Analysis

  • max time kernel
    95s
  • max time network
    123s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    02-08-2024 23:59

General

  • Target

    8795a5b03ecbfefd9c2e72479025c3dde14313b04985ade80bf2eb21fff12366.exe

  • Size

    1.2MB

  • MD5

    3dc8ca829ea4639a0d78f05ae481eec0

  • SHA1

    02bf8b9d26be7be2727bf980b5eb1e5e1c29bd0d

  • SHA256

    8795a5b03ecbfefd9c2e72479025c3dde14313b04985ade80bf2eb21fff12366

  • SHA512

    5162ee7aaaeabaf66280621bb239f47d3f8e66bc5fa9fee06083c60b9a7f5c27aa66b08dedca083e0e913ca8a9145e951c495fa327c31f822977243b46de8732

  • SSDEEP

    24576:KSY88f02Q1HCEWN2ZIOlWZelqxKR8MdjGUZWXABvz5nhj6Mcg8:z88FCEHwxKliUZvBvphtP

Malware Config

Extracted

Family

darkcomet

Botnet

Guest16

C2

dcdofus.no-ip.org:1604

Mutex

DC_MUTEX-1U9K2TB

Attributes
  • InstallPath

    MSDCSC\WindowsUpdate.exe

  • gencode

    TpN7E6aa2nhN

  • install

    true

  • offline_keylogger

    true

  • persistence

    true

  • reg_key

    WindowsUpdate

Signatures

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

  • Modifies WinLogon for persistence 2 TTPs 1 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself 1 IoCs
  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 24 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Drops file in System32 directory 9 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of AdjustPrivilegeToken 26 IoCs
  • Suspicious use of WriteProcessMemory 48 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\8795a5b03ecbfefd9c2e72479025c3dde14313b04985ade80bf2eb21fff12366.exe
    "C:\Users\Admin\AppData\Local\Temp\8795a5b03ecbfefd9c2e72479025c3dde14313b04985ade80bf2eb21fff12366.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of SetThreadContext
    • System Location Discovery: System Language Discovery
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4876
    • C:\Users\Admin\AppData\Local\Temp\8795a5b03ecbfefd9c2e72479025c3dde14313b04985ade80bf2eb21fff12366.exe
      C:\Users\Admin\AppData\Local\Temp\8795a5b03ecbfefd9c2e72479025c3dde14313b04985ade80bf2eb21fff12366.exe
      2⤵
      • Modifies WinLogon for persistence
      • Checks computer location settings
      • Adds Run key to start application
      • Drops file in System32 directory
      • System Location Discovery: System Language Discovery
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:3724
      • C:\Windows\SysWOW64\notepad.exe
        notepad
        3⤵
        • Deletes itself
        • System Location Discovery: System Language Discovery
        PID:4840
      • C:\Windows\SysWOW64\MSDCSC\WindowsUpdate.exe
        "C:\Windows\system32\MSDCSC\WindowsUpdate.exe"
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Drops file in System32 directory
        • Suspicious use of SetThreadContext
        • System Location Discovery: System Language Discovery
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:212
        • C:\Windows\SysWOW64\MSDCSC\WindowsUpdate.exe
          C:\Windows\SysWOW64\MSDCSC\WindowsUpdate.exe
          4⤵
          • Executes dropped EXE
          PID:4628
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -u -p 4628 -s 80
            5⤵
            • Program crash
            PID:2328
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 4628 -ip 4628
    1⤵
      PID:4712

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\D1.dll

      Filesize

      23KB

      MD5

      63fc996c75f5560acbe0a28dfee18f07

      SHA1

      f07317e054060d5bc41b9c583ead723288e2cdd4

      SHA256

      b1409c400b05819d175022c10ce322d20658cff102d5b78900d4cd2fc20a7dc9

      SHA512

      dffe944844fccfa7fadf91326fc931b7536d25f1ce205cd9cafad0319402a2c79dbce96003f441433991eae3685d71cded6ed27a24e21d58463c009461fb5f7e

    • C:\Users\Admin\AppData\Local\Temp\D2.dll

      Filesize

      21KB

      MD5

      2f52e1cc7eb9a7380dbf0d4ec24663bd

      SHA1

      7cd8cf6e15a87fa70a0065d4fa2e7cccd62bb85f

      SHA256

      a62407aaa2d649a6bace93fa802408977844c6a4264df5d1713842b5fb98f386

      SHA512

      8d5450f1ad0c237fc9ea076ecca1ea9667c9f560d6a264349320461ff4f35efaa64a0541167e3f8ad1a13f4f4ef453ec72b5e4d013b7a783a3fabbe1a4426002

    • C:\Users\Admin\AppData\Local\Temp\D3.dll

      Filesize

      22KB

      MD5

      91e37a28b4ab1e638bd54084a298dad5

      SHA1

      6c3c1d79bb96585738108fafe3d7605183cb5dd9

      SHA256

      0fe99fd185be2fdd7c8d26c972cda38fe14f39a6d4530951ce56fd743c64095e

      SHA512

      ab3609b69dd33f4bf13aaac5f8ef0dbe9f5001884f068ff5c14ff1c2b529b460ba56bea35e901e16fb1eb133c25c42d9a0ac8db0c542ea4dd450449730efe5b2

    • C:\Windows\SysWOW64\MSDCSC\WindowsUpdate.exe

      Filesize

      1.2MB

      MD5

      3dc8ca829ea4639a0d78f05ae481eec0

      SHA1

      02bf8b9d26be7be2727bf980b5eb1e5e1c29bd0d

      SHA256

      8795a5b03ecbfefd9c2e72479025c3dde14313b04985ade80bf2eb21fff12366

      SHA512

      5162ee7aaaeabaf66280621bb239f47d3f8e66bc5fa9fee06083c60b9a7f5c27aa66b08dedca083e0e913ca8a9145e951c495fa327c31f822977243b46de8732

    • memory/3724-34-0x0000000000400000-0x00000000004B2000-memory.dmp

      Filesize

      712KB

    • memory/3724-35-0x0000000000400000-0x00000000004B2000-memory.dmp

      Filesize

      712KB

    • memory/3724-37-0x0000000000400000-0x00000000004B2000-memory.dmp

      Filesize

      712KB

    • memory/3724-39-0x0000000000400000-0x00000000004B2000-memory.dmp

      Filesize

      712KB

    • memory/3724-40-0x00000000032B0000-0x00000000032B1000-memory.dmp

      Filesize

      4KB

    • memory/3724-88-0x0000000000400000-0x00000000004B2000-memory.dmp

      Filesize

      712KB

    • memory/4840-44-0x0000000001080000-0x0000000001081000-memory.dmp

      Filesize

      4KB

    • memory/4876-9-0x00000000751A0000-0x0000000075751000-memory.dmp

      Filesize

      5.7MB

    • memory/4876-2-0x00000000751A0000-0x0000000075751000-memory.dmp

      Filesize

      5.7MB

    • memory/4876-0-0x00000000751A2000-0x00000000751A3000-memory.dmp

      Filesize

      4KB

    • memory/4876-38-0x00000000751A0000-0x0000000075751000-memory.dmp

      Filesize

      5.7MB

    • memory/4876-1-0x00000000751A0000-0x0000000075751000-memory.dmp

      Filesize

      5.7MB