Analysis

  • max time kernel
    16s
  • max time network
    17s
  • platform
    windows7_x64
  • resource
    win7-20240708-en
  • resource tags

    arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
  • submitted
    05-08-2024 02:56

General

  • Target

    3dc8ca829ea4639a0d78f05ae481eec0N.exe

  • Size

    1.2MB

  • MD5

    3dc8ca829ea4639a0d78f05ae481eec0

  • SHA1

    02bf8b9d26be7be2727bf980b5eb1e5e1c29bd0d

  • SHA256

    8795a5b03ecbfefd9c2e72479025c3dde14313b04985ade80bf2eb21fff12366

  • SHA512

    5162ee7aaaeabaf66280621bb239f47d3f8e66bc5fa9fee06083c60b9a7f5c27aa66b08dedca083e0e913ca8a9145e951c495fa327c31f822977243b46de8732

  • SSDEEP

    24576:KSY88f02Q1HCEWN2ZIOlWZelqxKR8MdjGUZWXABvz5nhj6Mcg8:z88FCEHwxKliUZvBvphtP

Malware Config

Extracted

Family

darkcomet

Botnet

Guest16

C2

dcdofus.no-ip.org:1604

Mutex

DC_MUTEX-1U9K2TB

Attributes
  • InstallPath

    MSDCSC\WindowsUpdate.exe

  • gencode

    TpN7E6aa2nhN

  • install

    true

  • offline_keylogger

    true

  • persistence

    true

  • reg_key

    WindowsUpdate

Signatures

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

  • Modifies WinLogon for persistence 2 TTPs 1 IoCs
  • Deletes itself 1 IoCs
  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 20 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Drops file in System32 directory 9 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of AdjustPrivilegeToken 25 IoCs
  • Suspicious use of WriteProcessMemory 58 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\3dc8ca829ea4639a0d78f05ae481eec0N.exe
    "C:\Users\Admin\AppData\Local\Temp\3dc8ca829ea4639a0d78f05ae481eec0N.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of SetThreadContext
    • System Location Discovery: System Language Discovery
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2220
    • C:\Users\Admin\AppData\Local\Temp\3dc8ca829ea4639a0d78f05ae481eec0N.exe
      C:\Users\Admin\AppData\Local\Temp\3dc8ca829ea4639a0d78f05ae481eec0N.exe
      2⤵
      • Modifies WinLogon for persistence
      • Loads dropped DLL
      • Adds Run key to start application
      • Drops file in System32 directory
      • System Location Discovery: System Language Discovery
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2904
      • C:\Windows\SysWOW64\notepad.exe
        notepad
        3⤵
        • Deletes itself
        • System Location Discovery: System Language Discovery
        PID:2160
      • C:\Windows\SysWOW64\MSDCSC\WindowsUpdate.exe
        "C:\Windows\system32\MSDCSC\WindowsUpdate.exe"
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Drops file in System32 directory
        • Suspicious use of SetThreadContext
        • System Location Discovery: System Language Discovery
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:2716
        • C:\Windows\SysWOW64\MSDCSC\WindowsUpdate.exe
          C:\Windows\SysWOW64\MSDCSC\WindowsUpdate.exe
          4⤵
          • Executes dropped EXE
          PID:2968

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\D1.dll

    Filesize

    23KB

    MD5

    63fc996c75f5560acbe0a28dfee18f07

    SHA1

    f07317e054060d5bc41b9c583ead723288e2cdd4

    SHA256

    b1409c400b05819d175022c10ce322d20658cff102d5b78900d4cd2fc20a7dc9

    SHA512

    dffe944844fccfa7fadf91326fc931b7536d25f1ce205cd9cafad0319402a2c79dbce96003f441433991eae3685d71cded6ed27a24e21d58463c009461fb5f7e

  • C:\Users\Admin\AppData\Local\Temp\D2.dll

    Filesize

    21KB

    MD5

    2f52e1cc7eb9a7380dbf0d4ec24663bd

    SHA1

    7cd8cf6e15a87fa70a0065d4fa2e7cccd62bb85f

    SHA256

    a62407aaa2d649a6bace93fa802408977844c6a4264df5d1713842b5fb98f386

    SHA512

    8d5450f1ad0c237fc9ea076ecca1ea9667c9f560d6a264349320461ff4f35efaa64a0541167e3f8ad1a13f4f4ef453ec72b5e4d013b7a783a3fabbe1a4426002

  • \Users\Admin\AppData\Local\Temp\D3.dll

    Filesize

    22KB

    MD5

    91e37a28b4ab1e638bd54084a298dad5

    SHA1

    6c3c1d79bb96585738108fafe3d7605183cb5dd9

    SHA256

    0fe99fd185be2fdd7c8d26c972cda38fe14f39a6d4530951ce56fd743c64095e

    SHA512

    ab3609b69dd33f4bf13aaac5f8ef0dbe9f5001884f068ff5c14ff1c2b529b460ba56bea35e901e16fb1eb133c25c42d9a0ac8db0c542ea4dd450449730efe5b2

  • \Windows\SysWOW64\MSDCSC\WindowsUpdate.exe

    Filesize

    1.2MB

    MD5

    3dc8ca829ea4639a0d78f05ae481eec0

    SHA1

    02bf8b9d26be7be2727bf980b5eb1e5e1c29bd0d

    SHA256

    8795a5b03ecbfefd9c2e72479025c3dde14313b04985ade80bf2eb21fff12366

    SHA512

    5162ee7aaaeabaf66280621bb239f47d3f8e66bc5fa9fee06083c60b9a7f5c27aa66b08dedca083e0e913ca8a9145e951c495fa327c31f822977243b46de8732

  • memory/2160-52-0x00000000001A0000-0x00000000001A1000-memory.dmp

    Filesize

    4KB

  • memory/2160-36-0x00000000000F0000-0x00000000000F1000-memory.dmp

    Filesize

    4KB

  • memory/2220-2-0x0000000074500000-0x0000000074AAB000-memory.dmp

    Filesize

    5.7MB

  • memory/2220-30-0x0000000074500000-0x0000000074AAB000-memory.dmp

    Filesize

    5.7MB

  • memory/2220-0-0x0000000074501000-0x0000000074502000-memory.dmp

    Filesize

    4KB

  • memory/2220-1-0x0000000074500000-0x0000000074AAB000-memory.dmp

    Filesize

    5.7MB

  • memory/2904-28-0x0000000000400000-0x00000000004B2000-memory.dmp

    Filesize

    712KB

  • memory/2904-27-0x0000000000400000-0x00000000004B2000-memory.dmp

    Filesize

    712KB

  • memory/2904-29-0x0000000000400000-0x00000000004B2000-memory.dmp

    Filesize

    712KB

  • memory/2904-31-0x0000000000400000-0x00000000004B2000-memory.dmp

    Filesize

    712KB

  • memory/2904-32-0x00000000000C0000-0x00000000000C1000-memory.dmp

    Filesize

    4KB

  • memory/2904-86-0x0000000000400000-0x00000000004B2000-memory.dmp

    Filesize

    712KB