Analysis

  • max time kernel
    16s
  • max time network
    16s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    09-11-2024 04:16

General

  • Target

    3d0e1f7330885586e1cdeeeee34a224ace2c9ffadbbcad2aa7d15caf637eafdeN.exe

  • Size

    929KB

  • MD5

    92ff8539eb093582609a7a8083f38930

  • SHA1

    fde8cc65fdd5ab825f1be7daa9c9e422d32a3c7f

  • SHA256

    3d0e1f7330885586e1cdeeeee34a224ace2c9ffadbbcad2aa7d15caf637eafde

  • SHA512

    bd3303b7b73b0e2460db1cbd2428b3e55ed56d8c6258d016613c762190a3196ecfade2c98ba59a23e207a67c9efa67b3e0da880bc299020eb4130a6092a024fd

  • SSDEEP

    24576:I+QawCFbpfu2X0UOkcBk8NPktcNrUBC0lyE:YjupvOzpZSrX

Malware Config

Extracted

Family

darkcomet

Botnet

TP

C2

eviloton.no-ip.biz:1604

Mutex

DCMIN_MUTEX-QZP3U75

Attributes
  • InstallPath

    DCSCMIN\IMDCSC.exe

  • gencode

    hrLBKzjjkYGB

  • install

    true

  • offline_keylogger

    true

  • persistence

    false

  • reg_key

    DarkComet RAT

Signatures

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

  • Darkcomet family
  • Modifies WinLogon for persistence 2 TTPs 1 IoCs
  • Executes dropped EXE 11 IoCs
  • Loads dropped DLL 1 IoCs
  • Adds Run key to start application 2 TTPs 3 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of AdjustPrivilegeToken 23 IoCs
  • Suspicious use of WriteProcessMemory 57 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\3d0e1f7330885586e1cdeeeee34a224ace2c9ffadbbcad2aa7d15caf637eafdeN.exe
    "C:\Users\Admin\AppData\Local\Temp\3d0e1f7330885586e1cdeeeee34a224ace2c9ffadbbcad2aa7d15caf637eafdeN.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of SetThreadContext
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2256
    • C:\Users\Admin\AppData\Local\Temp\3d0e1f7330885586e1cdeeeee34a224ace2c9ffadbbcad2aa7d15caf637eafdeN.exe
      "C:\Users\Admin\AppData\Local\Temp\3d0e1f7330885586e1cdeeeee34a224ace2c9ffadbbcad2aa7d15caf637eafdeN.exe"
      2⤵
      • Modifies WinLogon for persistence
      • Loads dropped DLL
      • Adds Run key to start application
      • System Location Discovery: System Language Discovery
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2936
      • C:\Users\Admin\Documents\DCSCMIN\IMDCSC.exe
        "C:\Users\Admin\Documents\DCSCMIN\IMDCSC.exe"
        3⤵
        • Executes dropped EXE
        • Adds Run key to start application
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:2128
        • C:\Users\Admin\Documents\DCSCMIN\IMDCSC.exe
          "C:\Users\Admin\Documents\DCSCMIN\IMDCSC.exe"
          4⤵
          • Executes dropped EXE
          PID:2248
        • C:\Users\Admin\Documents\DCSCMIN\IMDCSC.exe
          "C:\Users\Admin\Documents\DCSCMIN\IMDCSC.exe"
          4⤵
          • Executes dropped EXE
          PID:1876
        • C:\Users\Admin\Documents\DCSCMIN\IMDCSC.exe
          "C:\Users\Admin\Documents\DCSCMIN\IMDCSC.exe"
          4⤵
          • Executes dropped EXE
          PID:2300
        • C:\Users\Admin\Documents\DCSCMIN\IMDCSC.exe
          "C:\Users\Admin\Documents\DCSCMIN\IMDCSC.exe"
          4⤵
          • Executes dropped EXE
          PID:1628
        • C:\Users\Admin\Documents\DCSCMIN\IMDCSC.exe
          "C:\Users\Admin\Documents\DCSCMIN\IMDCSC.exe"
          4⤵
          • Executes dropped EXE
          PID:684
        • C:\Users\Admin\Documents\DCSCMIN\IMDCSC.exe
          "C:\Users\Admin\Documents\DCSCMIN\IMDCSC.exe"
          4⤵
          • Executes dropped EXE
          PID:2736
        • C:\Users\Admin\Documents\DCSCMIN\IMDCSC.exe
          "C:\Users\Admin\Documents\DCSCMIN\IMDCSC.exe"
          4⤵
          • Executes dropped EXE
          PID:2752
        • C:\Users\Admin\Documents\DCSCMIN\IMDCSC.exe
          "C:\Users\Admin\Documents\DCSCMIN\IMDCSC.exe"
          4⤵
          • Executes dropped EXE
          PID:2828
        • C:\Users\Admin\Documents\DCSCMIN\IMDCSC.exe
          "C:\Users\Admin\Documents\DCSCMIN\IMDCSC.exe"
          4⤵
          • Executes dropped EXE
          PID:2860
        • C:\Users\Admin\Documents\DCSCMIN\IMDCSC.exe
          "C:\Users\Admin\Documents\DCSCMIN\IMDCSC.exe"
          4⤵
          • Executes dropped EXE
          PID:2868

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\Documents\DCSCMIN\IMDCSC.exe

    Filesize

    929KB

    MD5

    92ff8539eb093582609a7a8083f38930

    SHA1

    fde8cc65fdd5ab825f1be7daa9c9e422d32a3c7f

    SHA256

    3d0e1f7330885586e1cdeeeee34a224ace2c9ffadbbcad2aa7d15caf637eafde

    SHA512

    bd3303b7b73b0e2460db1cbd2428b3e55ed56d8c6258d016613c762190a3196ecfade2c98ba59a23e207a67c9efa67b3e0da880bc299020eb4130a6092a024fd

  • memory/2936-9-0x0000000000400000-0x00000000004B2000-memory.dmp

    Filesize

    712KB

  • memory/2936-6-0x0000000000400000-0x00000000004B2000-memory.dmp

    Filesize

    712KB

  • memory/2936-13-0x0000000000400000-0x00000000004B2000-memory.dmp

    Filesize

    712KB

  • memory/2936-11-0x0000000000400000-0x00000000004B2000-memory.dmp

    Filesize

    712KB

  • memory/2936-10-0x0000000000400000-0x00000000004B2000-memory.dmp

    Filesize

    712KB

  • memory/2936-0-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

    Filesize

    4KB

  • memory/2936-7-0x0000000000400000-0x00000000004B2000-memory.dmp

    Filesize

    712KB

  • memory/2936-8-0x0000000000400000-0x00000000004B2000-memory.dmp

    Filesize

    712KB

  • memory/2936-5-0x0000000000400000-0x00000000004B2000-memory.dmp

    Filesize

    712KB

  • memory/2936-14-0x0000000000400000-0x00000000004B2000-memory.dmp

    Filesize

    712KB

  • memory/2936-15-0x0000000000400000-0x00000000004B2000-memory.dmp

    Filesize

    712KB

  • memory/2936-16-0x0000000000110000-0x0000000000111000-memory.dmp

    Filesize

    4KB

  • memory/2936-2-0x0000000000400000-0x00000000004B2000-memory.dmp

    Filesize

    712KB

  • memory/2936-43-0x0000000000400000-0x00000000004B2000-memory.dmp

    Filesize

    712KB