Analysis
-
max time kernel
149s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20250129-en -
resource tags
-
submitted
07/02/2025, 02:09
General
-
Target
81d4ae23ba6fda401f23dcd6fe0e5ab0d074cabc55da653c21443df29efed2c1.exe
-
Size
304KB
-
MD5
90e6a2469d871d04bee95fca6c9e9c55
-
SHA1
a2defc9af6b677b5940362f7f496ac54eedc58e9
-
SHA256
81d4ae23ba6fda401f23dcd6fe0e5ab0d074cabc55da653c21443df29efed2c1
-
SHA512
922b7dee8e9f574a82cc0e96c6dd141315e0a9b32f9ce677bc2e4860c2c8296617d3ab6c79010a35fb42564ebeb1bafb0f04c1a6e6dc4826cb51221a21e57005
-
SSDEEP
6144:XsBlY9Z0moB/jMIzk+AUygl+faCEmV34FIYxboEbo:zLAQ+A3gpmNYxboMo
Malware Config
Signatures
-
Darkcomet
DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
-
Darkcomet family
-
Windows security bypass 2 TTPs 2 IoCs
-
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 1 IoCs
-
Windows security modification 2 TTPs 1 IoCs
-
Suspicious use of SetThreadContext 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Checks processor information in registry 2 TTPs 8 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Enumerates system info in registry 2 TTPs 2 IoCs
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 49 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
-
Suspicious use of WriteProcessMemory 8 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\81d4ae23ba6fda401f23dcd6fe0e5ab0d074cabc55da653c21443df29efed2c1.exe"C:\Users\Admin\AppData\Local\Temp\81d4ae23ba6fda401f23dcd6fe0e5ab0d074cabc55da653c21443df29efed2c1.exe"1⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\explorer.exe"C:\Users\Admin\AppData\Roaming\explorer.exe"2⤵
- Windows security bypass
- Checks BIOS information in registry
- Executes dropped EXE
- Windows security modification
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\explorer.exe"C:\Windows\SysWOW64\explorer.exe"3⤵
- Windows security bypass
- Checks BIOS information in registry
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
232KB
MD5813c33b6cbd5ab4c3f7511649a20cef5
SHA13b694fc0c4eef1495bde4e704c3272213d52bbf9
SHA256c6f22a2868f89e29b6ee5acc9f82aab9a9d6f1a8b2f9527418ee53b2222132e7
SHA512e3af68d8c4c0a851fb80d172a225921cdfee50712c14f9bda5f11a4d8f9fcac23241deef6a8e8dd14091bdc65e498c95cc1de03b543f422e3929ccc36cf99803
-
Filesize
624KB
-
Filesize
2.0MB
-
Filesize
664KB
-
Filesize
4.8MB
-
Filesize
2.0MB
-
Filesize
32KB
-
Filesize
304KB
-
Filesize
2.0MB
-
Filesize
392KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
756KB
-
Filesize
756KB
-
Filesize
2.0MB
-
Filesize
756KB
-
Filesize
756KB
-
Filesize
756KB
-
Filesize
2.0MB
-
Filesize
756KB
-
Filesize
2.0MB
-
Filesize
756KB
-
Filesize
2.0MB