darkcomet | e9371a8c9c83ad906a9c2c4f363a5ed6b7804c4a1ab229b2a3acc0c2ea5e77f5

General

Target

e9371a8c9c83ad906a9c2c4f363a5ed6b7804c4a1ab229b2a3acc0c2ea5e77f5.exe
Size

524KB
MD5

cce1ab2f6d29d6836051157b6e6c94da
SHA1

9b75c57dc5d8eb679a18795c40e8f676319af86a
SHA256

e9371a8c9c83ad906a9c2c4f363a5ed6b7804c4a1ab229b2a3acc0c2ea5e77f5
SHA512

4b1958aa1bfd4833dfcd85fc46b6035d5681d8fc51e81da4ecb4239264799f48118a32a717a1dcd2b1c8e0195f797edfb3504c25c00dcce2db0456684c02b95c

Score

10^/10

darkcomet persistence rat trojan

Malware Config

Signatures

Darkcomet
DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
trojan rat darkcomet
Executes dropped EXE 1 IoCs

Processes:

winlogon.exe

pid process

1768 winlogon.exe

pid	process
1768	winlogon.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

e9371a8c9c83ad906a9c2c4f363a5ed6b7804c4a1ab229b2a3acc0c2ea5e77f5.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Windows\CurrentVersion\Run\Windows Live = "C:\\Users\\Admin\\AppData\\Local\\Temp\\e9371a8c9c83ad906a9c2c4f363a5ed6b7804c4a1ab229b2a3acc0c2ea5e77f5.exe"	e9371a8c9c83ad906a9c2c4f363a5ed6b7804c4a1ab229b2a3acc0c2ea5e77f5.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

e9371a8c9c83ad906a9c2c4f363a5ed6b7804c4a1ab229b2a3acc0c2ea5e77f5.exe

description	pid	process	target process
PID 852 set thread context of 1768	852	e9371a8c9c83ad906a9c2c4f363a5ed6b7804c4a1ab229b2a3acc0c2ea5e77f5.exe	winlogon.exe

Suspicious use of AdjustPrivilegeToken 24 IoCs

Processes:

winlogon.exe

description	pid	process
Token: SeIncreaseQuotaPrivilege	1768	winlogon.exe
Token: SeSecurityPrivilege	1768	winlogon.exe
Token: SeTakeOwnershipPrivilege	1768	winlogon.exe
Token: SeLoadDriverPrivilege	1768	winlogon.exe
Token: SeSystemProfilePrivilege	1768	winlogon.exe
Token: SeSystemtimePrivilege	1768	winlogon.exe
Token: SeProfSingleProcessPrivilege	1768	winlogon.exe
Token: SeIncBasePriorityPrivilege	1768	winlogon.exe
Token: SeCreatePagefilePrivilege	1768	winlogon.exe
Token: SeBackupPrivilege	1768	winlogon.exe
Token: SeRestorePrivilege	1768	winlogon.exe
Token: SeShutdownPrivilege	1768	winlogon.exe
Token: SeDebugPrivilege	1768	winlogon.exe
Token: SeSystemEnvironmentPrivilege	1768	winlogon.exe
Token: SeChangeNotifyPrivilege	1768	winlogon.exe
Token: SeRemoteShutdownPrivilege	1768	winlogon.exe
Token: SeUndockPrivilege	1768	winlogon.exe
Token: SeManageVolumePrivilege	1768	winlogon.exe
Token: SeImpersonatePrivilege	1768	winlogon.exe
Token: SeCreateGlobalPrivilege	1768	winlogon.exe
Token: 33	1768	winlogon.exe
Token: 34	1768	winlogon.exe
Token: 35	1768	winlogon.exe
Token: 36	1768	winlogon.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

winlogon.exe

pid process

1768 winlogon.exe

pid	process
1768	winlogon.exe

Suspicious use of WriteProcessMemory 14 IoCs

Processes:

e9371a8c9c83ad906a9c2c4f363a5ed6b7804c4a1ab229b2a3acc0c2ea5e77f5.exe

description	pid	process	target process
PID 852 wrote to memory of 1768	852	e9371a8c9c83ad906a9c2c4f363a5ed6b7804c4a1ab229b2a3acc0c2ea5e77f5.exe	winlogon.exe
PID 852 wrote to memory of 1768	852	e9371a8c9c83ad906a9c2c4f363a5ed6b7804c4a1ab229b2a3acc0c2ea5e77f5.exe	winlogon.exe
PID 852 wrote to memory of 1768	852	e9371a8c9c83ad906a9c2c4f363a5ed6b7804c4a1ab229b2a3acc0c2ea5e77f5.exe	winlogon.exe
PID 852 wrote to memory of 1768	852	e9371a8c9c83ad906a9c2c4f363a5ed6b7804c4a1ab229b2a3acc0c2ea5e77f5.exe	winlogon.exe
PID 852 wrote to memory of 1768	852	e9371a8c9c83ad906a9c2c4f363a5ed6b7804c4a1ab229b2a3acc0c2ea5e77f5.exe	winlogon.exe
PID 852 wrote to memory of 1768	852	e9371a8c9c83ad906a9c2c4f363a5ed6b7804c4a1ab229b2a3acc0c2ea5e77f5.exe	winlogon.exe
PID 852 wrote to memory of 1768	852	e9371a8c9c83ad906a9c2c4f363a5ed6b7804c4a1ab229b2a3acc0c2ea5e77f5.exe	winlogon.exe
PID 852 wrote to memory of 1768	852	e9371a8c9c83ad906a9c2c4f363a5ed6b7804c4a1ab229b2a3acc0c2ea5e77f5.exe	winlogon.exe
PID 852 wrote to memory of 1768	852	e9371a8c9c83ad906a9c2c4f363a5ed6b7804c4a1ab229b2a3acc0c2ea5e77f5.exe	winlogon.exe
PID 852 wrote to memory of 1768	852	e9371a8c9c83ad906a9c2c4f363a5ed6b7804c4a1ab229b2a3acc0c2ea5e77f5.exe	winlogon.exe
PID 852 wrote to memory of 1768	852	e9371a8c9c83ad906a9c2c4f363a5ed6b7804c4a1ab229b2a3acc0c2ea5e77f5.exe	winlogon.exe
PID 852 wrote to memory of 1768	852	e9371a8c9c83ad906a9c2c4f363a5ed6b7804c4a1ab229b2a3acc0c2ea5e77f5.exe	winlogon.exe
PID 852 wrote to memory of 1768	852	e9371a8c9c83ad906a9c2c4f363a5ed6b7804c4a1ab229b2a3acc0c2ea5e77f5.exe	winlogon.exe
PID 852 wrote to memory of 1768	852	e9371a8c9c83ad906a9c2c4f363a5ed6b7804c4a1ab229b2a3acc0c2ea5e77f5.exe	winlogon.exe

C:\Users\Admin\AppData\Local\Temp\e9371a8c9c83ad906a9c2c4f363a5ed6b7804c4a1ab229b2a3acc0c2ea5e77f5.exe
"C:\Users\Admin\AppData\Local\Temp\e9371a8c9c83ad906a9c2c4f363a5ed6b7804c4a1ab229b2a3acc0c2ea5e77f5.exe"
1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:852

C:\Users\Admin\AppData\Local\Temp\winlogon.exe
C:\Users\Admin\AppData\Local\Temp\winlogon.exe
2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1768

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\winlogon.exe
MD5
dd0ee56841e535a3a3ae7c20c32de9cd

SHA1
fc1ea172fd3c67a00e37f930f7595784fc0d1f84

SHA256
8649df38276968d1417ec064360339610ff644491c87eb8ac2b2e67e7cbe47c9

SHA512
ee6a7982e194a5a24f5bd596d1ad6582defcababa19ea8011ba71ead2ee8945dce9f5af56e47b088c16ca00cb6c7225cc18b9b6f026e623283c0e02f9bed524e

Download Submit
C:\Users\Admin\AppData\Local\Temp\winlogon.exe
MD5
dd0ee56841e535a3a3ae7c20c32de9cd

SHA1
fc1ea172fd3c67a00e37f930f7595784fc0d1f84

SHA256
8649df38276968d1417ec064360339610ff644491c87eb8ac2b2e67e7cbe47c9

SHA512
ee6a7982e194a5a24f5bd596d1ad6582defcababa19ea8011ba71ead2ee8945dce9f5af56e47b088c16ca00cb6c7225cc18b9b6f026e623283c0e02f9bed524e

Download Submit
memory/852-114-0x00000000028B0000-0x00000000028B1000-memory.dmp

Filesize
4KB

Download
memory/1768-115-0x0000000000400000-0x00000000004C3000-memory.dmp

Filesize
780KB

Download
memory/1768-116-0x000000000049F92C-mapping.dmp

Download
memory/1768-120-0x0000000002220000-0x0000000002221000-memory.dmp

Filesize
4KB

Download
memory/1768-119-0x0000000000400000-0x00000000004C3000-memory.dmp

Filesize
780KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads