darkcomet | 2cc4826b0c4bc6a242fa4c4610c599e766a69d37e8b657e28131602541a60c21

General

Target

2cc4826b0c4bc6a242fa4c4610c599e766a69d37e8b657e28131602541a60c21.exe
Size

252KB
MD5

0f4fa9dff5b3fde74227eb45f3aa1bb9
SHA1

4be833339d7d907b2029a4466e0771760fd7a1f6
SHA256

2cc4826b0c4bc6a242fa4c4610c599e766a69d37e8b657e28131602541a60c21
SHA512

17100446ff5bceb5f4dcc0a16e48d33910d068b36cb48884d4fc3c5468d52a92120f6bb7a0eb832ed2322dc90c04bd97f57340df11595b68bb71dbbb2fefd4e7

Score

10^/10

darkcomet persistence rat trojan

Malware Config

Signatures

Darkcomet
DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
trojan rat darkcomet

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1004

Modify Registry

T1112

Processes:

2cc4826b0c4bc6a242fa4c4610c599e766a69d37e8b657e28131602541a60c21.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Users\\Admin\\Documents\\MSDCSC\\msdcsc.exe"	2cc4826b0c4bc6a242fa4c4610c599e766a69d37e8b657e28131602541a60c21.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

2cc4826b0c4bc6a242fa4c4610c599e766a69d37e8b657e28131602541a60c21.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Users\\Admin\\Documents\\MSDCSC\\msdcsc.exe"	2cc4826b0c4bc6a242fa4c4610c599e766a69d37e8b657e28131602541a60c21.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 23 IoCs

Processes:

2cc4826b0c4bc6a242fa4c4610c599e766a69d37e8b657e28131602541a60c21.exe

description	pid	process
Token: SeIncreaseQuotaPrivilege	2036	2cc4826b0c4bc6a242fa4c4610c599e766a69d37e8b657e28131602541a60c21.exe
Token: SeSecurityPrivilege	2036	2cc4826b0c4bc6a242fa4c4610c599e766a69d37e8b657e28131602541a60c21.exe
Token: SeTakeOwnershipPrivilege	2036	2cc4826b0c4bc6a242fa4c4610c599e766a69d37e8b657e28131602541a60c21.exe
Token: SeLoadDriverPrivilege	2036	2cc4826b0c4bc6a242fa4c4610c599e766a69d37e8b657e28131602541a60c21.exe
Token: SeSystemProfilePrivilege	2036	2cc4826b0c4bc6a242fa4c4610c599e766a69d37e8b657e28131602541a60c21.exe
Token: SeSystemtimePrivilege	2036	2cc4826b0c4bc6a242fa4c4610c599e766a69d37e8b657e28131602541a60c21.exe
Token: SeProfSingleProcessPrivilege	2036	2cc4826b0c4bc6a242fa4c4610c599e766a69d37e8b657e28131602541a60c21.exe
Token: SeIncBasePriorityPrivilege	2036	2cc4826b0c4bc6a242fa4c4610c599e766a69d37e8b657e28131602541a60c21.exe
Token: SeCreatePagefilePrivilege	2036	2cc4826b0c4bc6a242fa4c4610c599e766a69d37e8b657e28131602541a60c21.exe
Token: SeBackupPrivilege	2036	2cc4826b0c4bc6a242fa4c4610c599e766a69d37e8b657e28131602541a60c21.exe
Token: SeRestorePrivilege	2036	2cc4826b0c4bc6a242fa4c4610c599e766a69d37e8b657e28131602541a60c21.exe
Token: SeShutdownPrivilege	2036	2cc4826b0c4bc6a242fa4c4610c599e766a69d37e8b657e28131602541a60c21.exe
Token: SeDebugPrivilege	2036	2cc4826b0c4bc6a242fa4c4610c599e766a69d37e8b657e28131602541a60c21.exe
Token: SeSystemEnvironmentPrivilege	2036	2cc4826b0c4bc6a242fa4c4610c599e766a69d37e8b657e28131602541a60c21.exe
Token: SeChangeNotifyPrivilege	2036	2cc4826b0c4bc6a242fa4c4610c599e766a69d37e8b657e28131602541a60c21.exe
Token: SeRemoteShutdownPrivilege	2036	2cc4826b0c4bc6a242fa4c4610c599e766a69d37e8b657e28131602541a60c21.exe
Token: SeUndockPrivilege	2036	2cc4826b0c4bc6a242fa4c4610c599e766a69d37e8b657e28131602541a60c21.exe
Token: SeManageVolumePrivilege	2036	2cc4826b0c4bc6a242fa4c4610c599e766a69d37e8b657e28131602541a60c21.exe
Token: SeImpersonatePrivilege	2036	2cc4826b0c4bc6a242fa4c4610c599e766a69d37e8b657e28131602541a60c21.exe
Token: SeCreateGlobalPrivilege	2036	2cc4826b0c4bc6a242fa4c4610c599e766a69d37e8b657e28131602541a60c21.exe
Token: 33	2036	2cc4826b0c4bc6a242fa4c4610c599e766a69d37e8b657e28131602541a60c21.exe
Token: 34	2036	2cc4826b0c4bc6a242fa4c4610c599e766a69d37e8b657e28131602541a60c21.exe
Token: 35	2036	2cc4826b0c4bc6a242fa4c4610c599e766a69d37e8b657e28131602541a60c21.exe

C:\Users\Admin\AppData\Local\Temp\2cc4826b0c4bc6a242fa4c4610c599e766a69d37e8b657e28131602541a60c21.exe
"C:\Users\Admin\AppData\Local\Temp\2cc4826b0c4bc6a242fa4c4610c599e766a69d37e8b657e28131602541a60c21.exe"
1⤵
- Modifies WinLogon for persistence
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
PID:2036