Analysis
-
max time kernel
150s -
max time network
146s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
13-12-2024 01:35
Behavioral task
behavioral1
Sample
ANTI.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
ANTI.exe
Resource
win10v2004-20241007-en
General
-
Target
ANTI.exe
-
Size
649KB
-
MD5
2228a7c38b50114e7bec2d943f06acde
-
SHA1
15c6b33fe6a0ca328c2036b9017cd6d3a4a4397e
-
SHA256
49c0b1d294cca6b6c0d78b16f2b0efb081cd49bfe586653ea533b07328761aa6
-
SHA512
8c19ec40e2599613f7a8e4ba4544a1080f49db1740939c4fce4fcb8a0e9e111c4548a5aab6a0246b335858b6bf258ed7f2faa84c8d3d157e093fd5803ba5f488
-
SSDEEP
12288:bk0QVlhmPojAPTMEsUTg0oChO/Q2JbsbjPbN5qhRTtYe3f+Iw86k/9/+X:Q0QRWoJEfg0oChGdJQbjPbNW5tYeP+Ge
Malware Config
Extracted
darkcomet
Guest16_min
BAHROZPOOL.ZAPTO.ORG:1604
DCMIN_MUTEX-FQK5TTL
-
InstallPath
DCSCMIN\IMDCSC.exe
-
gencode
brdwfMVFo8ev
-
install
true
-
offline_keylogger
true
-
persistence
false
-
reg_key
DarkComet RAT
Signatures
-
Darkcomet family
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Users\\Admin\\Documents\\DCSCMIN\\IMDCSC.exe" ANTI.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\International\Geo\Nation ANTI.exe -
Executes dropped EXE 1 IoCs
pid Process 4552 IMDCSC.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\DarkComet RAT = "C:\\Users\\Admin\\Documents\\DCSCMIN\\IMDCSC.exe" ANTI.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ANTI.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IMDCSC.exe -
Suspicious use of AdjustPrivilegeToken 48 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 1764 ANTI.exe Token: SeSecurityPrivilege 1764 ANTI.exe Token: SeTakeOwnershipPrivilege 1764 ANTI.exe Token: SeLoadDriverPrivilege 1764 ANTI.exe Token: SeSystemProfilePrivilege 1764 ANTI.exe Token: SeSystemtimePrivilege 1764 ANTI.exe Token: SeProfSingleProcessPrivilege 1764 ANTI.exe Token: SeIncBasePriorityPrivilege 1764 ANTI.exe Token: SeCreatePagefilePrivilege 1764 ANTI.exe Token: SeBackupPrivilege 1764 ANTI.exe Token: SeRestorePrivilege 1764 ANTI.exe Token: SeShutdownPrivilege 1764 ANTI.exe Token: SeDebugPrivilege 1764 ANTI.exe Token: SeSystemEnvironmentPrivilege 1764 ANTI.exe Token: SeChangeNotifyPrivilege 1764 ANTI.exe Token: SeRemoteShutdownPrivilege 1764 ANTI.exe Token: SeUndockPrivilege 1764 ANTI.exe Token: SeManageVolumePrivilege 1764 ANTI.exe Token: SeImpersonatePrivilege 1764 ANTI.exe Token: SeCreateGlobalPrivilege 1764 ANTI.exe Token: 33 1764 ANTI.exe Token: 34 1764 ANTI.exe Token: 35 1764 ANTI.exe Token: 36 1764 ANTI.exe Token: SeIncreaseQuotaPrivilege 4552 IMDCSC.exe Token: SeSecurityPrivilege 4552 IMDCSC.exe Token: SeTakeOwnershipPrivilege 4552 IMDCSC.exe Token: SeLoadDriverPrivilege 4552 IMDCSC.exe Token: SeSystemProfilePrivilege 4552 IMDCSC.exe Token: SeSystemtimePrivilege 4552 IMDCSC.exe Token: SeProfSingleProcessPrivilege 4552 IMDCSC.exe Token: SeIncBasePriorityPrivilege 4552 IMDCSC.exe Token: SeCreatePagefilePrivilege 4552 IMDCSC.exe Token: SeBackupPrivilege 4552 IMDCSC.exe Token: SeRestorePrivilege 4552 IMDCSC.exe Token: SeShutdownPrivilege 4552 IMDCSC.exe Token: SeDebugPrivilege 4552 IMDCSC.exe Token: SeSystemEnvironmentPrivilege 4552 IMDCSC.exe Token: SeChangeNotifyPrivilege 4552 IMDCSC.exe Token: SeRemoteShutdownPrivilege 4552 IMDCSC.exe Token: SeUndockPrivilege 4552 IMDCSC.exe Token: SeManageVolumePrivilege 4552 IMDCSC.exe Token: SeImpersonatePrivilege 4552 IMDCSC.exe Token: SeCreateGlobalPrivilege 4552 IMDCSC.exe Token: 33 4552 IMDCSC.exe Token: 34 4552 IMDCSC.exe Token: 35 4552 IMDCSC.exe Token: 36 4552 IMDCSC.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 4552 IMDCSC.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 1764 wrote to memory of 4552 1764 ANTI.exe 82 PID 1764 wrote to memory of 4552 1764 ANTI.exe 82 PID 1764 wrote to memory of 4552 1764 ANTI.exe 82
Processes
-
C:\Users\Admin\AppData\Local\Temp\ANTI.exe"C:\Users\Admin\AppData\Local\Temp\ANTI.exe"1⤵
- Modifies WinLogon for persistence
- Checks computer location settings
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1764 -
C:\Users\Admin\Documents\DCSCMIN\IMDCSC.exe"C:\Users\Admin\Documents\DCSCMIN\IMDCSC.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:4552
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
649KB
MD52228a7c38b50114e7bec2d943f06acde
SHA115c6b33fe6a0ca328c2036b9017cd6d3a4a4397e
SHA25649c0b1d294cca6b6c0d78b16f2b0efb081cd49bfe586653ea533b07328761aa6
SHA5128c19ec40e2599613f7a8e4ba4544a1080f49db1740939c4fce4fcb8a0e9e111c4548a5aab6a0246b335858b6bf258ed7f2faa84c8d3d157e093fd5803ba5f488