darkcomet | 36e80c63a48af084e483910b7a42ecac4ed48d76c53ab8a300ad410bd0adba94

General

Target

JOIN.exe

Score

10^/10

darkcomet rat trojan upx

Malware Config

Signatures

Darkcomet
DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
trojan rat darkcomet
Executes dropped EXE 2 IoCs

Processes:

cvcvsdf.execvcvsdf.exe

pid process

1448 cvcvsdf.exe
1540 cvcvsdf.exe

pid	process
1448	cvcvsdf.exe
1540	cvcvsdf.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral1/memory/1540-14-0x0000000000400000-0x00000000004B8000-memory.dmp	upx
behavioral1/memory/1540-18-0x0000000000400000-0x00000000004B8000-memory.dmp	upx

Drops startup file 2 IoCs

Processes:

JOIN.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cvcvsdf.exe	JOIN.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cvcvsdf.exe	JOIN.exe

Loads dropped DLL 3 IoCs

Processes:

JOIN.execvcvsdf.exe

pid process

2008 JOIN.exe
2008 JOIN.exe
1448 cvcvsdf.exe
Suspicious use of SetThreadContext 1 IoCs

Processes:

cvcvsdf.exe

description pid process target process

PID 1448 set thread context of 1540 1448 cvcvsdf.exe cvcvsdf.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

pid	process
2008	JOIN.exe
2008	JOIN.exe
1448	cvcvsdf.exe

description	pid	process	target process
PID 1448 set thread context of 1540	1448	cvcvsdf.exe	cvcvsdf.exe

Suspicious use of AdjustPrivilegeToken 23 IoCs

Processes:

cvcvsdf.exe

description	pid	process
Token: SeIncreaseQuotaPrivilege	1540	cvcvsdf.exe
Token: SeSecurityPrivilege	1540	cvcvsdf.exe
Token: SeTakeOwnershipPrivilege	1540	cvcvsdf.exe
Token: SeLoadDriverPrivilege	1540	cvcvsdf.exe
Token: SeSystemProfilePrivilege	1540	cvcvsdf.exe
Token: SeSystemtimePrivilege	1540	cvcvsdf.exe
Token: SeProfSingleProcessPrivilege	1540	cvcvsdf.exe
Token: SeIncBasePriorityPrivilege	1540	cvcvsdf.exe
Token: SeCreatePagefilePrivilege	1540	cvcvsdf.exe
Token: SeBackupPrivilege	1540	cvcvsdf.exe
Token: SeRestorePrivilege	1540	cvcvsdf.exe
Token: SeShutdownPrivilege	1540	cvcvsdf.exe
Token: SeDebugPrivilege	1540	cvcvsdf.exe
Token: SeSystemEnvironmentPrivilege	1540	cvcvsdf.exe
Token: SeChangeNotifyPrivilege	1540	cvcvsdf.exe
Token: SeRemoteShutdownPrivilege	1540	cvcvsdf.exe
Token: SeUndockPrivilege	1540	cvcvsdf.exe
Token: SeManageVolumePrivilege	1540	cvcvsdf.exe
Token: SeImpersonatePrivilege	1540	cvcvsdf.exe
Token: SeCreateGlobalPrivilege	1540	cvcvsdf.exe
Token: 33	1540	cvcvsdf.exe
Token: 34	1540	cvcvsdf.exe
Token: 35	1540	cvcvsdf.exe

Suspicious use of SetWindowsHookEx 3 IoCs

Processes:

JOIN.execvcvsdf.execvcvsdf.exe

pid process

2008 JOIN.exe
1448 cvcvsdf.exe
1540 cvcvsdf.exe

pid	process
2008	JOIN.exe
1448	cvcvsdf.exe
1540	cvcvsdf.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

JOIN.execvcvsdf.exe

description	pid	process	target process
PID 2008 wrote to memory of 1448	2008	JOIN.exe	cvcvsdf.exe
PID 2008 wrote to memory of 1448	2008	JOIN.exe	cvcvsdf.exe
PID 2008 wrote to memory of 1448	2008	JOIN.exe	cvcvsdf.exe
PID 2008 wrote to memory of 1448	2008	JOIN.exe	cvcvsdf.exe
PID 1448 wrote to memory of 1540	1448	cvcvsdf.exe	cvcvsdf.exe
PID 1448 wrote to memory of 1540	1448	cvcvsdf.exe	cvcvsdf.exe
PID 1448 wrote to memory of 1540	1448	cvcvsdf.exe	cvcvsdf.exe
PID 1448 wrote to memory of 1540	1448	cvcvsdf.exe	cvcvsdf.exe
PID 1448 wrote to memory of 1540	1448	cvcvsdf.exe	cvcvsdf.exe
PID 1448 wrote to memory of 1540	1448	cvcvsdf.exe	cvcvsdf.exe
PID 1448 wrote to memory of 1540	1448	cvcvsdf.exe	cvcvsdf.exe
PID 1448 wrote to memory of 1540	1448	cvcvsdf.exe	cvcvsdf.exe

C:\Users\Admin\AppData\Local\Temp\JOIN.exe
"C:\Users\Admin\AppData\Local\Temp\JOIN.exe"
1⤵
- Drops startup file
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2008

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cvcvsdf.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cvcvsdf.exe"
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1448

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cvcvsdf.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cvcvsdf.exe"
3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1540

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cvcvsdf.exe
MD5
ff65699609255332366bf5416fb38869

SHA1
80e9e78f4c4be3daa256ba1e37235a7f159bd25a

SHA256
554711ee1f28155e4b972efff5299f79a054d31eeb18a5ce64f1617982eaeeae

SHA512
0e5a383e6332aee7c31c0ab60ad9d9d1e427dbe28836837a994b0ebac0eb2fe0b9741accfcb386000eb5fd19ac87adcbf86744802886b410c42887a277e9c262

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cvcvsdf.exe
MD5
ff65699609255332366bf5416fb38869

SHA1
80e9e78f4c4be3daa256ba1e37235a7f159bd25a

SHA256
554711ee1f28155e4b972efff5299f79a054d31eeb18a5ce64f1617982eaeeae

SHA512
0e5a383e6332aee7c31c0ab60ad9d9d1e427dbe28836837a994b0ebac0eb2fe0b9741accfcb386000eb5fd19ac87adcbf86744802886b410c42887a277e9c262

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cvcvsdf.exe
MD5
ff65699609255332366bf5416fb38869

SHA1
80e9e78f4c4be3daa256ba1e37235a7f159bd25a

SHA256
554711ee1f28155e4b972efff5299f79a054d31eeb18a5ce64f1617982eaeeae

SHA512
0e5a383e6332aee7c31c0ab60ad9d9d1e427dbe28836837a994b0ebac0eb2fe0b9741accfcb386000eb5fd19ac87adcbf86744802886b410c42887a277e9c262

Download Submit
\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cvcvsdf.exe
MD5
ff65699609255332366bf5416fb38869

SHA1
80e9e78f4c4be3daa256ba1e37235a7f159bd25a

SHA256
554711ee1f28155e4b972efff5299f79a054d31eeb18a5ce64f1617982eaeeae

SHA512
0e5a383e6332aee7c31c0ab60ad9d9d1e427dbe28836837a994b0ebac0eb2fe0b9741accfcb386000eb5fd19ac87adcbf86744802886b410c42887a277e9c262

Download Submit
\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cvcvsdf.exe
MD5
ff65699609255332366bf5416fb38869

SHA1
80e9e78f4c4be3daa256ba1e37235a7f159bd25a

SHA256
554711ee1f28155e4b972efff5299f79a054d31eeb18a5ce64f1617982eaeeae

SHA512
0e5a383e6332aee7c31c0ab60ad9d9d1e427dbe28836837a994b0ebac0eb2fe0b9741accfcb386000eb5fd19ac87adcbf86744802886b410c42887a277e9c262

Download Submit
\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cvcvsdf.exe
MD5
ff65699609255332366bf5416fb38869

SHA1
80e9e78f4c4be3daa256ba1e37235a7f159bd25a

SHA256
554711ee1f28155e4b972efff5299f79a054d31eeb18a5ce64f1617982eaeeae

SHA512
0e5a383e6332aee7c31c0ab60ad9d9d1e427dbe28836837a994b0ebac0eb2fe0b9741accfcb386000eb5fd19ac87adcbf86744802886b410c42887a277e9c262

Download Submit
memory/1448-7-0x0000000000000000-mapping.dmp

Download
memory/1540-14-0x0000000000400000-0x00000000004B8000-memory.dmp

Filesize
736KB

Download
memory/1540-15-0x00000000004B67A0-mapping.dmp

Download
memory/1540-19-0x0000000000240000-0x0000000000241000-memory.dmp

Filesize
4KB

Download
memory/1540-18-0x0000000000400000-0x00000000004B8000-memory.dmp

Filesize
736KB

Download
memory/2008-4-0x0000000076641000-0x0000000076643000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads