darkcomet | 8b4e13336abef6ecfbff5b1fea65e840863acbe85ef008fc43f4c6f108b391b8

General

Target

8b4e13336abef6ecfbff5b1fea65e840863acbe85ef008fc43f4c6f108b391b8.exe
Size

404KB
MD5

031bc4d25f79bc974e1eb0a389590a4d
SHA1

35ca2381988729dd6ac4f57f945472b56a76182b
SHA256

8b4e13336abef6ecfbff5b1fea65e840863acbe85ef008fc43f4c6f108b391b8
SHA512

393c8e69c3f69754b42f09ce227548f6c1b2b722384ce92c669ccad072f9d730a06c93132b9ec43f51f0eb4d7ad04197fc23d8b61dc6aa9351b9ce12ddcd9820

Score

10^/10

darkcomet privcrypt rat trojan upx

Malware Config

Extracted

Family

darkcomet

Botnet

PrivCrypt

C2

emile2012.no-ip.info:1337

Mutex

DCMIN_MUTEX-WB71XN1

Attributes

gencode
dby0EQrVG8Ck
install
false
offline_keylogger
true
persistence
false

Signatures

Darkcomet
DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
trojan rat darkcomet

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral1/memory/2008-0-0x0000000000400000-0x00000000004B7000-memory.dmp	upx
behavioral1/memory/2008-2-0x0000000000400000-0x00000000004B7000-memory.dmp	upx
behavioral1/memory/2008-3-0x0000000000400000-0x00000000004B7000-memory.dmp	upx

Uses the VBS compiler for execution 1 TTPs

Scripting
T1064

Suspicious use of SetThreadContext 1 IoCs

Processes:

8b4e13336abef6ecfbff5b1fea65e840863acbe85ef008fc43f4c6f108b391b8.exe

description	pid	process	target process
PID 1804 set thread context of 2008	1804	8b4e13336abef6ecfbff5b1fea65e840863acbe85ef008fc43f4c6f108b391b8.exe	vbc.exe

Suspicious use of AdjustPrivilegeToken 23 IoCs

Processes:

vbc.exe

description	pid	process
Token: SeIncreaseQuotaPrivilege	2008	vbc.exe
Token: SeSecurityPrivilege	2008	vbc.exe
Token: SeTakeOwnershipPrivilege	2008	vbc.exe
Token: SeLoadDriverPrivilege	2008	vbc.exe
Token: SeSystemProfilePrivilege	2008	vbc.exe
Token: SeSystemtimePrivilege	2008	vbc.exe
Token: SeProfSingleProcessPrivilege	2008	vbc.exe
Token: SeIncBasePriorityPrivilege	2008	vbc.exe
Token: SeCreatePagefilePrivilege	2008	vbc.exe
Token: SeBackupPrivilege	2008	vbc.exe
Token: SeRestorePrivilege	2008	vbc.exe
Token: SeShutdownPrivilege	2008	vbc.exe
Token: SeDebugPrivilege	2008	vbc.exe
Token: SeSystemEnvironmentPrivilege	2008	vbc.exe
Token: SeChangeNotifyPrivilege	2008	vbc.exe
Token: SeRemoteShutdownPrivilege	2008	vbc.exe
Token: SeUndockPrivilege	2008	vbc.exe
Token: SeManageVolumePrivilege	2008	vbc.exe
Token: SeImpersonatePrivilege	2008	vbc.exe
Token: SeCreateGlobalPrivilege	2008	vbc.exe
Token: 33	2008	vbc.exe
Token: 34	2008	vbc.exe
Token: 35	2008	vbc.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

vbc.exe

pid process

2008 vbc.exe

pid	process
2008	vbc.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

8b4e13336abef6ecfbff5b1fea65e840863acbe85ef008fc43f4c6f108b391b8.exe

description	pid	process	target process
PID 1804 wrote to memory of 2008	1804	8b4e13336abef6ecfbff5b1fea65e840863acbe85ef008fc43f4c6f108b391b8.exe	vbc.exe
PID 1804 wrote to memory of 2008	1804	8b4e13336abef6ecfbff5b1fea65e840863acbe85ef008fc43f4c6f108b391b8.exe	vbc.exe
PID 1804 wrote to memory of 2008	1804	8b4e13336abef6ecfbff5b1fea65e840863acbe85ef008fc43f4c6f108b391b8.exe	vbc.exe
PID 1804 wrote to memory of 2008	1804	8b4e13336abef6ecfbff5b1fea65e840863acbe85ef008fc43f4c6f108b391b8.exe	vbc.exe
PID 1804 wrote to memory of 2008	1804	8b4e13336abef6ecfbff5b1fea65e840863acbe85ef008fc43f4c6f108b391b8.exe	vbc.exe
PID 1804 wrote to memory of 2008	1804	8b4e13336abef6ecfbff5b1fea65e840863acbe85ef008fc43f4c6f108b391b8.exe	vbc.exe
PID 1804 wrote to memory of 2008	1804	8b4e13336abef6ecfbff5b1fea65e840863acbe85ef008fc43f4c6f108b391b8.exe	vbc.exe
PID 1804 wrote to memory of 2008	1804	8b4e13336abef6ecfbff5b1fea65e840863acbe85ef008fc43f4c6f108b391b8.exe	vbc.exe

C:\Users\Admin\AppData\Local\Temp\8b4e13336abef6ecfbff5b1fea65e840863acbe85ef008fc43f4c6f108b391b8.exe
"C:\Users\Admin\AppData\Local\Temp\8b4e13336abef6ecfbff5b1fea65e840863acbe85ef008fc43f4c6f108b391b8.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1804

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
2⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2008

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scripting

1

T1064

Persistence

Privilege Escalation

Defense Evasion

Scripting

1

T1064

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2008-0-0x0000000000400000-0x00000000004B7000-memory.dmp

Filesize
732KB

Download
memory/2008-1-0x00000000004B5000-mapping.dmp

Download
memory/2008-2-0x0000000000400000-0x00000000004B7000-memory.dmp

Filesize
732KB

Download
memory/2008-3-0x0000000000400000-0x00000000004B7000-memory.dmp

Filesize
732KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads