darkcomet | 86ab6a7f9d86cb1bb3ad5b55d788e785092177db39206f73bb23f6251d3c4baf

General

Target

86ab6a7f9d86cb1bb3ad5b55d788e785092177db39206f73bb23f6251d3c4baf.exe
Size

2.0MB
MD5

27bfb34bccb3534fb28907887ce2d416
SHA1

735ff286a15378f58adc88eb874602ce40fa9876
SHA256

86ab6a7f9d86cb1bb3ad5b55d788e785092177db39206f73bb23f6251d3c4baf
SHA512

c94302184c872e9d31196020e70ce2234196f94e5c0f8cff035babd40f40a1db05e08bca4efeb7080be8b3985eb8606a3cab82a1e701b73b8a6c685cd1acb3b1

Score

10^/10

darkcomet gudy evasion rat trojan upx

Malware Config

Extracted

Family

darkcomet

Botnet

GuDy

C2

sysprocess.ddns.net:1605

mila031.ddns.net:1604

Mutex

DC_MUTEX-9JVEVBK

Attributes

InstallPath
chkdsk32.exe
gencode
QAMy2R5hRowG
install
true
offline_keylogger
true
persistence
true
reg_key
SecurityEssentials

Signatures

Darkcomet
DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
trojan rat darkcomet
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs
evasion

Query Registry
T1012

Virtualization/Sandbox Evasion
T1497

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral2/memory/2796-68-0x0000000000400000-0x000000000041E000-memory.dmp	upx

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

86ab6a7f9d86cb1bb3ad5b55d788e785092177db39206f73bb23f6251d3c4baf.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	86ab6a7f9d86cb1bb3ad5b55d788e785092177db39206f73bb23f6251d3c4baf.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	86ab6a7f9d86cb1bb3ad5b55d788e785092177db39206f73bb23f6251d3c4baf.exe

Identifies Wine through registry keys 2 TTPs 1 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

Processes:

86ab6a7f9d86cb1bb3ad5b55d788e785092177db39206f73bb23f6251d3c4baf.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-1231583446-2617009595-2137880041-1000\Software\Wine	86ab6a7f9d86cb1bb3ad5b55d788e785092177db39206f73bb23f6251d3c4baf.exe

Program crash 2 IoCs

Processes:

WerFault.exeWerFault.exe

pid	pid_target	process	target process
3912	2796	WerFault.exe	iexplore.exe
3568	3688	WerFault.exe	86ab6a7f9d86cb1bb3ad5b55d788e785092177db39206f73bb23f6251d3c4baf.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

Processes:

86ab6a7f9d86cb1bb3ad5b55d788e785092177db39206f73bb23f6251d3c4baf.exe

pid process

428 86ab6a7f9d86cb1bb3ad5b55d788e785092177db39206f73bb23f6251d3c4baf.exe

Suspicious use of SetThreadContext 2 IoCs

Processes:

86ab6a7f9d86cb1bb3ad5b55d788e785092177db39206f73bb23f6251d3c4baf.exe

description	pid	process	target process
PID 428 set thread context of 2796	428	86ab6a7f9d86cb1bb3ad5b55d788e785092177db39206f73bb23f6251d3c4baf.exe	iexplore.exe
PID 428 set thread context of 3688	428	86ab6a7f9d86cb1bb3ad5b55d788e785092177db39206f73bb23f6251d3c4baf.exe	86ab6a7f9d86cb1bb3ad5b55d788e785092177db39206f73bb23f6251d3c4baf.exe

Suspicious behavior: EnumeratesProcesses 17 IoCs

Processes:

86ab6a7f9d86cb1bb3ad5b55d788e785092177db39206f73bb23f6251d3c4baf.exeWerFault.exe

pid	process
428	86ab6a7f9d86cb1bb3ad5b55d788e785092177db39206f73bb23f6251d3c4baf.exe
428	86ab6a7f9d86cb1bb3ad5b55d788e785092177db39206f73bb23f6251d3c4baf.exe
428	86ab6a7f9d86cb1bb3ad5b55d788e785092177db39206f73bb23f6251d3c4baf.exe
428	86ab6a7f9d86cb1bb3ad5b55d788e785092177db39206f73bb23f6251d3c4baf.exe
3568	WerFault.exe
3568	WerFault.exe
3568	WerFault.exe
3568	WerFault.exe
3568	WerFault.exe
3568	WerFault.exe
3568	WerFault.exe
3568	WerFault.exe
3568	WerFault.exe
3568	WerFault.exe
3568	WerFault.exe
3568	WerFault.exe
3568	WerFault.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

WerFault.exe

description pid process

Token: SeRestorePrivilege 3568 WerFault.exe
Token: SeBackupPrivilege 3568 WerFault.exe
Token: SeDebugPrivilege 3568 WerFault.exe

description	pid	process
Token: SeRestorePrivilege	3568	WerFault.exe
Token: SeBackupPrivilege	3568	WerFault.exe
Token: SeDebugPrivilege	3568	WerFault.exe

Suspicious use of WriteProcessMemory 44 IoCs

Processes:

86ab6a7f9d86cb1bb3ad5b55d788e785092177db39206f73bb23f6251d3c4baf.exe

C:\Users\Admin\AppData\Local\Temp\86ab6a7f9d86cb1bb3ad5b55d788e785092177db39206f73bb23f6251d3c4baf.exe
"C:\Users\Admin\AppData\Local\Temp\86ab6a7f9d86cb1bb3ad5b55d788e785092177db39206f73bb23f6251d3c4baf.exe"
1⤵
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:428

C:\Program Files (x86)\Internet Explorer\iexplore.exe
"C:\Program Files (x86)\Internet Explorer\iexplore.exe"
2⤵
PID:2680

C:\Program Files (x86)\Internet Explorer\iexplore.exe
"C:\Program Files (x86)\Internet Explorer\iexplore.exe"
2⤵
PID:2796

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2796 -s 48
3⤵
- Program crash
PID:3912

C:\Users\Admin\AppData\Local\Temp\86ab6a7f9d86cb1bb3ad5b55d788e785092177db39206f73bb23f6251d3c4baf.exe
C:\Users\Admin\AppData\Local\Temp\86ab6a7f9d86cb1bb3ad5b55d788e785092177db39206f73bb23f6251d3c4baf.exe
2⤵
PID:3444

C:\Users\Admin\AppData\Local\Temp\86ab6a7f9d86cb1bb3ad5b55d788e785092177db39206f73bb23f6251d3c4baf.exe
C:\Users\Admin\AppData\Local\Temp\86ab6a7f9d86cb1bb3ad5b55d788e785092177db39206f73bb23f6251d3c4baf.exe
2⤵
PID:3688

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3688 -s 592
3⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3568

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

2

T1497

Credential Access

Discovery

Query Registry

3

T1012

Virtualization/Sandbox Evasion

2

T1497

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/428-1-0x0000000005A60000-0x0000000005A61000-memory.dmp

Filesize
4KB

Download
memory/428-0-0x0000000005260000-0x0000000005261000-memory.dmp

Filesize
4KB

Download
memory/2796-68-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/2796-69-0x000000000040D810-mapping.dmp

Download
memory/3568-73-0x0000000004570000-0x0000000004571000-memory.dmp

Filesize
4KB

Download
memory/3568-81-0x0000000004AB0000-0x0000000004AB1000-memory.dmp

Filesize
4KB

Download
memory/3568-74-0x0000000004570000-0x0000000004571000-memory.dmp

Filesize
4KB

Download
memory/3688-77-0x000000000048F888-mapping.dmp

Download
memory/3688-71-0x000000000048F888-mapping.dmp

Download
memory/3688-78-0x000000000048F888-mapping.dmp

Download
memory/3688-79-0x000000000048F888-mapping.dmp

Download
memory/3688-80-0x000000000048F888-mapping.dmp

Download
memory/3688-70-0x0000000000400000-0x0000000000564000-memory.dmp

Filesize
1.4MB

Download
memory/3912-72-0x0000000004810000-0x0000000004811000-memory.dmp

Filesize
4KB

Download

description	pid	process	target process
PID 428 wrote to memory of 2680	428	86ab6a7f9d86cb1bb3ad5b55d788e785092177db39206f73bb23f6251d3c4baf.exe	iexplore.exe
PID 428 wrote to memory of 2680	428	86ab6a7f9d86cb1bb3ad5b55d788e785092177db39206f73bb23f6251d3c4baf.exe	iexplore.exe
PID 428 wrote to memory of 2680	428	86ab6a7f9d86cb1bb3ad5b55d788e785092177db39206f73bb23f6251d3c4baf.exe	iexplore.exe
PID 428 wrote to memory of 2796	428	86ab6a7f9d86cb1bb3ad5b55d788e785092177db39206f73bb23f6251d3c4baf.exe	iexplore.exe
PID 428 wrote to memory of 2796	428	86ab6a7f9d86cb1bb3ad5b55d788e785092177db39206f73bb23f6251d3c4baf.exe	iexplore.exe
PID 428 wrote to memory of 2796	428	86ab6a7f9d86cb1bb3ad5b55d788e785092177db39206f73bb23f6251d3c4baf.exe	iexplore.exe
PID 428 wrote to memory of 2796	428	86ab6a7f9d86cb1bb3ad5b55d788e785092177db39206f73bb23f6251d3c4baf.exe	iexplore.exe
PID 428 wrote to memory of 2796	428	86ab6a7f9d86cb1bb3ad5b55d788e785092177db39206f73bb23f6251d3c4baf.exe	iexplore.exe
PID 428 wrote to memory of 2796	428	86ab6a7f9d86cb1bb3ad5b55d788e785092177db39206f73bb23f6251d3c4baf.exe	iexplore.exe
PID 428 wrote to memory of 2796	428	86ab6a7f9d86cb1bb3ad5b55d788e785092177db39206f73bb23f6251d3c4baf.exe	iexplore.exe
PID 428 wrote to memory of 2796	428	86ab6a7f9d86cb1bb3ad5b55d788e785092177db39206f73bb23f6251d3c4baf.exe	iexplore.exe
PID 428 wrote to memory of 2796	428	86ab6a7f9d86cb1bb3ad5b55d788e785092177db39206f73bb23f6251d3c4baf.exe	iexplore.exe
PID 428 wrote to memory of 2796	428	86ab6a7f9d86cb1bb3ad5b55d788e785092177db39206f73bb23f6251d3c4baf.exe	iexplore.exe
PID 428 wrote to memory of 2796	428	86ab6a7f9d86cb1bb3ad5b55d788e785092177db39206f73bb23f6251d3c4baf.exe	iexplore.exe
PID 428 wrote to memory of 2796	428	86ab6a7f9d86cb1bb3ad5b55d788e785092177db39206f73bb23f6251d3c4baf.exe	iexplore.exe
PID 428 wrote to memory of 2796	428	86ab6a7f9d86cb1bb3ad5b55d788e785092177db39206f73bb23f6251d3c4baf.exe	iexplore.exe
PID 428 wrote to memory of 3444	428	86ab6a7f9d86cb1bb3ad5b55d788e785092177db39206f73bb23f6251d3c4baf.exe	86ab6a7f9d86cb1bb3ad5b55d788e785092177db39206f73bb23f6251d3c4baf.exe
PID 428 wrote to memory of 3444	428	86ab6a7f9d86cb1bb3ad5b55d788e785092177db39206f73bb23f6251d3c4baf.exe	86ab6a7f9d86cb1bb3ad5b55d788e785092177db39206f73bb23f6251d3c4baf.exe
PID 428 wrote to memory of 3444	428	86ab6a7f9d86cb1bb3ad5b55d788e785092177db39206f73bb23f6251d3c4baf.exe	86ab6a7f9d86cb1bb3ad5b55d788e785092177db39206f73bb23f6251d3c4baf.exe
PID 428 wrote to memory of 3688	428	86ab6a7f9d86cb1bb3ad5b55d788e785092177db39206f73bb23f6251d3c4baf.exe	86ab6a7f9d86cb1bb3ad5b55d788e785092177db39206f73bb23f6251d3c4baf.exe
PID 428 wrote to memory of 3688	428	86ab6a7f9d86cb1bb3ad5b55d788e785092177db39206f73bb23f6251d3c4baf.exe	86ab6a7f9d86cb1bb3ad5b55d788e785092177db39206f73bb23f6251d3c4baf.exe
PID 428 wrote to memory of 3688	428	86ab6a7f9d86cb1bb3ad5b55d788e785092177db39206f73bb23f6251d3c4baf.exe	86ab6a7f9d86cb1bb3ad5b55d788e785092177db39206f73bb23f6251d3c4baf.exe
PID 428 wrote to memory of 3688	428	86ab6a7f9d86cb1bb3ad5b55d788e785092177db39206f73bb23f6251d3c4baf.exe	86ab6a7f9d86cb1bb3ad5b55d788e785092177db39206f73bb23f6251d3c4baf.exe
PID 428 wrote to memory of 3688	428	86ab6a7f9d86cb1bb3ad5b55d788e785092177db39206f73bb23f6251d3c4baf.exe	86ab6a7f9d86cb1bb3ad5b55d788e785092177db39206f73bb23f6251d3c4baf.exe
PID 428 wrote to memory of 3688	428	86ab6a7f9d86cb1bb3ad5b55d788e785092177db39206f73bb23f6251d3c4baf.exe	86ab6a7f9d86cb1bb3ad5b55d788e785092177db39206f73bb23f6251d3c4baf.exe
PID 428 wrote to memory of 3688	428	86ab6a7f9d86cb1bb3ad5b55d788e785092177db39206f73bb23f6251d3c4baf.exe	86ab6a7f9d86cb1bb3ad5b55d788e785092177db39206f73bb23f6251d3c4baf.exe
PID 428 wrote to memory of 3688	428	86ab6a7f9d86cb1bb3ad5b55d788e785092177db39206f73bb23f6251d3c4baf.exe	86ab6a7f9d86cb1bb3ad5b55d788e785092177db39206f73bb23f6251d3c4baf.exe
PID 428 wrote to memory of 3688	428	86ab6a7f9d86cb1bb3ad5b55d788e785092177db39206f73bb23f6251d3c4baf.exe	86ab6a7f9d86cb1bb3ad5b55d788e785092177db39206f73bb23f6251d3c4baf.exe
PID 428 wrote to memory of 3688	428	86ab6a7f9d86cb1bb3ad5b55d788e785092177db39206f73bb23f6251d3c4baf.exe	86ab6a7f9d86cb1bb3ad5b55d788e785092177db39206f73bb23f6251d3c4baf.exe
PID 428 wrote to memory of 3688	428	86ab6a7f9d86cb1bb3ad5b55d788e785092177db39206f73bb23f6251d3c4baf.exe	86ab6a7f9d86cb1bb3ad5b55d788e785092177db39206f73bb23f6251d3c4baf.exe
PID 428 wrote to memory of 3688	428	86ab6a7f9d86cb1bb3ad5b55d788e785092177db39206f73bb23f6251d3c4baf.exe	86ab6a7f9d86cb1bb3ad5b55d788e785092177db39206f73bb23f6251d3c4baf.exe
PID 428 wrote to memory of 3688	428	86ab6a7f9d86cb1bb3ad5b55d788e785092177db39206f73bb23f6251d3c4baf.exe	86ab6a7f9d86cb1bb3ad5b55d788e785092177db39206f73bb23f6251d3c4baf.exe
PID 428 wrote to memory of 3688	428	86ab6a7f9d86cb1bb3ad5b55d788e785092177db39206f73bb23f6251d3c4baf.exe	86ab6a7f9d86cb1bb3ad5b55d788e785092177db39206f73bb23f6251d3c4baf.exe
PID 428 wrote to memory of 3688	428	86ab6a7f9d86cb1bb3ad5b55d788e785092177db39206f73bb23f6251d3c4baf.exe	86ab6a7f9d86cb1bb3ad5b55d788e785092177db39206f73bb23f6251d3c4baf.exe
PID 428 wrote to memory of 3688	428	86ab6a7f9d86cb1bb3ad5b55d788e785092177db39206f73bb23f6251d3c4baf.exe	86ab6a7f9d86cb1bb3ad5b55d788e785092177db39206f73bb23f6251d3c4baf.exe
PID 428 wrote to memory of 3688	428	86ab6a7f9d86cb1bb3ad5b55d788e785092177db39206f73bb23f6251d3c4baf.exe	86ab6a7f9d86cb1bb3ad5b55d788e785092177db39206f73bb23f6251d3c4baf.exe
PID 428 wrote to memory of 3688	428	86ab6a7f9d86cb1bb3ad5b55d788e785092177db39206f73bb23f6251d3c4baf.exe	86ab6a7f9d86cb1bb3ad5b55d788e785092177db39206f73bb23f6251d3c4baf.exe
PID 428 wrote to memory of 3688	428	86ab6a7f9d86cb1bb3ad5b55d788e785092177db39206f73bb23f6251d3c4baf.exe	86ab6a7f9d86cb1bb3ad5b55d788e785092177db39206f73bb23f6251d3c4baf.exe
PID 428 wrote to memory of 3688	428	86ab6a7f9d86cb1bb3ad5b55d788e785092177db39206f73bb23f6251d3c4baf.exe	86ab6a7f9d86cb1bb3ad5b55d788e785092177db39206f73bb23f6251d3c4baf.exe
PID 428 wrote to memory of 3688	428	86ab6a7f9d86cb1bb3ad5b55d788e785092177db39206f73bb23f6251d3c4baf.exe	86ab6a7f9d86cb1bb3ad5b55d788e785092177db39206f73bb23f6251d3c4baf.exe
PID 428 wrote to memory of 3688	428	86ab6a7f9d86cb1bb3ad5b55d788e785092177db39206f73bb23f6251d3c4baf.exe	86ab6a7f9d86cb1bb3ad5b55d788e785092177db39206f73bb23f6251d3c4baf.exe
PID 428 wrote to memory of 3688	428	86ab6a7f9d86cb1bb3ad5b55d788e785092177db39206f73bb23f6251d3c4baf.exe	86ab6a7f9d86cb1bb3ad5b55d788e785092177db39206f73bb23f6251d3c4baf.exe
PID 428 wrote to memory of 3688	428	86ab6a7f9d86cb1bb3ad5b55d788e785092177db39206f73bb23f6251d3c4baf.exe	86ab6a7f9d86cb1bb3ad5b55d788e785092177db39206f73bb23f6251d3c4baf.exe
PID 428 wrote to memory of 3688	428	86ab6a7f9d86cb1bb3ad5b55d788e785092177db39206f73bb23f6251d3c4baf.exe	86ab6a7f9d86cb1bb3ad5b55d788e785092177db39206f73bb23f6251d3c4baf.exe

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads