Analysis
- max time kernel
150s - max time network
146s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260618-en - resource tags
- submitted
26/06/2026, 12:51
General
- Target robuxhilesibedavaindir.exe
- Size 251KB
- Sample260626-p3mteact6m
- SHA256 b00808b57ad3fe8742dba40cacbebe0b22d85c5910b1e4b321a9704dc1a5976e
Malware Config
Extracted
-
darkcomet
-
Guest16
-
127.0.0.1:1604
-
DC_MUTEX-WNPK0V9
-
gencode
1rUS8UJ7tUxU
-
install
false
-
offline_keylogger
true
-
persistence
false
Signatures
- Family: Darkcomet
DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
- Modifies firewall policy service 3 TTPs 3 IoCs
- Windows security bypass 2 TTPs 2 IoCs
- Disables RegEdit via registry modification 1 IoCs
- Disables Task Manager via registry modification
- Sets file to hidden 1 TTPs 2 IoCs
Modifies file attributes to stop it showing in Explorer etc.
- Windows security modification 2 TTPs 2 IoCs
- UPX packed file 17 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 6 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious use of AdjustPrivilegeToken 24 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 6 IoCs
- System policy modification 1 TTPs 3 IoCs
- Views/modifies file attributes 1 TTPs 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\robuxhilesibedavaindir.exe"C:\Users\Admin\AppData\Local\Temp\robuxhilesibedavaindir.exe"1⤵
- Modifies firewall policy service
- Windows security bypass
- Disables RegEdit via registry modification
- Windows security modification
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp\robuxhilesibedavaindir.exe" +s +h2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Users\Admin\AppData\Local\Temp\robuxhilesibedavaindir.exe" +s +h3⤵
- Sets file to hidden
- System Location Discovery: System Language Discovery
- Views/modifies file attributes
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp" +s +h2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Users\Admin\AppData\Local\Temp" +s +h3⤵
- Sets file to hidden
- System Location Discovery: System Language Discovery
- Views/modifies file attributes
-
-
-
C:\Windows\SysWOW64\notepad.exenotepad2⤵
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v16
Defense Evasion
Hide Artifacts
2Hidden Files and Directories
2Impair Defenses
3Disable or Modify System Firewall
1Disable or Modify Tools
2Modify Registry
4Replay Monitor
Loading Replay Monitor...
Downloads
memory/1716-9-0x0000000000400000-0x00000000004B7000-memory.dmp
memory/1716-11-0x0000000000400000-0x00000000004B7000-memory.dmp
memory/1716-2-0x0000000000400000-0x00000000004B7000-memory.dmp
memory/1716-10-0x0000000000400000-0x00000000004B7000-memory.dmp
memory/1716-4-0x0000000000400000-0x00000000004B7000-memory.dmp
memory/1716-5-0x0000000000400000-0x00000000004B7000-memory.dmp
memory/1716-7-0x0000000000400000-0x00000000004B7000-memory.dmp
memory/1716-8-0x0000000000400000-0x00000000004B7000-memory.dmp
memory/1716-1-0x00000000004B6000-0x00000000004B7000-memory.dmp
memory/1716-0-0x0000000000400000-0x00000000004B7000-memory.dmp
memory/1716-19-0x0000000000400000-0x00000000004B7000-memory.dmp
memory/1716-12-0x0000000000400000-0x00000000004B7000-memory.dmp
memory/1716-13-0x0000000000400000-0x00000000004B7000-memory.dmp
memory/1716-14-0x0000000000400000-0x00000000004B7000-memory.dmp
memory/1716-15-0x0000000000400000-0x00000000004B7000-memory.dmp
memory/1716-16-0x0000000000400000-0x00000000004B7000-memory.dmp
memory/1716-17-0x0000000000400000-0x00000000004B7000-memory.dmp
memory/1716-18-0x0000000000400000-0x00000000004B7000-memory.dmp
memory/2584-3-0x0000000000910000-0x0000000000911000-memory.dmp