCSC\msdcsc.exe
      "C:\Users\Admin\Documents\MSDCSC\msdcsc.exe"
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:1468
      • C:\Windows\SysWOW64\notepad.exe
        notepad
        3⤵
        • System Location Discovery: System Language Discovery
        PID:3040

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\ULTIMAMULTI2024.EXE

    Filesize

    33KB

    MD5

    0a1c8bdec0475a012049ae3eb0e7a0ef

    SHA1

    21e7736e539d9f3af66bdcb22b21cf7882aa531e

    SHA256

    b58e20b5e2888cc7b0716bb858be28ff328d35e487f5c64dadc73cf6c3dd5df8

    SHA512

    1c05f9daf94bb063238c42798ecc024afb6ca48d627e5d25d1898fc238283d96eb3b9fa3c7a4065fa2a805945dad0a9039c1807a35fdf5280d32afc35db857f5

  • C:\Users\Admin\Documents\MSDCSC\msdcsc.exe

    Filesize

    691KB

    MD5

    e2d5c62c52be4b7a373943783d03d8b1

    SHA1

    3a115983e2ac0b94982ad5c9e701225151875ca6

    SHA256

    af42c9c8dbe06b86b405ebafd55d3683ef50756422193154797c089d6fc056fe

    SHA512

    78d179ac338bb9e78909aadb1ffa7cc7fc4b9c4136dc1fb14e8c63916f6b7da93722aa7dccf7afdc05548d3657ea7c95608a4a60fee6a3b09418b78f5074b64e

  • memory/436-0-0x0000000000620000-0x0000000000621000-memory.dmp

    Filesize

    4KB

  • memory/436-81-0x0000000000400000-0x00000000004BA000-memory.dmp

    Filesize

    744KB

  • memory/1468-97-0x0000000000400000-0x00000000004BA000-memory.dmp

    Filesize

    744KB

  • memory/1468-86-0x0000000000400000-0x00000000004BA000-memory.dmp

    Filesize

    744KB

  • memory/1468-82-0x0000000000400000-0x00000000004BA000-memory.dmp

    Filesize

    744KB

  • memory/3040-80-0x0000000000670000-0x0000000000671000-memory.dmp

    Filesize

    4KB

  • memory/3052-16-0x0000000005450000-0x00000000054EC000-memory.dmp

    Filesize

    624KB

  • memory/3052-68-0x0000000005720000-0x0000000005776000-memory.dmp

    Filesize

    344KB

  • memory/3052-69-0x0000000073290000-0x0000000073A40000-memory.dmp

    Filesize

    7.7MB

  • memory/3052-67-0x0000000005500000-0x000000000550A000-memory.dmp

    Filesize

    40KB

  • memory/3052-18-0x0000000005590000-0x0000000005622000-memory.dmp

    Filesize

    584KB

  • memory/3052-17-0x0000000005AA0000-0x0000000006044000-memory.dmp

    Filesize

    5.6MB

  • memory/3052-84-0x000000007329E000-0x000000007329F000-memory.dmp

    Filesize

    4KB

  • memory/3052-85-0x0000000073290000-0x0000000073A40000-memory.dmp

    Filesize

    7.7MB

  • memory/3052-15-0x0000000000B90000-0x0000000000BA0000-memory.dmp

    Filesize

    64KB

  • memory/3052-14-0x000000007329E000-0x000000007329F000-memory.dmp

    Filesize

    4KB