darkcomet | 36e80c63a48af084e483910b7a42ecac4ed48d76c53ab8a300ad410bd0adba94

General

Target

JOIN.exe

Score

10^/10

darkcomet rat trojan upx

Malware Config

Signatures

Darkcomet
DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
trojan rat darkcomet
Executes dropped EXE 2 IoCs

Processes:

cvcvsdf.execvcvsdf.exe

pid process

2480 cvcvsdf.exe
3336 cvcvsdf.exe

pid	process
2480	cvcvsdf.exe
3336	cvcvsdf.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral2/memory/3336-9-0x0000000000400000-0x00000000004B8000-memory.dmp	upx
behavioral2/memory/3336-12-0x0000000000400000-0x00000000004B8000-memory.dmp	upx

Drops startup file 2 IoCs

Processes:

JOIN.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cvcvsdf.exe	JOIN.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cvcvsdf.exe	JOIN.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

cvcvsdf.exe

description pid process target process

PID 2480 set thread context of 3336 2480 cvcvsdf.exe cvcvsdf.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

description	pid	process	target process
PID 2480 set thread context of 3336	2480	cvcvsdf.exe	cvcvsdf.exe

Suspicious use of AdjustPrivilegeToken 24 IoCs

Processes:

cvcvsdf.exe

description	pid	process
Token: SeIncreaseQuotaPrivilege	3336	cvcvsdf.exe
Token: SeSecurityPrivilege	3336	cvcvsdf.exe
Token: SeTakeOwnershipPrivilege	3336	cvcvsdf.exe
Token: SeLoadDriverPrivilege	3336	cvcvsdf.exe
Token: SeSystemProfilePrivilege	3336	cvcvsdf.exe
Token: SeSystemtimePrivilege	3336	cvcvsdf.exe
Token: SeProfSingleProcessPrivilege	3336	cvcvsdf.exe
Token: SeIncBasePriorityPrivilege	3336	cvcvsdf.exe
Token: SeCreatePagefilePrivilege	3336	cvcvsdf.exe
Token: SeBackupPrivilege	3336	cvcvsdf.exe
Token: SeRestorePrivilege	3336	cvcvsdf.exe
Token: SeShutdownPrivilege	3336	cvcvsdf.exe
Token: SeDebugPrivilege	3336	cvcvsdf.exe
Token: SeSystemEnvironmentPrivilege	3336	cvcvsdf.exe
Token: SeChangeNotifyPrivilege	3336	cvcvsdf.exe
Token: SeRemoteShutdownPrivilege	3336	cvcvsdf.exe
Token: SeUndockPrivilege	3336	cvcvsdf.exe
Token: SeManageVolumePrivilege	3336	cvcvsdf.exe
Token: SeImpersonatePrivilege	3336	cvcvsdf.exe
Token: SeCreateGlobalPrivilege	3336	cvcvsdf.exe
Token: 33	3336	cvcvsdf.exe
Token: 34	3336	cvcvsdf.exe
Token: 35	3336	cvcvsdf.exe
Token: 36	3336	cvcvsdf.exe

Suspicious use of SetWindowsHookEx 3 IoCs

Processes:

JOIN.execvcvsdf.execvcvsdf.exe

pid process

732 JOIN.exe
2480 cvcvsdf.exe
3336 cvcvsdf.exe

pid	process
732	JOIN.exe
2480	cvcvsdf.exe
3336	cvcvsdf.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

JOIN.execvcvsdf.exe

description	pid	process	target process
PID 732 wrote to memory of 2480	732	JOIN.exe	cvcvsdf.exe
PID 732 wrote to memory of 2480	732	JOIN.exe	cvcvsdf.exe
PID 732 wrote to memory of 2480	732	JOIN.exe	cvcvsdf.exe
PID 2480 wrote to memory of 3336	2480	cvcvsdf.exe	cvcvsdf.exe
PID 2480 wrote to memory of 3336	2480	cvcvsdf.exe	cvcvsdf.exe
PID 2480 wrote to memory of 3336	2480	cvcvsdf.exe	cvcvsdf.exe
PID 2480 wrote to memory of 3336	2480	cvcvsdf.exe	cvcvsdf.exe
PID 2480 wrote to memory of 3336	2480	cvcvsdf.exe	cvcvsdf.exe
PID 2480 wrote to memory of 3336	2480	cvcvsdf.exe	cvcvsdf.exe
PID 2480 wrote to memory of 3336	2480	cvcvsdf.exe	cvcvsdf.exe
PID 2480 wrote to memory of 3336	2480	cvcvsdf.exe	cvcvsdf.exe

C:\Users\Admin\AppData\Local\Temp\JOIN.exe
"C:\Users\Admin\AppData\Local\Temp\JOIN.exe"
1⤵
- Drops startup file
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:732

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cvcvsdf.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cvcvsdf.exe"
2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2480

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cvcvsdf.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cvcvsdf.exe"
3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:3336

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cvcvsdf.exe
MD5
ff65699609255332366bf5416fb38869

SHA1
80e9e78f4c4be3daa256ba1e37235a7f159bd25a

SHA256
554711ee1f28155e4b972efff5299f79a054d31eeb18a5ce64f1617982eaeeae

SHA512
0e5a383e6332aee7c31c0ab60ad9d9d1e427dbe28836837a994b0ebac0eb2fe0b9741accfcb386000eb5fd19ac87adcbf86744802886b410c42887a277e9c262

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cvcvsdf.exe
MD5
ff65699609255332366bf5416fb38869

SHA1
80e9e78f4c4be3daa256ba1e37235a7f159bd25a

SHA256
554711ee1f28155e4b972efff5299f79a054d31eeb18a5ce64f1617982eaeeae

SHA512
0e5a383e6332aee7c31c0ab60ad9d9d1e427dbe28836837a994b0ebac0eb2fe0b9741accfcb386000eb5fd19ac87adcbf86744802886b410c42887a277e9c262

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cvcvsdf.exe
MD5
ff65699609255332366bf5416fb38869

SHA1
80e9e78f4c4be3daa256ba1e37235a7f159bd25a

SHA256
554711ee1f28155e4b972efff5299f79a054d31eeb18a5ce64f1617982eaeeae

SHA512
0e5a383e6332aee7c31c0ab60ad9d9d1e427dbe28836837a994b0ebac0eb2fe0b9741accfcb386000eb5fd19ac87adcbf86744802886b410c42887a277e9c262

Download Submit
memory/2480-4-0x0000000000000000-mapping.dmp

Download
memory/3336-10-0x00000000004B67A0-mapping.dmp

Download
memory/3336-9-0x0000000000400000-0x00000000004B8000-memory.dmp

Filesize
736KB

Download
memory/3336-13-0x0000000000A90000-0x0000000000A91000-memory.dmp

Filesize
4KB

Download
memory/3336-12-0x0000000000400000-0x00000000004B8000-memory.dmp

Filesize
736KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads