darkcomet | e8037ba03db7ab77f623de243e19284af0dcc8e2d042e3bf7eba810066fae738

General

Target

e8037ba03db7ab77f623de243e19284af0dcc8e2d042e3bf7eba810066fae738.exe
Size

660KB
MD5

a5752f27ef2b3f17423ce9bb1c4aca39
SHA1

74316ef1040d4225fb16bb79749bb42eea8636b1
SHA256

e8037ba03db7ab77f623de243e19284af0dcc8e2d042e3bf7eba810066fae738
SHA512

80eeeb01a1e5087d5ea4fe50278ee91819d24e90650b1f3994f40bc06d01dd747ae339aaf9c7ac0acf1ef0acba8fbaa28421058441f15eea929a8a719e44905b

Score

10^/10

darkcomet guest16_min persistence rat trojan

Malware Config

Extracted

Family

darkcomet

Botnet

Guest16_min

C2

127.0.0.1:1604

Mutex

DCMIN_MUTEX-TDTH15Z

Attributes

InstallPath
DCSCMIN\IMDCSC.exe
gencode
7AF6lNtA1lPw
install
true
offline_keylogger
true
persistence
false
reg_key
DarkComet RAT

Signatures

Darkcomet
DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
trojan rat darkcomet

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1004

Modify Registry

T1112

Processes:

e8037ba03db7ab77f623de243e19284af0dcc8e2d042e3bf7eba810066fae738.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Users\\Admin\\Documents\\DCSCMIN\\IMDCSC.exe"	e8037ba03db7ab77f623de243e19284af0dcc8e2d042e3bf7eba810066fae738.exe

Executes dropped EXE 1 IoCs

Processes:

IMDCSC.exe

pid process

1972 IMDCSC.exe

pid	process
1972	IMDCSC.exe

Loads dropped DLL 2 IoCs

Processes:

e8037ba03db7ab77f623de243e19284af0dcc8e2d042e3bf7eba810066fae738.exe

pid	process
1748	e8037ba03db7ab77f623de243e19284af0dcc8e2d042e3bf7eba810066fae738.exe
1748	e8037ba03db7ab77f623de243e19284af0dcc8e2d042e3bf7eba810066fae738.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

e8037ba03db7ab77f623de243e19284af0dcc8e2d042e3bf7eba810066fae738.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Windows\CurrentVersion\Run\DarkComet RAT = "C:\\Users\\Admin\\Documents\\DCSCMIN\\IMDCSC.exe"	e8037ba03db7ab77f623de243e19284af0dcc8e2d042e3bf7eba810066fae738.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 46 IoCs

Processes:

e8037ba03db7ab77f623de243e19284af0dcc8e2d042e3bf7eba810066fae738.exeIMDCSC.exe

description	pid	process
Token: SeIncreaseQuotaPrivilege	1748	e8037ba03db7ab77f623de243e19284af0dcc8e2d042e3bf7eba810066fae738.exe
Token: SeSecurityPrivilege	1748	e8037ba03db7ab77f623de243e19284af0dcc8e2d042e3bf7eba810066fae738.exe
Token: SeTakeOwnershipPrivilege	1748	e8037ba03db7ab77f623de243e19284af0dcc8e2d042e3bf7eba810066fae738.exe
Token: SeLoadDriverPrivilege	1748	e8037ba03db7ab77f623de243e19284af0dcc8e2d042e3bf7eba810066fae738.exe
Token: SeSystemProfilePrivilege	1748	e8037ba03db7ab77f623de243e19284af0dcc8e2d042e3bf7eba810066fae738.exe
Token: SeSystemtimePrivilege	1748	e8037ba03db7ab77f623de243e19284af0dcc8e2d042e3bf7eba810066fae738.exe
Token: SeProfSingleProcessPrivilege	1748	e8037ba03db7ab77f623de243e19284af0dcc8e2d042e3bf7eba810066fae738.exe
Token: SeIncBasePriorityPrivilege	1748	e8037ba03db7ab77f623de243e19284af0dcc8e2d042e3bf7eba810066fae738.exe
Token: SeCreatePagefilePrivilege	1748	e8037ba03db7ab77f623de243e19284af0dcc8e2d042e3bf7eba810066fae738.exe
Token: SeBackupPrivilege	1748	e8037ba03db7ab77f623de243e19284af0dcc8e2d042e3bf7eba810066fae738.exe
Token: SeRestorePrivilege	1748	e8037ba03db7ab77f623de243e19284af0dcc8e2d042e3bf7eba810066fae738.exe
Token: SeShutdownPrivilege	1748	e8037ba03db7ab77f623de243e19284af0dcc8e2d042e3bf7eba810066fae738.exe
Token: SeDebugPrivilege	1748	e8037ba03db7ab77f623de243e19284af0dcc8e2d042e3bf7eba810066fae738.exe
Token: SeSystemEnvironmentPrivilege	1748	e8037ba03db7ab77f623de243e19284af0dcc8e2d042e3bf7eba810066fae738.exe
Token: SeChangeNotifyPrivilege	1748	e8037ba03db7ab77f623de243e19284af0dcc8e2d042e3bf7eba810066fae738.exe
Token: SeRemoteShutdownPrivilege	1748	e8037ba03db7ab77f623de243e19284af0dcc8e2d042e3bf7eba810066fae738.exe
Token: SeUndockPrivilege	1748	e8037ba03db7ab77f623de243e19284af0dcc8e2d042e3bf7eba810066fae738.exe
Token: SeManageVolumePrivilege	1748	e8037ba03db7ab77f623de243e19284af0dcc8e2d042e3bf7eba810066fae738.exe
Token: SeImpersonatePrivilege	1748	e8037ba03db7ab77f623de243e19284af0dcc8e2d042e3bf7eba810066fae738.exe
Token: SeCreateGlobalPrivilege	1748	e8037ba03db7ab77f623de243e19284af0dcc8e2d042e3bf7eba810066fae738.exe
Token: 33	1748	e8037ba03db7ab77f623de243e19284af0dcc8e2d042e3bf7eba810066fae738.exe
Token: 34	1748	e8037ba03db7ab77f623de243e19284af0dcc8e2d042e3bf7eba810066fae738.exe
Token: 35	1748	e8037ba03db7ab77f623de243e19284af0dcc8e2d042e3bf7eba810066fae738.exe
Token: SeIncreaseQuotaPrivilege	1972	IMDCSC.exe
Token: SeSecurityPrivilege	1972	IMDCSC.exe
Token: SeTakeOwnershipPrivilege	1972	IMDCSC.exe
Token: SeLoadDriverPrivilege	1972	IMDCSC.exe
Token: SeSystemProfilePrivilege	1972	IMDCSC.exe
Token: SeSystemtimePrivilege	1972	IMDCSC.exe
Token: SeProfSingleProcessPrivilege	1972	IMDCSC.exe
Token: SeIncBasePriorityPrivilege	1972	IMDCSC.exe
Token: SeCreatePagefilePrivilege	1972	IMDCSC.exe
Token: SeBackupPrivilege	1972	IMDCSC.exe
Token: SeRestorePrivilege	1972	IMDCSC.exe
Token: SeShutdownPrivilege	1972	IMDCSC.exe
Token: SeDebugPrivilege	1972	IMDCSC.exe
Token: SeSystemEnvironmentPrivilege	1972	IMDCSC.exe
Token: SeChangeNotifyPrivilege	1972	IMDCSC.exe
Token: SeRemoteShutdownPrivilege	1972	IMDCSC.exe
Token: SeUndockPrivilege	1972	IMDCSC.exe
Token: SeManageVolumePrivilege	1972	IMDCSC.exe
Token: SeImpersonatePrivilege	1972	IMDCSC.exe
Token: SeCreateGlobalPrivilege	1972	IMDCSC.exe
Token: 33	1972	IMDCSC.exe
Token: 34	1972	IMDCSC.exe
Token: 35	1972	IMDCSC.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

IMDCSC.exe

pid process

1972 IMDCSC.exe

pid	process
1972	IMDCSC.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

e8037ba03db7ab77f623de243e19284af0dcc8e2d042e3bf7eba810066fae738.exe

description	pid	process	target process
PID 1748 wrote to memory of 1972	1748	e8037ba03db7ab77f623de243e19284af0dcc8e2d042e3bf7eba810066fae738.exe	IMDCSC.exe
PID 1748 wrote to memory of 1972	1748	e8037ba03db7ab77f623de243e19284af0dcc8e2d042e3bf7eba810066fae738.exe	IMDCSC.exe
PID 1748 wrote to memory of 1972	1748	e8037ba03db7ab77f623de243e19284af0dcc8e2d042e3bf7eba810066fae738.exe	IMDCSC.exe
PID 1748 wrote to memory of 1972	1748	e8037ba03db7ab77f623de243e19284af0dcc8e2d042e3bf7eba810066fae738.exe	IMDCSC.exe

C:\Users\Admin\AppData\Local\Temp\e8037ba03db7ab77f623de243e19284af0dcc8e2d042e3bf7eba810066fae738.exe
"C:\Users\Admin\AppData\Local\Temp\e8037ba03db7ab77f623de243e19284af0dcc8e2d042e3bf7eba810066fae738.exe"
1⤵
- Modifies WinLogon for persistence
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1748

C:\Users\Admin\Documents\DCSCMIN\IMDCSC.exe
"C:\Users\Admin\Documents\DCSCMIN\IMDCSC.exe"
2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1972

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Winlogon Helper DLL

1

T1004

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

2

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\Documents\DCSCMIN\IMDCSC.exe
MD5
a5752f27ef2b3f17423ce9bb1c4aca39

SHA1
74316ef1040d4225fb16bb79749bb42eea8636b1

SHA256
e8037ba03db7ab77f623de243e19284af0dcc8e2d042e3bf7eba810066fae738

SHA512
80eeeb01a1e5087d5ea4fe50278ee91819d24e90650b1f3994f40bc06d01dd747ae339aaf9c7ac0acf1ef0acba8fbaa28421058441f15eea929a8a719e44905b

Download Submit
\Users\Admin\Documents\DCSCMIN\IMDCSC.exe
MD5
a5752f27ef2b3f17423ce9bb1c4aca39

SHA1
74316ef1040d4225fb16bb79749bb42eea8636b1

SHA256
e8037ba03db7ab77f623de243e19284af0dcc8e2d042e3bf7eba810066fae738

SHA512
80eeeb01a1e5087d5ea4fe50278ee91819d24e90650b1f3994f40bc06d01dd747ae339aaf9c7ac0acf1ef0acba8fbaa28421058441f15eea929a8a719e44905b

Download Submit
\Users\Admin\Documents\DCSCMIN\IMDCSC.exe
MD5
a5752f27ef2b3f17423ce9bb1c4aca39

SHA1
74316ef1040d4225fb16bb79749bb42eea8636b1

SHA256
e8037ba03db7ab77f623de243e19284af0dcc8e2d042e3bf7eba810066fae738

SHA512
80eeeb01a1e5087d5ea4fe50278ee91819d24e90650b1f3994f40bc06d01dd747ae339aaf9c7ac0acf1ef0acba8fbaa28421058441f15eea929a8a719e44905b

Download Submit
memory/1748-60-0x00000000757E1000-0x00000000757E3000-memory.dmp

Filesize
8KB

Download
memory/1748-66-0x0000000000250000-0x0000000000251000-memory.dmp

Filesize
4KB

Download
memory/1972-63-0x0000000000000000-mapping.dmp

Download
memory/1972-67-0x0000000000240000-0x0000000000241000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads