Analysis
- max time kernel
93s - max time network
96s - platform
windows10-2004_x64 - resource
win10v2004-20250129-en - resource tags
- submitted
05/02/2025, 07:14
General
- Target 9fa6c7d1c6e03a0eb892319ee48c8510f91c43b5056aa7b76ee134ccb3d0ef87.exe
- Size 283KB
- Sample250205-h2tr1awkfv
- SHA256 9fa6c7d1c6e03a0eb892319ee48c8510f91c43b5056aa7b76ee134ccb3d0ef87
Malware Config
Extracted
-
darkcomet
-
Guest16
-
whatrobloxhackedrobuxlastnight.ddns.net:1604
-
DC_MUTEX-XABL0YQ
-
InstallPath
Alx
-
gencode
nuMr7zMe6ooH
-
install
true
-
offline_keylogger
true
-
persistence
false
-
reg_key
Alx
Signatures
- Darkcomet
DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
- Darkcomet family
- Modifies WinLogon for persistence 2 TTPs 1 IoCs
- Adds Run key to start application 2 TTPs 1 IoCs
- UPX packed file 3 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious use of AdjustPrivilegeToken 24 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\9fa6c7d1c6e03a0eb892319ee48c8510f91c43b5056aa7b76ee134ccb3d0ef87.exeC:\Users\Admin\AppData\Local\Temp\9fa6c7d1c6e03a0eb892319ee48c8510f91c43b5056aa7b76ee134ccb3d0ef87.exe dsrm -subtree -noprompt -c user"http://+:443"1⤵
- Modifies WinLogon for persistence
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Replay Monitor
Loading Replay Monitor...
Downloads
Alx
memory/1040-0-0x0000000000400000-0x00000000004C7000-memory.dmp
memory/1040-1-0x0000000002850000-0x0000000002851000-memory.dmp
memory/1040-28-0x0000000000400000-0x00000000004C7000-memory.dmp