Analysis

  • max time kernel
    150s
  • max time network
    121s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    13-11-2024 02:42

General

  • Target

    c7d4c1c411927c1392f0793ee02108c86f134b90075ee2574fd0864657725d74.exe

  • Size

    520KB

  • MD5

    8bd5bac79fc049aebe1db767c7f4e8a2

  • SHA1

    0566f6b910c319b8e0cf4783596832ab6855286f

  • SHA256

    c7d4c1c411927c1392f0793ee02108c86f134b90075ee2574fd0864657725d74

  • SHA512

    16b5dd41b9578b276f5b1231860fe2b779c30252399cf1cc23ae2b0785bdfee989c5ce9b67e9f734723353fbba8d79ddc69b7409ae07001639d2c8a0f37836d9

  • SSDEEP

    6144:f9GGo2CwtGg6eeihEfph2CMvvqqSaYwpncOeC66AOa0aFtVEQfTo1ozVqMbd:f9fC3hh29Ya77A90aFtDfT5IMbd

Malware Config

Extracted

Family

darkcomet

Botnet

PrivateEye

C2

ratblackshades.no-ip.biz:1604

Mutex

DC_MUTEX-ACC1R98

Attributes
  • gencode

    8GG5LVVGljSF

  • install

    false

  • offline_keylogger

    true

  • persistence

    false

Signatures

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

  • Darkcomet family
  • Executes dropped EXE 3 IoCs
  • Loads dropped DLL 4 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Suspicious use of SetThreadContext 3 IoCs
  • UPX packed file 27 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Gathers network information 2 TTPs 1 IoCs

    Uses commandline utility to view network configuration.

  • Modifies registry key 1 TTPs 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 23 IoCs
  • Suspicious use of SetWindowsHookEx 5 IoCs
  • Suspicious use of WriteProcessMemory 44 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\c7d4c1c411927c1392f0793ee02108c86f134b90075ee2574fd0864657725d74.exe
    "C:\Users\Admin\AppData\Local\Temp\c7d4c1c411927c1392f0793ee02108c86f134b90075ee2574fd0864657725d74.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1964
    • C:\Users\Admin\AppData\Local\Temp\c7d4c1c411927c1392f0793ee02108c86f134b90075ee2574fd0864657725d74.exe
      "C:\Users\Admin\AppData\Local\Temp\c7d4c1c411927c1392f0793ee02108c86f134b90075ee2574fd0864657725d74.exe"
      2⤵
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2632
      • C:\Users\Admin\AppData\Roaming\Microsoft\winupd.exe
        C:\Users\Admin\AppData\Roaming\Microsoft\winupd.exe -notray
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious use of SetThreadContext
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:2712
        • C:\Users\Admin\AppData\Roaming\Microsoft\winupd.exe
          "C:\Users\Admin\AppData\Roaming\Microsoft\winupd.exe"
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:2548
          • C:\Windows\SysWOW64\ipconfig.exe
            "C:\Windows\system32\ipconfig.exe"
            5⤵
            • System Location Discovery: System Language Discovery
            • Gathers network information
            • Suspicious use of WriteProcessMemory
            PID:2992
            • C:\Windows\SysWOW64\cmd.exe
              cmd /c ""C:\Users\Admin\AppData\Local\Temp\HKWVWSQX.bat" "
              6⤵
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:1924
              • C:\Windows\SysWOW64\reg.exe
                REG ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v WinUpdate /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Microsoft\winupd.exe -notray" /f
                7⤵
                • Adds Run key to start application
                • System Location Discovery: System Language Discovery
                • Modifies registry key
                PID:596
        • C:\Users\Admin\AppData\Roaming\Microsoft\winupd.exe
          "C:\Users\Admin\AppData\Roaming\Microsoft\winupd.exe"
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of SetWindowsHookEx
          PID:2520

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\HKWVWSQX.bat

    Filesize

    151B

    MD5

    cac890d00365d07b9ca89def17cc3a36

    SHA1

    6fa99679ede791c16b5d3e6d243a98e8bbdb7eab

    SHA256

    4f98ddee89760080a5c8a93666d2f5c97be52b741265ef4d1ce9aaebf05f12da

    SHA512

    124dc0b18e13425bde43bcbbe2a99005928e398bffcb458d498aac9e754bc5b92b703270667800876c60b0801343f2de8c6b9a1eebafd80bb4f6d5dc295dd9f1

  • \Users\Admin\AppData\Roaming\Microsoft\winupd.exe

    Filesize

    520KB

    MD5

    e4ef48e15883dcefc76b856acd0359aa

    SHA1

    13a43b3409aa2ccba636d3fe5beda2f0feb78ffb

    SHA256

    583ec4f9dcf6654e1c461dbaab1679e307b19f173432b760e7f1d5105c02c2a3

    SHA512

    0e40f27ba7a546bc96536b7c6d0f63ccbedc25b5daaa04728a07ced6a71b8f3c3a7c3fb32f9353fae71d5b4a095d013a0a2c873c3b5e6939c26019a412004cd1

  • memory/1964-3-0x0000000000400000-0x0000000000483000-memory.dmp

    Filesize

    524KB

  • memory/1964-2-0x0000000000400000-0x0000000000414000-memory.dmp

    Filesize

    80KB

  • memory/1964-19-0x0000000000400000-0x0000000000483000-memory.dmp

    Filesize

    524KB

  • memory/1964-18-0x0000000000400000-0x0000000000483000-memory.dmp

    Filesize

    524KB

  • memory/1964-16-0x0000000000400000-0x0000000000414000-memory.dmp

    Filesize

    80KB

  • memory/2520-87-0x0000000000400000-0x00000000004B7000-memory.dmp

    Filesize

    732KB

  • memory/2520-78-0x0000000000400000-0x00000000004B7000-memory.dmp

    Filesize

    732KB

  • memory/2520-99-0x0000000000400000-0x00000000004B7000-memory.dmp

    Filesize

    732KB

  • memory/2520-98-0x0000000000400000-0x00000000004B7000-memory.dmp

    Filesize

    732KB

  • memory/2520-97-0x0000000000400000-0x00000000004B7000-memory.dmp

    Filesize

    732KB

  • memory/2520-96-0x0000000000400000-0x00000000004B7000-memory.dmp

    Filesize

    732KB

  • memory/2520-52-0x0000000000400000-0x00000000004B7000-memory.dmp

    Filesize

    732KB

  • memory/2520-61-0x0000000000400000-0x00000000004B7000-memory.dmp

    Filesize

    732KB

  • memory/2520-95-0x0000000000400000-0x00000000004B7000-memory.dmp

    Filesize

    732KB

  • memory/2520-94-0x0000000000400000-0x00000000004B7000-memory.dmp

    Filesize

    732KB

  • memory/2520-65-0x0000000000400000-0x00000000004B7000-memory.dmp

    Filesize

    732KB

  • memory/2520-64-0x0000000000400000-0x00000000004B7000-memory.dmp

    Filesize

    732KB

  • memory/2520-74-0x0000000000400000-0x00000000004B7000-memory.dmp

    Filesize

    732KB

  • memory/2520-76-0x0000000000400000-0x00000000004B7000-memory.dmp

    Filesize

    732KB

  • memory/2520-77-0x0000000000400000-0x00000000004B7000-memory.dmp

    Filesize

    732KB

  • memory/2520-75-0x0000000000400000-0x00000000004B7000-memory.dmp

    Filesize

    732KB

  • memory/2520-93-0x0000000000400000-0x00000000004B7000-memory.dmp

    Filesize

    732KB

  • memory/2520-54-0x0000000000400000-0x00000000004B7000-memory.dmp

    Filesize

    732KB

  • memory/2520-50-0x0000000000400000-0x00000000004B7000-memory.dmp

    Filesize

    732KB

  • memory/2520-92-0x0000000000400000-0x00000000004B7000-memory.dmp

    Filesize

    732KB

  • memory/2520-79-0x0000000000400000-0x00000000004B7000-memory.dmp

    Filesize

    732KB

  • memory/2520-91-0x0000000000400000-0x00000000004B7000-memory.dmp

    Filesize

    732KB

  • memory/2520-90-0x0000000000400000-0x00000000004B7000-memory.dmp

    Filesize

    732KB

  • memory/2520-84-0x0000000000400000-0x00000000004B7000-memory.dmp

    Filesize

    732KB

  • memory/2520-85-0x0000000000400000-0x00000000004B7000-memory.dmp

    Filesize

    732KB

  • memory/2520-86-0x0000000000400000-0x00000000004B7000-memory.dmp

    Filesize

    732KB

  • memory/2520-89-0x0000000000400000-0x00000000004B7000-memory.dmp

    Filesize

    732KB

  • memory/2520-88-0x0000000000400000-0x00000000004B7000-memory.dmp

    Filesize

    732KB

  • memory/2548-83-0x0000000000400000-0x0000000000407000-memory.dmp

    Filesize

    28KB

  • memory/2632-12-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

    Filesize

    4KB

  • memory/2632-20-0x0000000000400000-0x0000000000407000-memory.dmp

    Filesize

    28KB

  • memory/2632-4-0x0000000000400000-0x0000000000407000-memory.dmp

    Filesize

    28KB

  • memory/2632-68-0x0000000000400000-0x0000000000407000-memory.dmp

    Filesize

    28KB

  • memory/2632-8-0x0000000000400000-0x0000000000407000-memory.dmp

    Filesize

    28KB

  • memory/2632-6-0x0000000000400000-0x0000000000407000-memory.dmp

    Filesize

    28KB

  • memory/2712-62-0x0000000000400000-0x0000000000483000-memory.dmp

    Filesize

    524KB

  • memory/2712-48-0x0000000000400000-0x0000000000483000-memory.dmp

    Filesize

    524KB

  • memory/2712-36-0x0000000000400000-0x0000000000483000-memory.dmp

    Filesize

    524KB

  • memory/2992-72-0x00000000000C0000-0x00000000000C1000-memory.dmp

    Filesize

    4KB