Analysis
-
max time kernel
150s -
max time network
143s -
platform
windows10-2004_x64 -
resource
win10v2004-20250217-en -
resource tags
arch:x64arch:x86image:win10v2004-20250217-enlocale:en-usos:windows10-2004-x64system -
submitted
27/02/2025, 22:46
Static task
static1
Behavioral task
behavioral1
Sample
6514c07cc8c4c8eec0497429b2740aaa63472c91916956c08612f2ed0b11af5a.exe
Resource
win7-20250207-en
General
-
Target
6514c07cc8c4c8eec0497429b2740aaa63472c91916956c08612f2ed0b11af5a.exe
-
Size
343KB
-
MD5
77fd5c6a7ed616d1146a055a9aa58720
-
SHA1
cafacc26a98e13c768eeea3bba37973db58453c3
-
SHA256
6514c07cc8c4c8eec0497429b2740aaa63472c91916956c08612f2ed0b11af5a
-
SHA512
65fa1be05fc3df2caab383fb82af5b619ee1caedab09689878f596596ebf2972ec450fc24ae9e4c27f1639cbcac26c4b7898fa8c95ae27d4fbddb5df228f112f
-
SSDEEP
6144:XYLtU7Ixhnhz5TN6mJWd/7qMD8gmggfojeGbfUTpYDDmu/+3fbN:osI3lFZWdqswtfJG+pG/YN
Malware Config
Extracted
darkcomet
Guest16
159.146.115.189:3131
DC_MUTEX-6VU05UR
-
gencode
FbWUotbhX9sQ
-
install
false
-
offline_keylogger
true
-
persistence
false
Signatures
-
Darkcomet family
-
Executes dropped EXE 1 IoCs
pid Process 3588 6514c07cc8c4c8eec0497429b2740aaa63472c91916956c08612f2ed0b11af5amgr.exe -
resource yara_rule behavioral2/files/0x000c000000023be9-4.dat upx behavioral2/memory/3588-5-0x0000000000400000-0x000000000045D000-memory.dmp upx -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 1 IoCs
pid pid_target Process procid_target 1896 3588 WerFault.exe 86 -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6514c07cc8c4c8eec0497429b2740aaa63472c91916956c08612f2ed0b11af5a.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6514c07cc8c4c8eec0497429b2740aaa63472c91916956c08612f2ed0b11af5amgr.exe -
Suspicious use of AdjustPrivilegeToken 24 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 4896 6514c07cc8c4c8eec0497429b2740aaa63472c91916956c08612f2ed0b11af5a.exe Token: SeSecurityPrivilege 4896 6514c07cc8c4c8eec0497429b2740aaa63472c91916956c08612f2ed0b11af5a.exe Token: SeTakeOwnershipPrivilege 4896 6514c07cc8c4c8eec0497429b2740aaa63472c91916956c08612f2ed0b11af5a.exe Token: SeLoadDriverPrivilege 4896 6514c07cc8c4c8eec0497429b2740aaa63472c91916956c08612f2ed0b11af5a.exe Token: SeSystemProfilePrivilege 4896 6514c07cc8c4c8eec0497429b2740aaa63472c91916956c08612f2ed0b11af5a.exe Token: SeSystemtimePrivilege 4896 6514c07cc8c4c8eec0497429b2740aaa63472c91916956c08612f2ed0b11af5a.exe Token: SeProfSingleProcessPrivilege 4896 6514c07cc8c4c8eec0497429b2740aaa63472c91916956c08612f2ed0b11af5a.exe Token: SeIncBasePriorityPrivilege 4896 6514c07cc8c4c8eec0497429b2740aaa63472c91916956c08612f2ed0b11af5a.exe Token: SeCreatePagefilePrivilege 4896 6514c07cc8c4c8eec0497429b2740aaa63472c91916956c08612f2ed0b11af5a.exe Token: SeBackupPrivilege 4896 6514c07cc8c4c8eec0497429b2740aaa63472c91916956c08612f2ed0b11af5a.exe Token: SeRestorePrivilege 4896 6514c07cc8c4c8eec0497429b2740aaa63472c91916956c08612f2ed0b11af5a.exe Token: SeShutdownPrivilege 4896 6514c07cc8c4c8eec0497429b2740aaa63472c91916956c08612f2ed0b11af5a.exe Token: SeDebugPrivilege 4896 6514c07cc8c4c8eec0497429b2740aaa63472c91916956c08612f2ed0b11af5a.exe Token: SeSystemEnvironmentPrivilege 4896 6514c07cc8c4c8eec0497429b2740aaa63472c91916956c08612f2ed0b11af5a.exe Token: SeChangeNotifyPrivilege 4896 6514c07cc8c4c8eec0497429b2740aaa63472c91916956c08612f2ed0b11af5a.exe Token: SeRemoteShutdownPrivilege 4896 6514c07cc8c4c8eec0497429b2740aaa63472c91916956c08612f2ed0b11af5a.exe Token: SeUndockPrivilege 4896 6514c07cc8c4c8eec0497429b2740aaa63472c91916956c08612f2ed0b11af5a.exe Token: SeManageVolumePrivilege 4896 6514c07cc8c4c8eec0497429b2740aaa63472c91916956c08612f2ed0b11af5a.exe Token: SeImpersonatePrivilege 4896 6514c07cc8c4c8eec0497429b2740aaa63472c91916956c08612f2ed0b11af5a.exe Token: SeCreateGlobalPrivilege 4896 6514c07cc8c4c8eec0497429b2740aaa63472c91916956c08612f2ed0b11af5a.exe Token: 33 4896 6514c07cc8c4c8eec0497429b2740aaa63472c91916956c08612f2ed0b11af5a.exe Token: 34 4896 6514c07cc8c4c8eec0497429b2740aaa63472c91916956c08612f2ed0b11af5a.exe Token: 35 4896 6514c07cc8c4c8eec0497429b2740aaa63472c91916956c08612f2ed0b11af5a.exe Token: 36 4896 6514c07cc8c4c8eec0497429b2740aaa63472c91916956c08612f2ed0b11af5a.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 4896 6514c07cc8c4c8eec0497429b2740aaa63472c91916956c08612f2ed0b11af5a.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4896 wrote to memory of 3588 4896 6514c07cc8c4c8eec0497429b2740aaa63472c91916956c08612f2ed0b11af5a.exe 86 PID 4896 wrote to memory of 3588 4896 6514c07cc8c4c8eec0497429b2740aaa63472c91916956c08612f2ed0b11af5a.exe 86 PID 4896 wrote to memory of 3588 4896 6514c07cc8c4c8eec0497429b2740aaa63472c91916956c08612f2ed0b11af5a.exe 86
Processes
-
C:\Users\Admin\AppData\Local\Temp\6514c07cc8c4c8eec0497429b2740aaa63472c91916956c08612f2ed0b11af5a.exe"C:\Users\Admin\AppData\Local\Temp\6514c07cc8c4c8eec0497429b2740aaa63472c91916956c08612f2ed0b11af5a.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4896 -
C:\Users\Admin\AppData\Local\Temp\6514c07cc8c4c8eec0497429b2740aaa63472c91916956c08612f2ed0b11af5amgr.exeC:\Users\Admin\AppData\Local\Temp\6514c07cc8c4c8eec0497429b2740aaa63472c91916956c08612f2ed0b11af5amgr.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3588 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3588 -s 2643⤵
- Program crash
PID:1896
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3588 -ip 35881⤵PID:4556
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\6514c07cc8c4c8eec0497429b2740aaa63472c91916956c08612f2ed0b11af5amgr.exe
Filesize105KB
MD5d5ca6e1f080abc64bbb11e098acbeabb
SHA11849634bf5a65e1baddddd4452c99dfa003e2647
SHA25630193b5ccf8a1834eac3502ef165350ab74b107451145f3d2937fdf24b9eceae
SHA512aa57ce51de38af6212d7339c4baac543a54b0f527621b0ef9e78eca5e5699e8508a154f54f8ac04135527d8417275eeee72a502a362547575699330cc756b161