darkcomet | 23f173c2ea208d35ebc04be8cebb189348a85228806c367756e72064899f25c0

Analysis

max time kernel
149s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
30-06-2024 23:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

23f173c2ea208d35ebc04be8cebb189348a85228806c367756e72064899f25c0_NeikiAnalytics.exe
Size

3.9MB
MD5

783e407833fe0ad2c162e7b0235d9220
SHA1

f020644b862cc00c259341d4d5021d5689bd3994
SHA256

23f173c2ea208d35ebc04be8cebb189348a85228806c367756e72064899f25c0
SHA512

2762f16d80e4b8413b654f89dec715f3d561a021b9d879f5828e1794e87e4c622cdd389227f6dcc6b99326a2d78d75fae49df95e8667cd6f2031c47feb35c13a
SSDEEP

98304:alX3KMj7yBNUVPhd5G0Z5DxdM3hZpmBAlB6D4tyX6kuT4IkQApCgvms0Cv05J5CR:alX3KMj7yBNUVPhd5G0Z5DxdM3hZpmBR

Score

10^/10

darkcomet persistence rat trojan upx

Malware Config

Signatures

Darkcomet
DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
trojan rat darkcomet
Checks BIOS information in registry 2 TTPs 1 IoCs
BIOS information is often read in order to detect sandboxing environments.

Query Registry
T1012

System Information Discovery
T1082

Processes:

Soundcrd.exe

description ioc process

Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate Soundcrd.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate	Soundcrd.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

23f173c2ea208d35ebc04be8cebb189348a85228806c367756e72064899f25c0_NeikiAnalytics.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation	23f173c2ea208d35ebc04be8cebb189348a85228806c367756e72064899f25c0_NeikiAnalytics.exe

Executes dropped EXE 3 IoCs

Processes:

Soundcrd.exeSoundcrd.exeSoundcrd.exe

pid process

5096 Soundcrd.exe
224 Soundcrd.exe
1852 Soundcrd.exe

pid	process
5096	Soundcrd.exe
224	Soundcrd.exe
1852	Soundcrd.exe

UPX packed file 31 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral2/memory/2488-1-0x0000000000400000-0x00000000007EC000-memory.dmp	upx
C:\Users\Admin\AppData\Roaming\Soundcrd.txt	upx
behavioral2/memory/5096-28-0x0000000000400000-0x00000000007EC000-memory.dmp	upx
behavioral2/memory/2488-31-0x0000000000400000-0x00000000007EC000-memory.dmp	upx
behavioral2/memory/224-34-0x0000000000400000-0x00000000004B5000-memory.dmp	upx
behavioral2/memory/224-35-0x0000000000400000-0x00000000004B5000-memory.dmp	upx
behavioral2/memory/224-37-0x0000000000400000-0x00000000004B5000-memory.dmp	upx
behavioral2/memory/224-39-0x0000000000400000-0x00000000004B5000-memory.dmp	upx
behavioral2/memory/224-38-0x0000000000400000-0x00000000004B5000-memory.dmp	upx
behavioral2/memory/224-36-0x0000000000400000-0x00000000004B5000-memory.dmp	upx
behavioral2/memory/224-32-0x0000000000400000-0x00000000004B5000-memory.dmp	upx
behavioral2/memory/1852-46-0x0000000000400000-0x0000000000409000-memory.dmp	upx
behavioral2/memory/5096-49-0x0000000000400000-0x00000000007EC000-memory.dmp	upx
behavioral2/memory/1852-44-0x0000000000400000-0x0000000000409000-memory.dmp	upx
behavioral2/memory/1852-41-0x0000000000400000-0x0000000000409000-memory.dmp	upx
behavioral2/memory/224-40-0x0000000000400000-0x00000000004B5000-memory.dmp	upx
behavioral2/memory/1852-51-0x0000000000400000-0x0000000000409000-memory.dmp	upx
behavioral2/memory/224-50-0x0000000000400000-0x00000000004B5000-memory.dmp	upx
behavioral2/memory/224-52-0x0000000000400000-0x00000000004B5000-memory.dmp	upx
behavioral2/memory/224-55-0x0000000000400000-0x00000000004B5000-memory.dmp	upx
behavioral2/memory/224-57-0x0000000000400000-0x00000000004B5000-memory.dmp	upx
behavioral2/memory/224-59-0x0000000000400000-0x00000000004B5000-memory.dmp	upx
behavioral2/memory/224-61-0x0000000000400000-0x00000000004B5000-memory.dmp	upx
behavioral2/memory/224-63-0x0000000000400000-0x00000000004B5000-memory.dmp	upx
behavioral2/memory/224-65-0x0000000000400000-0x00000000004B5000-memory.dmp	upx
behavioral2/memory/224-67-0x0000000000400000-0x00000000004B5000-memory.dmp	upx
behavioral2/memory/224-69-0x0000000000400000-0x00000000004B5000-memory.dmp	upx
behavioral2/memory/224-71-0x0000000000400000-0x00000000004B5000-memory.dmp	upx
behavioral2/memory/224-73-0x0000000000400000-0x00000000004B5000-memory.dmp	upx
behavioral2/memory/224-75-0x0000000000400000-0x00000000004B5000-memory.dmp	upx
behavioral2/memory/224-77-0x0000000000400000-0x00000000004B5000-memory.dmp	upx

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

reg.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Mcrosoftt = "C:\\Users\\Admin\\AppData\\Roaming\\Soundcrd.exe"	reg.exe

Suspicious use of SetThreadContext 2 IoCs

Processes:

Soundcrd.exe

description pid process target process

PID 5096 set thread context of 224 5096 Soundcrd.exe Soundcrd.exe
PID 5096 set thread context of 1852 5096 Soundcrd.exe Soundcrd.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

description	pid	process	target process
PID 5096 set thread context of 224	5096	Soundcrd.exe	Soundcrd.exe
PID 5096 set thread context of 1852	5096	Soundcrd.exe	Soundcrd.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

Soundcrd.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Soundcrd.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	Soundcrd.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	Soundcrd.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	Soundcrd.exe

Enumerates system info in registry 2 TTPs 1 IoCs

Query Registry
T1012

System Information Discovery
T1082

Processes:

Soundcrd.exe

description ioc process

Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier Soundcrd.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	Soundcrd.exe

Suspicious use of AdjustPrivilegeToken 25 IoCs

Processes:

Soundcrd.exeSoundcrd.exe

description	pid	process
Token: SeIncreaseQuotaPrivilege	224	Soundcrd.exe
Token: SeSecurityPrivilege	224	Soundcrd.exe
Token: SeTakeOwnershipPrivilege	224	Soundcrd.exe
Token: SeLoadDriverPrivilege	224	Soundcrd.exe
Token: SeSystemProfilePrivilege	224	Soundcrd.exe
Token: SeSystemtimePrivilege	224	Soundcrd.exe
Token: SeProfSingleProcessPrivilege	224	Soundcrd.exe
Token: SeIncBasePriorityPrivilege	224	Soundcrd.exe
Token: SeCreatePagefilePrivilege	224	Soundcrd.exe
Token: SeBackupPrivilege	224	Soundcrd.exe
Token: SeRestorePrivilege	224	Soundcrd.exe
Token: SeShutdownPrivilege	224	Soundcrd.exe
Token: SeDebugPrivilege	224	Soundcrd.exe
Token: SeSystemEnvironmentPrivilege	224	Soundcrd.exe
Token: SeChangeNotifyPrivilege	224	Soundcrd.exe
Token: SeRemoteShutdownPrivilege	224	Soundcrd.exe
Token: SeUndockPrivilege	224	Soundcrd.exe
Token: SeManageVolumePrivilege	224	Soundcrd.exe
Token: SeImpersonatePrivilege	224	Soundcrd.exe
Token: SeCreateGlobalPrivilege	224	Soundcrd.exe
Token: 33	224	Soundcrd.exe
Token: 34	224	Soundcrd.exe
Token: 35	224	Soundcrd.exe
Token: 36	224	Soundcrd.exe
Token: SeDebugPrivilege	1852	Soundcrd.exe

Suspicious use of SetWindowsHookEx 3 IoCs

Processes:

23f173c2ea208d35ebc04be8cebb189348a85228806c367756e72064899f25c0_NeikiAnalytics.exeSoundcrd.exeSoundcrd.exe

pid process

2488 23f173c2ea208d35ebc04be8cebb189348a85228806c367756e72064899f25c0_NeikiAnalytics.exe
5096 Soundcrd.exe
1852 Soundcrd.exe

pid	process
2488	23f173c2ea208d35ebc04be8cebb189348a85228806c367756e72064899f25c0_NeikiAnalytics.exe
5096	Soundcrd.exe
1852	Soundcrd.exe

Suspicious use of WriteProcessMemory 25 IoCs

Processes:

23f173c2ea208d35ebc04be8cebb189348a85228806c367756e72064899f25c0_NeikiAnalytics.execmd.exeSoundcrd.exe

description	pid	process	target process
PID 2488 wrote to memory of 4044	2488	23f173c2ea208d35ebc04be8cebb189348a85228806c367756e72064899f25c0_NeikiAnalytics.exe	cmd.exe
PID 2488 wrote to memory of 4044	2488	23f173c2ea208d35ebc04be8cebb189348a85228806c367756e72064899f25c0_NeikiAnalytics.exe	cmd.exe
PID 2488 wrote to memory of 4044	2488	23f173c2ea208d35ebc04be8cebb189348a85228806c367756e72064899f25c0_NeikiAnalytics.exe	cmd.exe
PID 4044 wrote to memory of 1396	4044	cmd.exe	reg.exe
PID 4044 wrote to memory of 1396	4044	cmd.exe	reg.exe
PID 4044 wrote to memory of 1396	4044	cmd.exe	reg.exe
PID 2488 wrote to memory of 5096	2488	23f173c2ea208d35ebc04be8cebb189348a85228806c367756e72064899f25c0_NeikiAnalytics.exe	Soundcrd.exe
PID 2488 wrote to memory of 5096	2488	23f173c2ea208d35ebc04be8cebb189348a85228806c367756e72064899f25c0_NeikiAnalytics.exe	Soundcrd.exe
PID 2488 wrote to memory of 5096	2488	23f173c2ea208d35ebc04be8cebb189348a85228806c367756e72064899f25c0_NeikiAnalytics.exe	Soundcrd.exe
PID 5096 wrote to memory of 224	5096	Soundcrd.exe	Soundcrd.exe
PID 5096 wrote to memory of 224	5096	Soundcrd.exe	Soundcrd.exe
PID 5096 wrote to memory of 224	5096	Soundcrd.exe	Soundcrd.exe
PID 5096 wrote to memory of 224	5096	Soundcrd.exe	Soundcrd.exe
PID 5096 wrote to memory of 224	5096	Soundcrd.exe	Soundcrd.exe
PID 5096 wrote to memory of 224	5096	Soundcrd.exe	Soundcrd.exe
PID 5096 wrote to memory of 224	5096	Soundcrd.exe	Soundcrd.exe
PID 5096 wrote to memory of 224	5096	Soundcrd.exe	Soundcrd.exe
PID 5096 wrote to memory of 1852	5096	Soundcrd.exe	Soundcrd.exe
PID 5096 wrote to memory of 1852	5096	Soundcrd.exe	Soundcrd.exe
PID 5096 wrote to memory of 1852	5096	Soundcrd.exe	Soundcrd.exe
PID 5096 wrote to memory of 1852	5096	Soundcrd.exe	Soundcrd.exe
PID 5096 wrote to memory of 1852	5096	Soundcrd.exe	Soundcrd.exe
PID 5096 wrote to memory of 1852	5096	Soundcrd.exe	Soundcrd.exe
PID 5096 wrote to memory of 1852	5096	Soundcrd.exe	Soundcrd.exe
PID 5096 wrote to memory of 1852	5096	Soundcrd.exe	Soundcrd.exe

C:\Users\Admin\AppData\Local\Temp\23f173c2ea208d35ebc04be8cebb189348a85228806c367756e72064899f25c0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\23f173c2ea208d35ebc04be8cebb189348a85228806c367756e72064899f25c0_NeikiAnalytics.exe"
1⤵
- Checks computer location settings
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2488

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\KJgTD.bat" "
2⤵
- Suspicious use of WriteProcessMemory
PID:4044

C:\Windows\SysWOW64\reg.exe
REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "Mcrosoftt" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Soundcrd.exe" /f
3⤵
- Adds Run key to start application
PID:1396

C:\Users\Admin\AppData\Roaming\Soundcrd.exe
"C:\Users\Admin\AppData\Roaming\Soundcrd.exe"
2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5096

C:\Users\Admin\AppData\Roaming\Soundcrd.exe
C:\Users\Admin\AppData\Roaming\Soundcrd.exe
3⤵
- Checks BIOS information in registry
- Executes dropped EXE
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious use of AdjustPrivilegeToken
PID:224

C:\Users\Admin\AppData\Roaming\Soundcrd.exe
C:\Users\Admin\AppData\Roaming\Soundcrd.exe
3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1852

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\KJgTD.txt
Filesize
139B

MD5
173bcce4810d4901872d0ef4f0bfea4e

SHA1
561b03fdfe68b6419fddf57f32e1aab9a6126a2f

SHA256
10ea37eceabbe80fe9814280b66b957636951dbeeed18a9b4d50a1d24a6f1d1d

SHA512
2401e0a5e3f7bf590a0767449da2249d09717e8c1cb71a7475e81d9615580001cfc38705cd1a5b4edc33f7df043bf195e28e4a5442a32bc879dffc6473bd545e

Download Submit
C:\Users\Admin\AppData\Roaming\Soundcrd.txt
Filesize
3.9MB

MD5
d8f28870f49807652f692aa5c8f50041

SHA1
6d4f7e124b56fca0b9b0ef99018e0229363d0a0e

SHA256
6536912699464f30d07570015aaba995791b4d48c3c569dc17729f029b29a6a9

SHA512
1df53282592f934628cac3fd29674e9d954f76812ece9f1d13872ab57e180bb0a4fbcba2896e0adfddba9a742f6c9eca72b20ce03cd085487168c36a1c975a52

Download Submit
memory/224-40-0x0000000000400000-0x00000000004B5000-memory.dmp

Filesize
724KB

Download
memory/224-63-0x0000000000400000-0x00000000004B5000-memory.dmp

Filesize
724KB

Download
memory/224-75-0x0000000000400000-0x00000000004B5000-memory.dmp

Filesize
724KB

Download
memory/224-34-0x0000000000400000-0x00000000004B5000-memory.dmp

Filesize
724KB

Download
memory/224-35-0x0000000000400000-0x00000000004B5000-memory.dmp

Filesize
724KB

Download
memory/224-37-0x0000000000400000-0x00000000004B5000-memory.dmp

Filesize
724KB

Download
memory/224-39-0x0000000000400000-0x00000000004B5000-memory.dmp

Filesize
724KB

Download
memory/224-38-0x0000000000400000-0x00000000004B5000-memory.dmp

Filesize
724KB

Download
memory/224-36-0x0000000000400000-0x00000000004B5000-memory.dmp

Filesize
724KB

Download
memory/224-32-0x0000000000400000-0x00000000004B5000-memory.dmp

Filesize
724KB

Download
memory/224-73-0x0000000000400000-0x00000000004B5000-memory.dmp

Filesize
724KB

Download
memory/224-71-0x0000000000400000-0x00000000004B5000-memory.dmp

Filesize
724KB

Download
memory/224-69-0x0000000000400000-0x00000000004B5000-memory.dmp

Filesize
724KB

Download
memory/224-67-0x0000000000400000-0x00000000004B5000-memory.dmp

Filesize
724KB

Download
memory/224-77-0x0000000000400000-0x00000000004B5000-memory.dmp

Filesize
724KB

Download
memory/224-65-0x0000000000400000-0x00000000004B5000-memory.dmp

Filesize
724KB

Download
memory/224-50-0x0000000000400000-0x00000000004B5000-memory.dmp

Filesize
724KB

Download
memory/224-52-0x0000000000400000-0x00000000004B5000-memory.dmp

Filesize
724KB

Download
memory/224-55-0x0000000000400000-0x00000000004B5000-memory.dmp

Filesize
724KB

Download
memory/224-57-0x0000000000400000-0x00000000004B5000-memory.dmp

Filesize
724KB

Download
memory/224-59-0x0000000000400000-0x00000000004B5000-memory.dmp

Filesize
724KB

Download
memory/224-61-0x0000000000400000-0x00000000004B5000-memory.dmp

Filesize
724KB

Download
memory/1852-41-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/1852-44-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/1852-46-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/1852-51-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2488-31-0x0000000000400000-0x00000000007EC000-memory.dmp

Filesize
3.9MB

Download
memory/2488-1-0x0000000000400000-0x00000000007EC000-memory.dmp

Filesize
3.9MB

Download
memory/5096-28-0x0000000000400000-0x00000000007EC000-memory.dmp

Filesize
3.9MB

Download
memory/5096-49-0x0000000000400000-0x00000000007EC000-memory.dmp

Filesize
3.9MB

Download