darkcomet | e8037ba03db7ab77f623de243e19284af0dcc8e2d042e3bf7eba810066fae738

General

Target

e8037ba03db7ab77f623de243e19284af0dcc8e2d042e3bf7eba810066fae738.exe
Size

660KB
MD5

a5752f27ef2b3f17423ce9bb1c4aca39
SHA1

74316ef1040d4225fb16bb79749bb42eea8636b1
SHA256

e8037ba03db7ab77f623de243e19284af0dcc8e2d042e3bf7eba810066fae738
SHA512

80eeeb01a1e5087d5ea4fe50278ee91819d24e90650b1f3994f40bc06d01dd747ae339aaf9c7ac0acf1ef0acba8fbaa28421058441f15eea929a8a719e44905b

Score

10^/10

darkcomet guest16_min persistence rat trojan

Malware Config

Extracted

Family

darkcomet

Botnet

Guest16_min

C2

127.0.0.1:1604

Mutex

DCMIN_MUTEX-TDTH15Z

Attributes

InstallPath
DCSCMIN\IMDCSC.exe
gencode
7AF6lNtA1lPw
install
true
offline_keylogger
true
persistence
false
reg_key
DarkComet RAT

Signatures

Darkcomet
DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
trojan rat darkcomet

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1004

Modify Registry

T1112

Processes:

e8037ba03db7ab77f623de243e19284af0dcc8e2d042e3bf7eba810066fae738.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Users\\Admin\\Documents\\DCSCMIN\\IMDCSC.exe"	e8037ba03db7ab77f623de243e19284af0dcc8e2d042e3bf7eba810066fae738.exe

Executes dropped EXE 1 IoCs

Processes:

IMDCSC.exe

pid process

736 IMDCSC.exe

pid	process
736	IMDCSC.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

e8037ba03db7ab77f623de243e19284af0dcc8e2d042e3bf7eba810066fae738.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Windows\CurrentVersion\Run\DarkComet RAT = "C:\\Users\\Admin\\Documents\\DCSCMIN\\IMDCSC.exe"	e8037ba03db7ab77f623de243e19284af0dcc8e2d042e3bf7eba810066fae738.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 48 IoCs

Processes:

e8037ba03db7ab77f623de243e19284af0dcc8e2d042e3bf7eba810066fae738.exeIMDCSC.exe

description	pid	process
Token: SeIncreaseQuotaPrivilege	1808	e8037ba03db7ab77f623de243e19284af0dcc8e2d042e3bf7eba810066fae738.exe
Token: SeSecurityPrivilege	1808	e8037ba03db7ab77f623de243e19284af0dcc8e2d042e3bf7eba810066fae738.exe
Token: SeTakeOwnershipPrivilege	1808	e8037ba03db7ab77f623de243e19284af0dcc8e2d042e3bf7eba810066fae738.exe
Token: SeLoadDriverPrivilege	1808	e8037ba03db7ab77f623de243e19284af0dcc8e2d042e3bf7eba810066fae738.exe
Token: SeSystemProfilePrivilege	1808	e8037ba03db7ab77f623de243e19284af0dcc8e2d042e3bf7eba810066fae738.exe
Token: SeSystemtimePrivilege	1808	e8037ba03db7ab77f623de243e19284af0dcc8e2d042e3bf7eba810066fae738.exe
Token: SeProfSingleProcessPrivilege	1808	e8037ba03db7ab77f623de243e19284af0dcc8e2d042e3bf7eba810066fae738.exe
Token: SeIncBasePriorityPrivilege	1808	e8037ba03db7ab77f623de243e19284af0dcc8e2d042e3bf7eba810066fae738.exe
Token: SeCreatePagefilePrivilege	1808	e8037ba03db7ab77f623de243e19284af0dcc8e2d042e3bf7eba810066fae738.exe
Token: SeBackupPrivilege	1808	e8037ba03db7ab77f623de243e19284af0dcc8e2d042e3bf7eba810066fae738.exe
Token: SeRestorePrivilege	1808	e8037ba03db7ab77f623de243e19284af0dcc8e2d042e3bf7eba810066fae738.exe
Token: SeShutdownPrivilege	1808	e8037ba03db7ab77f623de243e19284af0dcc8e2d042e3bf7eba810066fae738.exe
Token: SeDebugPrivilege	1808	e8037ba03db7ab77f623de243e19284af0dcc8e2d042e3bf7eba810066fae738.exe
Token: SeSystemEnvironmentPrivilege	1808	e8037ba03db7ab77f623de243e19284af0dcc8e2d042e3bf7eba810066fae738.exe
Token: SeChangeNotifyPrivilege	1808	e8037ba03db7ab77f623de243e19284af0dcc8e2d042e3bf7eba810066fae738.exe
Token: SeRemoteShutdownPrivilege	1808	e8037ba03db7ab77f623de243e19284af0dcc8e2d042e3bf7eba810066fae738.exe
Token: SeUndockPrivilege	1808	e8037ba03db7ab77f623de243e19284af0dcc8e2d042e3bf7eba810066fae738.exe
Token: SeManageVolumePrivilege	1808	e8037ba03db7ab77f623de243e19284af0dcc8e2d042e3bf7eba810066fae738.exe
Token: SeImpersonatePrivilege	1808	e8037ba03db7ab77f623de243e19284af0dcc8e2d042e3bf7eba810066fae738.exe
Token: SeCreateGlobalPrivilege	1808	e8037ba03db7ab77f623de243e19284af0dcc8e2d042e3bf7eba810066fae738.exe
Token: 33	1808	e8037ba03db7ab77f623de243e19284af0dcc8e2d042e3bf7eba810066fae738.exe
Token: 34	1808	e8037ba03db7ab77f623de243e19284af0dcc8e2d042e3bf7eba810066fae738.exe
Token: 35	1808	e8037ba03db7ab77f623de243e19284af0dcc8e2d042e3bf7eba810066fae738.exe
Token: 36	1808	e8037ba03db7ab77f623de243e19284af0dcc8e2d042e3bf7eba810066fae738.exe
Token: SeIncreaseQuotaPrivilege	736	IMDCSC.exe
Token: SeSecurityPrivilege	736	IMDCSC.exe
Token: SeTakeOwnershipPrivilege	736	IMDCSC.exe
Token: SeLoadDriverPrivilege	736	IMDCSC.exe
Token: SeSystemProfilePrivilege	736	IMDCSC.exe
Token: SeSystemtimePrivilege	736	IMDCSC.exe
Token: SeProfSingleProcessPrivilege	736	IMDCSC.exe
Token: SeIncBasePriorityPrivilege	736	IMDCSC.exe
Token: SeCreatePagefilePrivilege	736	IMDCSC.exe
Token: SeBackupPrivilege	736	IMDCSC.exe
Token: SeRestorePrivilege	736	IMDCSC.exe
Token: SeShutdownPrivilege	736	IMDCSC.exe
Token: SeDebugPrivilege	736	IMDCSC.exe
Token: SeSystemEnvironmentPrivilege	736	IMDCSC.exe
Token: SeChangeNotifyPrivilege	736	IMDCSC.exe
Token: SeRemoteShutdownPrivilege	736	IMDCSC.exe
Token: SeUndockPrivilege	736	IMDCSC.exe
Token: SeManageVolumePrivilege	736	IMDCSC.exe
Token: SeImpersonatePrivilege	736	IMDCSC.exe
Token: SeCreateGlobalPrivilege	736	IMDCSC.exe
Token: 33	736	IMDCSC.exe
Token: 34	736	IMDCSC.exe
Token: 35	736	IMDCSC.exe
Token: 36	736	IMDCSC.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

IMDCSC.exe

pid process

736 IMDCSC.exe

pid	process
736	IMDCSC.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

e8037ba03db7ab77f623de243e19284af0dcc8e2d042e3bf7eba810066fae738.exe

description	pid	process	target process
PID 1808 wrote to memory of 736	1808	e8037ba03db7ab77f623de243e19284af0dcc8e2d042e3bf7eba810066fae738.exe	IMDCSC.exe
PID 1808 wrote to memory of 736	1808	e8037ba03db7ab77f623de243e19284af0dcc8e2d042e3bf7eba810066fae738.exe	IMDCSC.exe
PID 1808 wrote to memory of 736	1808	e8037ba03db7ab77f623de243e19284af0dcc8e2d042e3bf7eba810066fae738.exe	IMDCSC.exe

C:\Users\Admin\AppData\Local\Temp\e8037ba03db7ab77f623de243e19284af0dcc8e2d042e3bf7eba810066fae738.exe
"C:\Users\Admin\AppData\Local\Temp\e8037ba03db7ab77f623de243e19284af0dcc8e2d042e3bf7eba810066fae738.exe"
1⤵
- Modifies WinLogon for persistence
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1808

C:\Users\Admin\Documents\DCSCMIN\IMDCSC.exe
"C:\Users\Admin\Documents\DCSCMIN\IMDCSC.exe"
2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:736

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

Winlogon Helper DLL

Privilege Escalation

Defense Evasion

Modify Registry

2

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\Documents\DCSCMIN\IMDCSC.exe
MD5
a5752f27ef2b3f17423ce9bb1c4aca39

SHA1
74316ef1040d4225fb16bb79749bb42eea8636b1

SHA256
e8037ba03db7ab77f623de243e19284af0dcc8e2d042e3bf7eba810066fae738

SHA512
80eeeb01a1e5087d5ea4fe50278ee91819d24e90650b1f3994f40bc06d01dd747ae339aaf9c7ac0acf1ef0acba8fbaa28421058441f15eea929a8a719e44905b

Download Submit
C:\Users\Admin\Documents\DCSCMIN\IMDCSC.exe
MD5
a5752f27ef2b3f17423ce9bb1c4aca39

SHA1
74316ef1040d4225fb16bb79749bb42eea8636b1

SHA256
e8037ba03db7ab77f623de243e19284af0dcc8e2d042e3bf7eba810066fae738

SHA512
80eeeb01a1e5087d5ea4fe50278ee91819d24e90650b1f3994f40bc06d01dd747ae339aaf9c7ac0acf1ef0acba8fbaa28421058441f15eea929a8a719e44905b

Download Submit
memory/736-115-0x0000000000000000-mapping.dmp

Download
memory/736-118-0x0000000000550000-0x000000000069A000-memory.dmp

Filesize
1.3MB

Download
memory/1808-114-0x0000000000740000-0x0000000000741000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads