darkcomet | 86f3d464496271328b6bf4c63c0feeec0f5381d11cec24d2f753cf07f2e4cb96

General

Target

ddd6405699a1b9d274a9ec1ee86fd97b.exe
Size

1.1MB
MD5

ddd6405699a1b9d274a9ec1ee86fd97b
SHA1

167499450b5b204eb319792c9a5cea7fdf83e858
SHA256

86f3d464496271328b6bf4c63c0feeec0f5381d11cec24d2f753cf07f2e4cb96
SHA512

3da3574fca2f9ecf3e73479235b3a6bb2d3fdf3695b75583e4528b5efbf87546eeed4c408ee31e849294bc1fe48cc1a97e50638f6b2d27fe161ac31d2e50d6e7

Score

10^/10

darkcomet dark persistence rat trojan

Malware Config

Extracted

Family

darkcomet

Botnet

Dark

C2

uchedack.no-ip.org:6666

Mutex

DC_MUTEX-15LJ0H8

Attributes

gencode
cnD6zzq2qYhm
install
false
offline_keylogger
true
persistence
false

Signatures

Darkcomet
DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
trojan rat darkcomet
Uses the VBS compiler for execution 1 TTPs

Scripting
T1064

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

ddd6405699a1b9d274a9ec1ee86fd97b.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-4210623931-3856158591-1213714290-1000\Software\Microsoft\Windows\CurrentVersion\Run\AdobeUpdater = "C:\\Users\\Admin\\AppData\\Local\\Temp\\AdobeUpdater.exe"	ddd6405699a1b9d274a9ec1ee86fd97b.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

ddd6405699a1b9d274a9ec1ee86fd97b.exe

description pid process target process

PID 1428 set thread context of 1048 1428 ddd6405699a1b9d274a9ec1ee86fd97b.exe vbc.exe

description	pid	process	target process
PID 1428 set thread context of 1048	1428	ddd6405699a1b9d274a9ec1ee86fd97b.exe	vbc.exe

Suspicious use of AdjustPrivilegeToken 26 IoCs

Processes:

ddd6405699a1b9d274a9ec1ee86fd97b.exevbc.exe

description	pid	process
Token: SeDebugPrivilege	1428	ddd6405699a1b9d274a9ec1ee86fd97b.exe
Token: 33	1428	ddd6405699a1b9d274a9ec1ee86fd97b.exe
Token: SeIncBasePriorityPrivilege	1428	ddd6405699a1b9d274a9ec1ee86fd97b.exe
Token: SeIncreaseQuotaPrivilege	1048	vbc.exe
Token: SeSecurityPrivilege	1048	vbc.exe
Token: SeTakeOwnershipPrivilege	1048	vbc.exe
Token: SeLoadDriverPrivilege	1048	vbc.exe
Token: SeSystemProfilePrivilege	1048	vbc.exe
Token: SeSystemtimePrivilege	1048	vbc.exe
Token: SeProfSingleProcessPrivilege	1048	vbc.exe
Token: SeIncBasePriorityPrivilege	1048	vbc.exe
Token: SeCreatePagefilePrivilege	1048	vbc.exe
Token: SeBackupPrivilege	1048	vbc.exe
Token: SeRestorePrivilege	1048	vbc.exe
Token: SeShutdownPrivilege	1048	vbc.exe
Token: SeDebugPrivilege	1048	vbc.exe
Token: SeSystemEnvironmentPrivilege	1048	vbc.exe
Token: SeChangeNotifyPrivilege	1048	vbc.exe
Token: SeRemoteShutdownPrivilege	1048	vbc.exe
Token: SeUndockPrivilege	1048	vbc.exe
Token: SeManageVolumePrivilege	1048	vbc.exe
Token: SeImpersonatePrivilege	1048	vbc.exe
Token: SeCreateGlobalPrivilege	1048	vbc.exe
Token: 33	1048	vbc.exe
Token: 34	1048	vbc.exe
Token: 35	1048	vbc.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

vbc.exe

pid process

1048 vbc.exe

pid	process
1048	vbc.exe

Suspicious use of WriteProcessMemory 16 IoCs

Processes:

ddd6405699a1b9d274a9ec1ee86fd97b.exe

description	pid	process	target process
PID 1428 wrote to memory of 1048	1428	ddd6405699a1b9d274a9ec1ee86fd97b.exe	vbc.exe
PID 1428 wrote to memory of 1048	1428	ddd6405699a1b9d274a9ec1ee86fd97b.exe	vbc.exe
PID 1428 wrote to memory of 1048	1428	ddd6405699a1b9d274a9ec1ee86fd97b.exe	vbc.exe
PID 1428 wrote to memory of 1048	1428	ddd6405699a1b9d274a9ec1ee86fd97b.exe	vbc.exe
PID 1428 wrote to memory of 1048	1428	ddd6405699a1b9d274a9ec1ee86fd97b.exe	vbc.exe
PID 1428 wrote to memory of 1048	1428	ddd6405699a1b9d274a9ec1ee86fd97b.exe	vbc.exe
PID 1428 wrote to memory of 1048	1428	ddd6405699a1b9d274a9ec1ee86fd97b.exe	vbc.exe
PID 1428 wrote to memory of 1048	1428	ddd6405699a1b9d274a9ec1ee86fd97b.exe	vbc.exe
PID 1428 wrote to memory of 1048	1428	ddd6405699a1b9d274a9ec1ee86fd97b.exe	vbc.exe
PID 1428 wrote to memory of 1048	1428	ddd6405699a1b9d274a9ec1ee86fd97b.exe	vbc.exe
PID 1428 wrote to memory of 1048	1428	ddd6405699a1b9d274a9ec1ee86fd97b.exe	vbc.exe
PID 1428 wrote to memory of 1048	1428	ddd6405699a1b9d274a9ec1ee86fd97b.exe	vbc.exe
PID 1428 wrote to memory of 1048	1428	ddd6405699a1b9d274a9ec1ee86fd97b.exe	vbc.exe
PID 1428 wrote to memory of 1048	1428	ddd6405699a1b9d274a9ec1ee86fd97b.exe	vbc.exe
PID 1428 wrote to memory of 1048	1428	ddd6405699a1b9d274a9ec1ee86fd97b.exe	vbc.exe
PID 1428 wrote to memory of 1048	1428	ddd6405699a1b9d274a9ec1ee86fd97b.exe	vbc.exe

C:\Users\Admin\AppData\Local\Temp\ddd6405699a1b9d274a9ec1ee86fd97b.exe
"C:\Users\Admin\AppData\Local\Temp\ddd6405699a1b9d274a9ec1ee86fd97b.exe"
1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1428

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
2⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1048

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scripting

1

T1064

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

Scripting

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1048-1-0x000000000048F888-mapping.dmp

Download
memory/1048-0-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/1048-2-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads