Overview

overview

10

Static

static

3

9b476881db...21.exe

windows7-x64

10

9b476881db...21.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    07-01-2025 17:18

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    9b476881db7aef7dbedcce78017129b37667ea282d0c99566a38cfa94e343821.exe

  • Size

    759KB

  • MD5

    ab5e0c9fbbf7cd002742a751c290a0c0

  • SHA1

    ef61e32aadd9ebfc674c4f951c860f2d952b639d

  • SHA256

    9b476881db7aef7dbedcce78017129b37667ea282d0c99566a38cfa94e343821

  • SHA512

    7e79dae7dc598113d4488d7b2460c174284b4b0ad530c49a091d987c1c42c323edb769c030510613023c569924f5036878a133f8dd81050f17ae3c15bcd5f2f8

  • SSDEEP

    12288:qM3iXBPCO36urpV5HODRH0xh9W1gx7K8hiz1v8hvwxUj1ShwONxyibDwdB:oqEdTE0X9WSxG8IZv8hI21ShFNxyoMj

Score
10/10
darkcometmusicagoagilenetdiscoverypersistencerattrojan

Malware Config

Extracted

Family

darkcomet

Botnet

MusicAGO

C2

mantrust.noip.me:3013

Mutex

DC_MUTEX-80DX6FJ

Attributes
  • gencode

    5GYC98Amy0Ur

  • install

    false

  • offline_keylogger

    true

  • persistence

    false

Signatures

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

    trojanratdarkcomet
  • Darkcomet family
    darkcomet
  • Checks computer location settings 2 TTPs 4 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 6 IoCs
  • Obfuscated with Agile.Net obfuscator 1 IoCs

    Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

    agilenet
  • Adds Run key to start application 2 TTPs 3 IoCs
    persistence
  • Suspicious use of SetThreadContext 4 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 12 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\9b476881db7aef7dbedcce78017129b37667ea282d0c99566a38cfa94e343821.exe
    "C:\Users\Admin\AppData\Local\Temp\9b476881db7aef7dbedcce78017129b37667ea282d0c99566a38cfa94e343821.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of SetThreadContext
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: RenamesItself
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1208
    • C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
      "C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe"
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      PID:392
    • C:\Users\Admin\AppData\Roaming\Microsoft FxCop\wmiApSrv.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft FxCop\wmiApSrv.exe"
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • System Location Discovery: System Language Discovery
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2096
      • C:\Users\Admin\AppData\Roaming\Microsoft FxCop\SamSs.exe
        "C:\Users\Admin\AppData\Roaming\Microsoft FxCop\SamSs.exe"
        3⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • System Location Discovery: System Language Discovery
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:5040
        • C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
          "C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe"
          4⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of AdjustPrivilegeToken
          PID:2544
        • C:\Users\Admin\AppData\Roaming\Microsoft FxCop\wmiApSrv.exe
          "C:\Users\Admin\AppData\Roaming\Microsoft FxCop\wmiApSrv.exe"
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:1364
    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\takshost.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\takshost.exe"
      2⤵
      • Checks computer location settings
      • Suspicious use of SetThreadContext
      • System Location Discovery: System Language Discovery
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:4336
      • C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
        "C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe"
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of AdjustPrivilegeToken
        PID:4232
      • C:\Users\Admin\AppData\Roaming\Microsoft FxCop\wmiApSrv.exe
        "C:\Users\Admin\AppData\Roaming\Microsoft FxCop\wmiApSrv.exe"
        3⤵
        • Executes dropped EXE
        • Adds Run key to start application
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:4468
        • C:\Users\Admin\AppData\Roaming\Microsoft FxCop\SamSs.exe
          "C:\Users\Admin\AppData\Roaming\Microsoft FxCop\SamSs.exe"
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • Suspicious use of SetThreadContext
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:1728
          • C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
            "C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe"
            5⤵
            • System Location Discovery: System Language Discovery
            PID:460
          • C:\Users\Admin\AppData\Roaming\Microsoft FxCop\wmiApSrv.exe
            "C:\Users\Admin\AppData\Roaming\Microsoft FxCop\wmiApSrv.exe"
            5⤵
            • Executes dropped EXE
            • Adds Run key to start application
            • System Location Discovery: System Language Discovery
            PID:2492

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Microsoft\CLR_v2.0_32\UsageLogs\SamSs.exe.log
    Filesize

    319B

    MD5

    824ba7b7eed8b900a98dd25129c4cd83

    SHA1

    54478770b2158000ef365591d42977cb854453a1

    SHA256

    d182dd648c92e41cd62dccc65f130c07f0a96c03b32f907c3d1218e9aa5bda03

    SHA512

    ae4f3a9673711ecb6cc5d06874c587341d5094803923b53b6e982278fa64549d7acf866de165e23750facd55da556b6794c0d32f129f4087529c73acd4ffb11e

    Download Submit

  • C:\Users\Admin\AppData\Local\Microsoft\CLR_v2.0_32\UsageLogs\wmiApSrv.exe.log
    Filesize

    224B

    MD5

    c19eb8c8e7a40e6b987f9d2ee952996e

    SHA1

    6fc3049855bc9100643e162511673c6df0f28bfb

    SHA256

    677e9e30350df17e2bc20fa9f7d730e9f7cc6e870d6520a345f5f7dc5b31f58a

    SHA512

    860713b4a787c2189ed12a47d4b68b60ac00c7a253cae52dd4eb9276dacafeae3a81906b6d0742c8ecfdfaa255777c445beb7c2a532f3c677a9903237ac97596

    Download Submit

  • C:\Users\Admin\AppData\Roaming\Microsoft FxCop\SamSs.exe
    Filesize

    759KB

    MD5

    ab5e0c9fbbf7cd002742a751c290a0c0

    SHA1

    ef61e32aadd9ebfc674c4f951c860f2d952b639d

    SHA256

    9b476881db7aef7dbedcce78017129b37667ea282d0c99566a38cfa94e343821

    SHA512

    7e79dae7dc598113d4488d7b2460c174284b4b0ad530c49a091d987c1c42c323edb769c030510613023c569924f5036878a133f8dd81050f17ae3c15bcd5f2f8

    Download Submit

  • C:\Users\Admin\AppData\Roaming\Microsoft FxCop\wmiApSrv.exe
    Filesize

    18KB

    MD5

    97235ac11c44acda447e9b8b393ae1da

    SHA1

    370e8a69c78e677dfccc40aceb7238cd8b8596eb

    SHA256

    10017309dab7a06278fdac82ee487e63b2f6ea4ec1309e2e31928d1323885698

    SHA512

    ff44929eaed0ef767122f065071c1030f5987835e17fbe516898c724b4beffee9f827e3378b552480f07629aa76dc1a1370b8ede5edb8f6bdb7b22245d044f0b

    Download Submit

  • memory/392-8-0x0000000000400000-0x00000000004B2000-memory.dmp

    Filesize

    712KB

    Download

  • memory/392-12-0x0000000000400000-0x00000000004B2000-memory.dmp

    Filesize

    712KB

    Download

  • memory/392-27-0x0000000000400000-0x00000000004B2000-memory.dmp

    Filesize

    712KB

    Download

  • memory/392-9-0x0000000000400000-0x00000000004B2000-memory.dmp

    Filesize

    712KB

    Download

  • memory/392-10-0x0000000000400000-0x00000000004B2000-memory.dmp

    Filesize

    712KB

    Download

  • memory/392-11-0x00000000022C0000-0x00000000022C1000-memory.dmp

    Filesize

    4KB

    Download

  • memory/392-13-0x0000000000400000-0x00000000004B2000-memory.dmp

    Filesize

    712KB

    Download

  • memory/392-7-0x0000000000400000-0x00000000004B2000-memory.dmp

    Filesize

    712KB

    Download

  • memory/1208-4-0x0000000074F50000-0x0000000075501000-memory.dmp

    Filesize

    5.7MB

    Download

  • memory/1208-1-0x0000000074F50000-0x0000000075501000-memory.dmp

    Filesize

    5.7MB

    Download

  • memory/1208-2-0x0000000074F50000-0x0000000075501000-memory.dmp

    Filesize

    5.7MB

    Download

  • memory/1208-3-0x0000000074F52000-0x0000000074F53000-memory.dmp

    Filesize

    4KB

    Download

  • memory/1208-0-0x0000000074F52000-0x0000000074F53000-memory.dmp

    Filesize

    4KB

    Download

  • memory/1208-36-0x0000000074F50000-0x0000000075501000-memory.dmp

    Filesize

    5.7MB

    Download

  • memory/2096-26-0x0000000074F50000-0x0000000075501000-memory.dmp

    Filesize

    5.7MB

    Download

  • memory/2096-29-0x0000000074F50000-0x0000000075501000-memory.dmp

    Filesize

    5.7MB

    Download

  • memory/2096-28-0x0000000074F52000-0x0000000074F53000-memory.dmp

    Filesize

    4KB

    Download

  • memory/2096-38-0x0000000074F50000-0x0000000075501000-memory.dmp

    Filesize

    5.7MB

    Download

  • memory/2096-25-0x0000000074F50000-0x0000000075501000-memory.dmp

    Filesize

    5.7MB

    Download

  • memory/2096-24-0x0000000074F52000-0x0000000074F53000-memory.dmp

    Filesize

    4KB

    Download

  • memory/5040-33-0x0000000074F50000-0x0000000075501000-memory.dmp

    Filesize

    5.7MB

    Download

  • memory/5040-34-0x0000000074F50000-0x0000000075501000-memory.dmp

    Filesize

    5.7MB

    Download

  • memory/5040-54-0x0000000074F50000-0x0000000075501000-memory.dmp

    Filesize

    5.7MB

    Download