darkcomet | 36e80c63a48af084e483910b7a42ecac4ed48d76c53ab8a300ad410bd0adba94

General

Target

JOIN.exe

Score

10^/10

darkcomet rat trojan upx

Malware Config

Signatures

Darkcomet
DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
trojan rat darkcomet
Executes dropped EXE 2 IoCs

Processes:

cvcvsdf.execvcvsdf.exe

pid process

1200 cvcvsdf.exe
1904 cvcvsdf.exe

pid	process
1200	cvcvsdf.exe
1904	cvcvsdf.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral1/memory/1904-14-0x0000000000400000-0x00000000004B8000-memory.dmp	upx
behavioral1/memory/1904-18-0x0000000000400000-0x00000000004B8000-memory.dmp	upx

Drops startup file 2 IoCs

Processes:

JOIN.exe

description	ioc	process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cvcvsdf.exe	JOIN.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cvcvsdf.exe	JOIN.exe

Loads dropped DLL 3 IoCs

Processes:

JOIN.execvcvsdf.exe

pid process

1924 JOIN.exe
1924 JOIN.exe
1200 cvcvsdf.exe
Suspicious use of SetThreadContext 1 IoCs

Processes:

cvcvsdf.exe

description pid process target process

PID 1200 set thread context of 1904 1200 cvcvsdf.exe cvcvsdf.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

pid	process
1924	JOIN.exe
1924	JOIN.exe
1200	cvcvsdf.exe

description	pid	process	target process
PID 1200 set thread context of 1904	1200	cvcvsdf.exe	cvcvsdf.exe

Suspicious use of AdjustPrivilegeToken 23 IoCs

Processes:

cvcvsdf.exe

description	pid	process
Token: SeIncreaseQuotaPrivilege	1904	cvcvsdf.exe
Token: SeSecurityPrivilege	1904	cvcvsdf.exe
Token: SeTakeOwnershipPrivilege	1904	cvcvsdf.exe
Token: SeLoadDriverPrivilege	1904	cvcvsdf.exe
Token: SeSystemProfilePrivilege	1904	cvcvsdf.exe
Token: SeSystemtimePrivilege	1904	cvcvsdf.exe
Token: SeProfSingleProcessPrivilege	1904	cvcvsdf.exe
Token: SeIncBasePriorityPrivilege	1904	cvcvsdf.exe
Token: SeCreatePagefilePrivilege	1904	cvcvsdf.exe
Token: SeBackupPrivilege	1904	cvcvsdf.exe
Token: SeRestorePrivilege	1904	cvcvsdf.exe
Token: SeShutdownPrivilege	1904	cvcvsdf.exe
Token: SeDebugPrivilege	1904	cvcvsdf.exe
Token: SeSystemEnvironmentPrivilege	1904	cvcvsdf.exe
Token: SeChangeNotifyPrivilege	1904	cvcvsdf.exe
Token: SeRemoteShutdownPrivilege	1904	cvcvsdf.exe
Token: SeUndockPrivilege	1904	cvcvsdf.exe
Token: SeManageVolumePrivilege	1904	cvcvsdf.exe
Token: SeImpersonatePrivilege	1904	cvcvsdf.exe
Token: SeCreateGlobalPrivilege	1904	cvcvsdf.exe
Token: 33	1904	cvcvsdf.exe
Token: 34	1904	cvcvsdf.exe
Token: 35	1904	cvcvsdf.exe

Suspicious use of SetWindowsHookEx 3 IoCs

Processes:

JOIN.execvcvsdf.execvcvsdf.exe

pid process

1924 JOIN.exe
1200 cvcvsdf.exe
1904 cvcvsdf.exe

pid	process
1924	JOIN.exe
1200	cvcvsdf.exe
1904	cvcvsdf.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

JOIN.execvcvsdf.exe

description	pid	process	target process
PID 1924 wrote to memory of 1200	1924	JOIN.exe	cvcvsdf.exe
PID 1924 wrote to memory of 1200	1924	JOIN.exe	cvcvsdf.exe
PID 1924 wrote to memory of 1200	1924	JOIN.exe	cvcvsdf.exe
PID 1924 wrote to memory of 1200	1924	JOIN.exe	cvcvsdf.exe
PID 1200 wrote to memory of 1904	1200	cvcvsdf.exe	cvcvsdf.exe
PID 1200 wrote to memory of 1904	1200	cvcvsdf.exe	cvcvsdf.exe
PID 1200 wrote to memory of 1904	1200	cvcvsdf.exe	cvcvsdf.exe
PID 1200 wrote to memory of 1904	1200	cvcvsdf.exe	cvcvsdf.exe
PID 1200 wrote to memory of 1904	1200	cvcvsdf.exe	cvcvsdf.exe
PID 1200 wrote to memory of 1904	1200	cvcvsdf.exe	cvcvsdf.exe
PID 1200 wrote to memory of 1904	1200	cvcvsdf.exe	cvcvsdf.exe
PID 1200 wrote to memory of 1904	1200	cvcvsdf.exe	cvcvsdf.exe

C:\Users\Admin\AppData\Local\Temp\JOIN.exe
"C:\Users\Admin\AppData\Local\Temp\JOIN.exe"
1⤵
- Drops startup file
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1924

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cvcvsdf.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cvcvsdf.exe"
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1200

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cvcvsdf.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cvcvsdf.exe"
3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1904

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cvcvsdf.exe

MD5
ff65699609255332366bf5416fb38869

SHA1
80e9e78f4c4be3daa256ba1e37235a7f159bd25a

SHA256
554711ee1f28155e4b972efff5299f79a054d31eeb18a5ce64f1617982eaeeae

SHA512
0e5a383e6332aee7c31c0ab60ad9d9d1e427dbe28836837a994b0ebac0eb2fe0b9741accfcb386000eb5fd19ac87adcbf86744802886b410c42887a277e9c262

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cvcvsdf.exe

MD5
ff65699609255332366bf5416fb38869

SHA1
80e9e78f4c4be3daa256ba1e37235a7f159bd25a

SHA256
554711ee1f28155e4b972efff5299f79a054d31eeb18a5ce64f1617982eaeeae

SHA512
0e5a383e6332aee7c31c0ab60ad9d9d1e427dbe28836837a994b0ebac0eb2fe0b9741accfcb386000eb5fd19ac87adcbf86744802886b410c42887a277e9c262

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cvcvsdf.exe

MD5
ff65699609255332366bf5416fb38869

SHA1
80e9e78f4c4be3daa256ba1e37235a7f159bd25a

SHA256
554711ee1f28155e4b972efff5299f79a054d31eeb18a5ce64f1617982eaeeae

SHA512
0e5a383e6332aee7c31c0ab60ad9d9d1e427dbe28836837a994b0ebac0eb2fe0b9741accfcb386000eb5fd19ac87adcbf86744802886b410c42887a277e9c262

Download Submit
\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cvcvsdf.exe

MD5
ff65699609255332366bf5416fb38869

SHA1
80e9e78f4c4be3daa256ba1e37235a7f159bd25a

SHA256
554711ee1f28155e4b972efff5299f79a054d31eeb18a5ce64f1617982eaeeae

SHA512
0e5a383e6332aee7c31c0ab60ad9d9d1e427dbe28836837a994b0ebac0eb2fe0b9741accfcb386000eb5fd19ac87adcbf86744802886b410c42887a277e9c262

Download Submit
\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cvcvsdf.exe

MD5
ff65699609255332366bf5416fb38869

SHA1
80e9e78f4c4be3daa256ba1e37235a7f159bd25a

SHA256
554711ee1f28155e4b972efff5299f79a054d31eeb18a5ce64f1617982eaeeae

SHA512
0e5a383e6332aee7c31c0ab60ad9d9d1e427dbe28836837a994b0ebac0eb2fe0b9741accfcb386000eb5fd19ac87adcbf86744802886b410c42887a277e9c262

Download Submit
\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cvcvsdf.exe

MD5
ff65699609255332366bf5416fb38869

SHA1
80e9e78f4c4be3daa256ba1e37235a7f159bd25a

SHA256
554711ee1f28155e4b972efff5299f79a054d31eeb18a5ce64f1617982eaeeae

SHA512
0e5a383e6332aee7c31c0ab60ad9d9d1e427dbe28836837a994b0ebac0eb2fe0b9741accfcb386000eb5fd19ac87adcbf86744802886b410c42887a277e9c262

Download Submit
memory/1200-7-0x0000000000000000-mapping.dmp

Download
memory/1904-14-0x0000000000400000-0x00000000004B8000-memory.dmp

Filesize
736KB

Download
memory/1904-15-0x00000000004B67A0-mapping.dmp

Download
memory/1904-18-0x0000000000400000-0x00000000004B8000-memory.dmp

Filesize
736KB

Download
memory/1904-19-0x0000000000250000-0x0000000000251000-memory.dmp

Filesize
4KB

Download
memory/1924-4-0x0000000075AE1000-0x0000000075AE3000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads