darkcomet | e6edf54375a14314aa44db9fe8cdd48368338e7ed873f25ba2a6a5ff4381d233

General

Target

Payment Confirmation.exe
Size

888KB
MD5

800b9d7f3a47c5a18da78cb6a54f90be
SHA1

67c825ca6d8f430fdfc4cbca78c442600db7ccf0
SHA256

e6edf54375a14314aa44db9fe8cdd48368338e7ed873f25ba2a6a5ff4381d233
SHA512

3f36217fc2e0afd41d16ea8e35628b00bd8e094194b892e551ba2b39fffaf16e67ece937ade136fe03286fef59718a76fc83081a7cb1dd2f8a7efa811a992e87

Score

10^/10

darkcomet rat trojan upx

Malware Config

Signatures

Darkcomet
DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
trojan rat darkcomet
Executes dropped EXE 2 IoCs

Processes:

cvcvsdf.execvcvsdf.exe

pid process

1996 cvcvsdf.exe
768 cvcvsdf.exe

pid	process
1996	cvcvsdf.exe
768	cvcvsdf.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral1/memory/768-14-0x0000000000400000-0x00000000004B8000-memory.dmp	upx
behavioral1/memory/768-18-0x0000000000400000-0x00000000004B8000-memory.dmp	upx

Drops startup file 2 IoCs

Processes:

Payment Confirmation.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cvcvsdf.exe	Payment Confirmation.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cvcvsdf.exe	Payment Confirmation.exe

Loads dropped DLL 3 IoCs

Processes:

Payment Confirmation.execvcvsdf.exe

pid process

1340 Payment Confirmation.exe
1340 Payment Confirmation.exe
1996 cvcvsdf.exe
Suspicious use of SetThreadContext 1 IoCs

Processes:

cvcvsdf.exe

description pid process target process

PID 1996 set thread context of 768 1996 cvcvsdf.exe cvcvsdf.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

pid	process
1340	Payment Confirmation.exe
1340	Payment Confirmation.exe
1996	cvcvsdf.exe

description	pid	process	target process
PID 1996 set thread context of 768	1996	cvcvsdf.exe	cvcvsdf.exe

Suspicious use of AdjustPrivilegeToken 23 IoCs

Processes:

cvcvsdf.exe

description	pid	process
Token: SeIncreaseQuotaPrivilege	768	cvcvsdf.exe
Token: SeSecurityPrivilege	768	cvcvsdf.exe
Token: SeTakeOwnershipPrivilege	768	cvcvsdf.exe
Token: SeLoadDriverPrivilege	768	cvcvsdf.exe
Token: SeSystemProfilePrivilege	768	cvcvsdf.exe
Token: SeSystemtimePrivilege	768	cvcvsdf.exe
Token: SeProfSingleProcessPrivilege	768	cvcvsdf.exe
Token: SeIncBasePriorityPrivilege	768	cvcvsdf.exe
Token: SeCreatePagefilePrivilege	768	cvcvsdf.exe
Token: SeBackupPrivilege	768	cvcvsdf.exe
Token: SeRestorePrivilege	768	cvcvsdf.exe
Token: SeShutdownPrivilege	768	cvcvsdf.exe
Token: SeDebugPrivilege	768	cvcvsdf.exe
Token: SeSystemEnvironmentPrivilege	768	cvcvsdf.exe
Token: SeChangeNotifyPrivilege	768	cvcvsdf.exe
Token: SeRemoteShutdownPrivilege	768	cvcvsdf.exe
Token: SeUndockPrivilege	768	cvcvsdf.exe
Token: SeManageVolumePrivilege	768	cvcvsdf.exe
Token: SeImpersonatePrivilege	768	cvcvsdf.exe
Token: SeCreateGlobalPrivilege	768	cvcvsdf.exe
Token: 33	768	cvcvsdf.exe
Token: 34	768	cvcvsdf.exe
Token: 35	768	cvcvsdf.exe

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

Payment Confirmation.execvcvsdf.exe

pid process

1340 Payment Confirmation.exe
1996 cvcvsdf.exe

pid	process
1340	Payment Confirmation.exe
1996	cvcvsdf.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

Payment Confirmation.execvcvsdf.exe

description	pid	process	target process
PID 1340 wrote to memory of 1996	1340	Payment Confirmation.exe	cvcvsdf.exe
PID 1340 wrote to memory of 1996	1340	Payment Confirmation.exe	cvcvsdf.exe
PID 1340 wrote to memory of 1996	1340	Payment Confirmation.exe	cvcvsdf.exe
PID 1340 wrote to memory of 1996	1340	Payment Confirmation.exe	cvcvsdf.exe
PID 1996 wrote to memory of 768	1996	cvcvsdf.exe	cvcvsdf.exe
PID 1996 wrote to memory of 768	1996	cvcvsdf.exe	cvcvsdf.exe
PID 1996 wrote to memory of 768	1996	cvcvsdf.exe	cvcvsdf.exe
PID 1996 wrote to memory of 768	1996	cvcvsdf.exe	cvcvsdf.exe
PID 1996 wrote to memory of 768	1996	cvcvsdf.exe	cvcvsdf.exe
PID 1996 wrote to memory of 768	1996	cvcvsdf.exe	cvcvsdf.exe
PID 1996 wrote to memory of 768	1996	cvcvsdf.exe	cvcvsdf.exe
PID 1996 wrote to memory of 768	1996	cvcvsdf.exe	cvcvsdf.exe

C:\Users\Admin\AppData\Local\Temp\Payment Confirmation.exe
"C:\Users\Admin\AppData\Local\Temp\Payment Confirmation.exe"
1⤵
- Drops startup file
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1340

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cvcvsdf.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cvcvsdf.exe"
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1996

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cvcvsdf.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cvcvsdf.exe"
3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:768

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cvcvsdf.exe
MD5
800b9d7f3a47c5a18da78cb6a54f90be

SHA1
67c825ca6d8f430fdfc4cbca78c442600db7ccf0

SHA256
e6edf54375a14314aa44db9fe8cdd48368338e7ed873f25ba2a6a5ff4381d233

SHA512
3f36217fc2e0afd41d16ea8e35628b00bd8e094194b892e551ba2b39fffaf16e67ece937ade136fe03286fef59718a76fc83081a7cb1dd2f8a7efa811a992e87

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cvcvsdf.exe
MD5
800b9d7f3a47c5a18da78cb6a54f90be

SHA1
67c825ca6d8f430fdfc4cbca78c442600db7ccf0

SHA256
e6edf54375a14314aa44db9fe8cdd48368338e7ed873f25ba2a6a5ff4381d233

SHA512
3f36217fc2e0afd41d16ea8e35628b00bd8e094194b892e551ba2b39fffaf16e67ece937ade136fe03286fef59718a76fc83081a7cb1dd2f8a7efa811a992e87

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cvcvsdf.exe
MD5
800b9d7f3a47c5a18da78cb6a54f90be

SHA1
67c825ca6d8f430fdfc4cbca78c442600db7ccf0

SHA256
e6edf54375a14314aa44db9fe8cdd48368338e7ed873f25ba2a6a5ff4381d233

SHA512
3f36217fc2e0afd41d16ea8e35628b00bd8e094194b892e551ba2b39fffaf16e67ece937ade136fe03286fef59718a76fc83081a7cb1dd2f8a7efa811a992e87

Download Submit
\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cvcvsdf.exe
MD5
800b9d7f3a47c5a18da78cb6a54f90be

SHA1
67c825ca6d8f430fdfc4cbca78c442600db7ccf0

SHA256
e6edf54375a14314aa44db9fe8cdd48368338e7ed873f25ba2a6a5ff4381d233

SHA512
3f36217fc2e0afd41d16ea8e35628b00bd8e094194b892e551ba2b39fffaf16e67ece937ade136fe03286fef59718a76fc83081a7cb1dd2f8a7efa811a992e87

Download Submit
\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cvcvsdf.exe
MD5
800b9d7f3a47c5a18da78cb6a54f90be

SHA1
67c825ca6d8f430fdfc4cbca78c442600db7ccf0

SHA256
e6edf54375a14314aa44db9fe8cdd48368338e7ed873f25ba2a6a5ff4381d233

SHA512
3f36217fc2e0afd41d16ea8e35628b00bd8e094194b892e551ba2b39fffaf16e67ece937ade136fe03286fef59718a76fc83081a7cb1dd2f8a7efa811a992e87

Download Submit
\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cvcvsdf.exe
MD5
800b9d7f3a47c5a18da78cb6a54f90be

SHA1
67c825ca6d8f430fdfc4cbca78c442600db7ccf0

SHA256
e6edf54375a14314aa44db9fe8cdd48368338e7ed873f25ba2a6a5ff4381d233

SHA512
3f36217fc2e0afd41d16ea8e35628b00bd8e094194b892e551ba2b39fffaf16e67ece937ade136fe03286fef59718a76fc83081a7cb1dd2f8a7efa811a992e87

Download Submit
memory/768-14-0x0000000000400000-0x00000000004B8000-memory.dmp

Filesize
736KB

Download
memory/768-15-0x00000000004B67A0-mapping.dmp

Download
memory/768-18-0x0000000000400000-0x00000000004B8000-memory.dmp

Filesize
736KB

Download
memory/768-19-0x0000000000240000-0x0000000000241000-memory.dmp

Filesize
4KB

Download
memory/1340-4-0x0000000076691000-0x0000000076693000-memory.dmp

Filesize
8KB

Download
memory/1996-7-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads