darkcomet | 6cd21bf6382590e04c706acb435ed2e386a88688b38b90e62db4b373c4aa8fde

General

Target

6cd21bf6382590e04c706acb435ed2e386a88688b38b90e62db4b373c4aa8fde.exe
Size

658KB
MD5

f7a9d152cbf9106561019c15d5cb096a
SHA1

634095863cca6cb0acdc88ddae4d22fb5946d44c
SHA256

6cd21bf6382590e04c706acb435ed2e386a88688b38b90e62db4b373c4aa8fde
SHA512

901044df24e0fd3d4743e7825141d3d46f0afca5a88e151c656aa85d750b2e6d4ffabee0171c99c320fcd2896cebf629dc40b9f47b3cce8f6bec3c31b9f56615

Score

10^/10

darkcomet junior_sazan persistence rat trojan

Malware Config

Extracted

Family

darkcomet

Botnet

Junior_Sazan

C2

127.0.0.1:1604

Mutex

DCMIN_MUTEX-E86NVH9

Attributes

InstallPath
DCSCMIN\IMDCSC.exe
gencode
sGjswh3WfdnG
install
true
offline_keylogger
true
persistence
false
reg_key
Windows Defender

Signatures

Darkcomet
DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
trojan rat darkcomet

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1004

Modify Registry

T1112

Processes:

6cd21bf6382590e04c706acb435ed2e386a88688b38b90e62db4b373c4aa8fde.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Users\\Admin\\Documents\\DCSCMIN\\IMDCSC.exe"	6cd21bf6382590e04c706acb435ed2e386a88688b38b90e62db4b373c4aa8fde.exe

Executes dropped EXE 1 IoCs

Processes:

IMDCSC.exe

pid process

1200 IMDCSC.exe

pid	process
1200	IMDCSC.exe

Loads dropped DLL 2 IoCs

Processes:

6cd21bf6382590e04c706acb435ed2e386a88688b38b90e62db4b373c4aa8fde.exe

pid	process
1820	6cd21bf6382590e04c706acb435ed2e386a88688b38b90e62db4b373c4aa8fde.exe
1820	6cd21bf6382590e04c706acb435ed2e386a88688b38b90e62db4b373c4aa8fde.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

6cd21bf6382590e04c706acb435ed2e386a88688b38b90e62db4b373c4aa8fde.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Windows\CurrentVersion\Run\Windows Defender = "C:\\Users\\Admin\\Documents\\DCSCMIN\\IMDCSC.exe"	6cd21bf6382590e04c706acb435ed2e386a88688b38b90e62db4b373c4aa8fde.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 46 IoCs

Processes:

6cd21bf6382590e04c706acb435ed2e386a88688b38b90e62db4b373c4aa8fde.exeIMDCSC.exe

description	pid	process
Token: SeIncreaseQuotaPrivilege	1820	6cd21bf6382590e04c706acb435ed2e386a88688b38b90e62db4b373c4aa8fde.exe
Token: SeSecurityPrivilege	1820	6cd21bf6382590e04c706acb435ed2e386a88688b38b90e62db4b373c4aa8fde.exe
Token: SeTakeOwnershipPrivilege	1820	6cd21bf6382590e04c706acb435ed2e386a88688b38b90e62db4b373c4aa8fde.exe
Token: SeLoadDriverPrivilege	1820	6cd21bf6382590e04c706acb435ed2e386a88688b38b90e62db4b373c4aa8fde.exe
Token: SeSystemProfilePrivilege	1820	6cd21bf6382590e04c706acb435ed2e386a88688b38b90e62db4b373c4aa8fde.exe
Token: SeSystemtimePrivilege	1820	6cd21bf6382590e04c706acb435ed2e386a88688b38b90e62db4b373c4aa8fde.exe
Token: SeProfSingleProcessPrivilege	1820	6cd21bf6382590e04c706acb435ed2e386a88688b38b90e62db4b373c4aa8fde.exe
Token: SeIncBasePriorityPrivilege	1820	6cd21bf6382590e04c706acb435ed2e386a88688b38b90e62db4b373c4aa8fde.exe
Token: SeCreatePagefilePrivilege	1820	6cd21bf6382590e04c706acb435ed2e386a88688b38b90e62db4b373c4aa8fde.exe
Token: SeBackupPrivilege	1820	6cd21bf6382590e04c706acb435ed2e386a88688b38b90e62db4b373c4aa8fde.exe
Token: SeRestorePrivilege	1820	6cd21bf6382590e04c706acb435ed2e386a88688b38b90e62db4b373c4aa8fde.exe
Token: SeShutdownPrivilege	1820	6cd21bf6382590e04c706acb435ed2e386a88688b38b90e62db4b373c4aa8fde.exe
Token: SeDebugPrivilege	1820	6cd21bf6382590e04c706acb435ed2e386a88688b38b90e62db4b373c4aa8fde.exe
Token: SeSystemEnvironmentPrivilege	1820	6cd21bf6382590e04c706acb435ed2e386a88688b38b90e62db4b373c4aa8fde.exe
Token: SeChangeNotifyPrivilege	1820	6cd21bf6382590e04c706acb435ed2e386a88688b38b90e62db4b373c4aa8fde.exe
Token: SeRemoteShutdownPrivilege	1820	6cd21bf6382590e04c706acb435ed2e386a88688b38b90e62db4b373c4aa8fde.exe
Token: SeUndockPrivilege	1820	6cd21bf6382590e04c706acb435ed2e386a88688b38b90e62db4b373c4aa8fde.exe
Token: SeManageVolumePrivilege	1820	6cd21bf6382590e04c706acb435ed2e386a88688b38b90e62db4b373c4aa8fde.exe
Token: SeImpersonatePrivilege	1820	6cd21bf6382590e04c706acb435ed2e386a88688b38b90e62db4b373c4aa8fde.exe
Token: SeCreateGlobalPrivilege	1820	6cd21bf6382590e04c706acb435ed2e386a88688b38b90e62db4b373c4aa8fde.exe
Token: 33	1820	6cd21bf6382590e04c706acb435ed2e386a88688b38b90e62db4b373c4aa8fde.exe
Token: 34	1820	6cd21bf6382590e04c706acb435ed2e386a88688b38b90e62db4b373c4aa8fde.exe
Token: 35	1820	6cd21bf6382590e04c706acb435ed2e386a88688b38b90e62db4b373c4aa8fde.exe
Token: SeIncreaseQuotaPrivilege	1200	IMDCSC.exe
Token: SeSecurityPrivilege	1200	IMDCSC.exe
Token: SeTakeOwnershipPrivilege	1200	IMDCSC.exe
Token: SeLoadDriverPrivilege	1200	IMDCSC.exe
Token: SeSystemProfilePrivilege	1200	IMDCSC.exe
Token: SeSystemtimePrivilege	1200	IMDCSC.exe
Token: SeProfSingleProcessPrivilege	1200	IMDCSC.exe
Token: SeIncBasePriorityPrivilege	1200	IMDCSC.exe
Token: SeCreatePagefilePrivilege	1200	IMDCSC.exe
Token: SeBackupPrivilege	1200	IMDCSC.exe
Token: SeRestorePrivilege	1200	IMDCSC.exe
Token: SeShutdownPrivilege	1200	IMDCSC.exe
Token: SeDebugPrivilege	1200	IMDCSC.exe
Token: SeSystemEnvironmentPrivilege	1200	IMDCSC.exe
Token: SeChangeNotifyPrivilege	1200	IMDCSC.exe
Token: SeRemoteShutdownPrivilege	1200	IMDCSC.exe
Token: SeUndockPrivilege	1200	IMDCSC.exe
Token: SeManageVolumePrivilege	1200	IMDCSC.exe
Token: SeImpersonatePrivilege	1200	IMDCSC.exe
Token: SeCreateGlobalPrivilege	1200	IMDCSC.exe
Token: 33	1200	IMDCSC.exe
Token: 34	1200	IMDCSC.exe
Token: 35	1200	IMDCSC.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

IMDCSC.exe

pid process

1200 IMDCSC.exe

pid	process
1200	IMDCSC.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

6cd21bf6382590e04c706acb435ed2e386a88688b38b90e62db4b373c4aa8fde.exe

description	pid	process	target process
PID 1820 wrote to memory of 1200	1820	6cd21bf6382590e04c706acb435ed2e386a88688b38b90e62db4b373c4aa8fde.exe	IMDCSC.exe
PID 1820 wrote to memory of 1200	1820	6cd21bf6382590e04c706acb435ed2e386a88688b38b90e62db4b373c4aa8fde.exe	IMDCSC.exe
PID 1820 wrote to memory of 1200	1820	6cd21bf6382590e04c706acb435ed2e386a88688b38b90e62db4b373c4aa8fde.exe	IMDCSC.exe
PID 1820 wrote to memory of 1200	1820	6cd21bf6382590e04c706acb435ed2e386a88688b38b90e62db4b373c4aa8fde.exe	IMDCSC.exe

C:\Users\Admin\AppData\Local\Temp\6cd21bf6382590e04c706acb435ed2e386a88688b38b90e62db4b373c4aa8fde.exe
"C:\Users\Admin\AppData\Local\Temp\6cd21bf6382590e04c706acb435ed2e386a88688b38b90e62db4b373c4aa8fde.exe"
1⤵
- Modifies WinLogon for persistence
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1820
- C:\Users\Admin\Documents\DCSCMIN\IMDCSC.exe
  "C:\Users\Admin\Documents\DCSCMIN\IMDCSC.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:1200

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

Winlogon Helper DLL

Privilege Escalation

Defense Evasion

Modify Registry

2

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\Documents\DCSCMIN\IMDCSC.exe

MD5
f7a9d152cbf9106561019c15d5cb096a

SHA1
634095863cca6cb0acdc88ddae4d22fb5946d44c

SHA256
6cd21bf6382590e04c706acb435ed2e386a88688b38b90e62db4b373c4aa8fde

SHA512
901044df24e0fd3d4743e7825141d3d46f0afca5a88e151c656aa85d750b2e6d4ffabee0171c99c320fcd2896cebf629dc40b9f47b3cce8f6bec3c31b9f56615

Download Submit
C:\Users\Admin\Documents\DCSCMIN\IMDCSC.exe

MD5
f7a9d152cbf9106561019c15d5cb096a

SHA1
634095863cca6cb0acdc88ddae4d22fb5946d44c

SHA256
6cd21bf6382590e04c706acb435ed2e386a88688b38b90e62db4b373c4aa8fde

SHA512
901044df24e0fd3d4743e7825141d3d46f0afca5a88e151c656aa85d750b2e6d4ffabee0171c99c320fcd2896cebf629dc40b9f47b3cce8f6bec3c31b9f56615

Download Submit
\Users\Admin\Documents\DCSCMIN\IMDCSC.exe

MD5
f7a9d152cbf9106561019c15d5cb096a

SHA1
634095863cca6cb0acdc88ddae4d22fb5946d44c

SHA256
6cd21bf6382590e04c706acb435ed2e386a88688b38b90e62db4b373c4aa8fde

SHA512
901044df24e0fd3d4743e7825141d3d46f0afca5a88e151c656aa85d750b2e6d4ffabee0171c99c320fcd2896cebf629dc40b9f47b3cce8f6bec3c31b9f56615

Download Submit
\Users\Admin\Documents\DCSCMIN\IMDCSC.exe

MD5
f7a9d152cbf9106561019c15d5cb096a

SHA1
634095863cca6cb0acdc88ddae4d22fb5946d44c

SHA256
6cd21bf6382590e04c706acb435ed2e386a88688b38b90e62db4b373c4aa8fde

SHA512
901044df24e0fd3d4743e7825141d3d46f0afca5a88e151c656aa85d750b2e6d4ffabee0171c99c320fcd2896cebf629dc40b9f47b3cce8f6bec3c31b9f56615

Download Submit
memory/1200-64-0x0000000000000000-mapping.dmp

Download
memory/1200-68-0x00000000002C0000-0x00000000002C1000-memory.dmp

Filesize
4KB

Download
memory/1820-60-0x0000000076641000-0x0000000076643000-memory.dmp

Filesize
8KB

Download
memory/1820-61-0x00000000002D0000-0x00000000002D1000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads