Overview

overview

10

Static

static

10

XMR.exe

windows10-ltsc_2021-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    XMR.exe
  • Size 1.4MB
  • Sample261018-w76weattft
  • SHA256 21b6c73f9089efd956dcc9a668e07f4c4168c2a3e907a292c3762362ba947ef4
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
darkcometnanocoreproratguest16aspackv2defense_evasiondiscoveryexecutionkeyloggerpersistenceratspywarestealertrojanupx

Malware Config

Extracted

Family

  • darkcomet

Attributes
  • gencode

  • install

    false

  • offline_keylogger

    false

  • persistence

    false

rc4.plain

Extracted

Family

  • darkcomet

Botnet

  • Guest16

C2

  • 127.0.0.1:10000

Mutex

  • DC_MUTEX-GXU2NLA

Attributes
  • gencode

    j3b9eu7o0vos

  • install

    false

  • offline_keylogger

    true

  • password

    43244324234324/3*432/432*/4***

  • persistence

    false

rc4.plain

Extracted

Family

  • nanocore

Version

  • 1.2.2.0

C2

  • 127.0.0.1:54984

Mutex

  • 864f750e-388b-40af-a681-5ec6dc9e34bf

Attributes
  • activate_away_mode

    true

  • backup_connection_host

    127.0.0.1

  • backup_dns_server

  • buffer_size

    65535

  • build_time

    2026-07-30T20:08:47.832895136Z

  • bypass_user_account_control

    true

  • bypass_user_account_control_data

  • clear_access_control

    true

  • clear_zone_identifier

    false

  • connect_delay

    4000

  • connection_port

    54984

  • default_group

    Default

  • enable_debug_mode

    true

  • gc_threshold

    1.048576e+07

  • keep_alive_timeout

    30000

  • keyboard_logging

    false

  • lan_timeout

    2500

  • max_packet_size

    1.048576e+07

  • mutex

    864f750e-388b-40af-a681-5ec6dc9e34bf

  • mutex_timeout

    5000

  • prevent_system_sleep

    false

  • primary_connection_host

  • primary_dns_server

  • request_elevation

    true

  • restart_delay

    5000

  • run_delay

    0

  • run_on_startup

    true

  • set_critical_process

    true

  • timeout_interval

    5000

  • use_custom_dns_server

    false

  • version

    1.2.2.0

  • wan_timeout

    8000

Targets

    • Target
      XMR.exe
    • Size 1.4MB
    • SHA256 21b6c73f9089efd956dcc9a668e07f4c4168c2a3e907a292c3762362ba947ef4
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    10/10
    aspackv2guest16defense_evasiondiscoveryexecutiondarkcometnanocoreproratkeyloggerpersistenceratspywarestealertrojanupx

    • Detects ProRat payload

    • Family: Darkcomet

      DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

      trojanratdarkcomet

    • Family: NanoCore

      NanoCore is a remote access tool (RAT) with a variety of capabilities.

      keyloggertrojanstealerspywarenanocore

    • Family: ProRat

      ProRat is a Windows RAT written in C++.

      ratprorat

    • Modifies WinLogon for persistence

      persistence

    • Modifies firewall policy service

      defense_evasion

    • Modifies security service

      defense_evasion

    • Windows security bypass

      defense_evasiontrojan

    • Adds policy Run key to start application

      persistence

    • Boot or Logon Autostart Execution: Active Setup

      Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

      persistence

    • Disables RegEdit via registry modification

      defense_evasion

    • Disables Task Manager via registry modification

      defense_evasion

    • Sets file to hidden

      Modifies file attributes to stop it showing in Explorer etc.

      defense_evasion

    • ASPack v2.12-2.42

      Detects executables packed with ASPack v2.12-2.42

      aspackv2

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Windows security modification

      defense_evasiontrojan

    • Checks whether UAC is enabled

      defense_evasiontrojan

    • Modifies WinLogon

      persistence

    • Drops file in System32 directory

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral1

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1
T1059

Windows Command Shell

1
T1059.003

Persistence

Boot or Logon Autostart Execution

4
T1547

Active Setup

1
T1547.014

Registry Run Keys / Startup Folder

1
T1547.001

Winlogon Helper DLL

2
T1547.004

Create or Modify System Process

2
T1543

Windows Service

2
T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

4
T1547

Active Setup

1
T1547.014

Registry Run Keys / Startup Folder

1
T1547.001

Winlogon Helper DLL

2
T1547.004

Create or Modify System Process

2
T1543

Windows Service

2
T1543.003

Defense Evasion

Hide Artifacts

2
T1564

Hidden Files and Directories

2
T1564.001

Impair Defenses

3
T1562

Disable or Modify System Firewall

1
T1562.004

Disable or Modify Tools

2
T1562.001

Modify Registry

9
T1112

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

3
T1082

System Location Discovery

1
T1614

System Language Discovery

1
T1614.001

System Network Configuration Discovery

1
T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks