darkcomet | 478c798cecf1d123798b6cb4a98be37082a61f1a36fbda353f3ddac57597845b

General

Target

478c798cecf1d123798b6cb4a98be37082a61f1a36fbda353f3ddac57597845b.exe
Size

318KB
MD5

6f3d0a03a44e571b7e1dae6f1323e3a5
SHA1

0bcb371da75012f57d57552cc69a536d781eb21f
SHA256

478c798cecf1d123798b6cb4a98be37082a61f1a36fbda353f3ddac57597845b
SHA512

3343f558ade079379011484aae8568fa41d3d15e58656ead5e33f244e910eea72756bfbe0a706a894e1477c62dfd871ab29f4b6d72e55949480816366063d8a2

Score

10^/10

darkcomet persistence rat trojan

Malware Config

Signatures

Darkcomet
DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
trojan rat darkcomet

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1004

Modify Registry

T1112

Processes:

478c798cecf1d123798b6cb4a98be37082a61f1a36fbda353f3ddac57597845b.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Users\\Admin\\AppData\\Roaming\\MSDCSC\\msdcsc.exe"	478c798cecf1d123798b6cb4a98be37082a61f1a36fbda353f3ddac57597845b.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

478c798cecf1d123798b6cb4a98be37082a61f1a36fbda353f3ddac57597845b.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Users\\Admin\\AppData\\Roaming\\MSDCSC\\msdcsc.exe"	478c798cecf1d123798b6cb4a98be37082a61f1a36fbda353f3ddac57597845b.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 24 IoCs

Processes:

478c798cecf1d123798b6cb4a98be37082a61f1a36fbda353f3ddac57597845b.exe

description	pid	process
Token: SeIncreaseQuotaPrivilege	1304	478c798cecf1d123798b6cb4a98be37082a61f1a36fbda353f3ddac57597845b.exe
Token: SeSecurityPrivilege	1304	478c798cecf1d123798b6cb4a98be37082a61f1a36fbda353f3ddac57597845b.exe
Token: SeTakeOwnershipPrivilege	1304	478c798cecf1d123798b6cb4a98be37082a61f1a36fbda353f3ddac57597845b.exe
Token: SeLoadDriverPrivilege	1304	478c798cecf1d123798b6cb4a98be37082a61f1a36fbda353f3ddac57597845b.exe
Token: SeSystemProfilePrivilege	1304	478c798cecf1d123798b6cb4a98be37082a61f1a36fbda353f3ddac57597845b.exe
Token: SeSystemtimePrivilege	1304	478c798cecf1d123798b6cb4a98be37082a61f1a36fbda353f3ddac57597845b.exe
Token: SeProfSingleProcessPrivilege	1304	478c798cecf1d123798b6cb4a98be37082a61f1a36fbda353f3ddac57597845b.exe
Token: SeIncBasePriorityPrivilege	1304	478c798cecf1d123798b6cb4a98be37082a61f1a36fbda353f3ddac57597845b.exe
Token: SeCreatePagefilePrivilege	1304	478c798cecf1d123798b6cb4a98be37082a61f1a36fbda353f3ddac57597845b.exe
Token: SeBackupPrivilege	1304	478c798cecf1d123798b6cb4a98be37082a61f1a36fbda353f3ddac57597845b.exe
Token: SeRestorePrivilege	1304	478c798cecf1d123798b6cb4a98be37082a61f1a36fbda353f3ddac57597845b.exe
Token: SeShutdownPrivilege	1304	478c798cecf1d123798b6cb4a98be37082a61f1a36fbda353f3ddac57597845b.exe
Token: SeDebugPrivilege	1304	478c798cecf1d123798b6cb4a98be37082a61f1a36fbda353f3ddac57597845b.exe
Token: SeSystemEnvironmentPrivilege	1304	478c798cecf1d123798b6cb4a98be37082a61f1a36fbda353f3ddac57597845b.exe
Token: SeChangeNotifyPrivilege	1304	478c798cecf1d123798b6cb4a98be37082a61f1a36fbda353f3ddac57597845b.exe
Token: SeRemoteShutdownPrivilege	1304	478c798cecf1d123798b6cb4a98be37082a61f1a36fbda353f3ddac57597845b.exe
Token: SeUndockPrivilege	1304	478c798cecf1d123798b6cb4a98be37082a61f1a36fbda353f3ddac57597845b.exe
Token: SeManageVolumePrivilege	1304	478c798cecf1d123798b6cb4a98be37082a61f1a36fbda353f3ddac57597845b.exe
Token: SeImpersonatePrivilege	1304	478c798cecf1d123798b6cb4a98be37082a61f1a36fbda353f3ddac57597845b.exe
Token: SeCreateGlobalPrivilege	1304	478c798cecf1d123798b6cb4a98be37082a61f1a36fbda353f3ddac57597845b.exe
Token: 33	1304	478c798cecf1d123798b6cb4a98be37082a61f1a36fbda353f3ddac57597845b.exe
Token: 34	1304	478c798cecf1d123798b6cb4a98be37082a61f1a36fbda353f3ddac57597845b.exe
Token: 35	1304	478c798cecf1d123798b6cb4a98be37082a61f1a36fbda353f3ddac57597845b.exe
Token: 36	1304	478c798cecf1d123798b6cb4a98be37082a61f1a36fbda353f3ddac57597845b.exe

C:\Users\Admin\AppData\Local\Temp\478c798cecf1d123798b6cb4a98be37082a61f1a36fbda353f3ddac57597845b.exe
"C:\Users\Admin\AppData\Local\Temp\478c798cecf1d123798b6cb4a98be37082a61f1a36fbda353f3ddac57597845b.exe"
1⤵
- Modifies WinLogon for persistence
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
PID:1304