darkcomet | 78d9b951e8a890aaddc1cc31116708800b3851f4f4c073c72325c26c6e407d2c

General

Target

78d9b951e8a890aaddc1cc31116708800b3851f4f4c073c72325c26c6e407d2c.exe
Size

545KB
MD5

e2c65291f42b8587e4f3bdcfc0c114f0
SHA1

4da09c5b590a278cb38c35c2233ff39d4b4bc788
SHA256

78d9b951e8a890aaddc1cc31116708800b3851f4f4c073c72325c26c6e407d2c
SHA512

6c2398e7646e6670fef030792ea533a271be67b3e995111b33a05faa2a05a288804f6c085f9841aed53366a9586a764ee0aea27a5e0a42efcb746cc3191e437a

Score

10^/10

darkcomet persistence rat trojan upx

Malware Config

Signatures

Darkcomet
DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
trojan rat darkcomet
Executes dropped EXE 2 IoCs

Processes:

msadrh10.exelsasrv.exe

pid process

1632 msadrh10.exe
1452 lsasrv.exe

pid	process
1632	msadrh10.exe
1452	lsasrv.exe

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral1/memory/1260-61-0x0000000000400000-0x00000000004B7000-memory.dmp	upx

Loads dropped DLL 2 IoCs

Processes:

78d9b951e8a890aaddc1cc31116708800b3851f4f4c073c72325c26c6e407d2c.exe

pid	process
788	78d9b951e8a890aaddc1cc31116708800b3851f4f4c073c72325c26c6e407d2c.exe
788	78d9b951e8a890aaddc1cc31116708800b3851f4f4c073c72325c26c6e407d2c.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

msadrh10.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft® Windows® Operating System = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Templates\\msadrh10.exe"	msadrh10.exe

Suspicious use of SetThreadContext 2 IoCs

Processes:

78d9b951e8a890aaddc1cc31116708800b3851f4f4c073c72325c26c6e407d2c.exelsasrv.exe

description	pid	process	target process
PID 788 set thread context of 1260	788	78d9b951e8a890aaddc1cc31116708800b3851f4f4c073c72325c26c6e407d2c.exe	AppLaunch.exe
PID 1452 set thread context of 908	1452	lsasrv.exe	AppLaunch.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

78d9b951e8a890aaddc1cc31116708800b3851f4f4c073c72325c26c6e407d2c.exemsadrh10.exe

pid	process
788	78d9b951e8a890aaddc1cc31116708800b3851f4f4c073c72325c26c6e407d2c.exe
788	78d9b951e8a890aaddc1cc31116708800b3851f4f4c073c72325c26c6e407d2c.exe
788	78d9b951e8a890aaddc1cc31116708800b3851f4f4c073c72325c26c6e407d2c.exe
788	78d9b951e8a890aaddc1cc31116708800b3851f4f4c073c72325c26c6e407d2c.exe
1632	msadrh10.exe
788	78d9b951e8a890aaddc1cc31116708800b3851f4f4c073c72325c26c6e407d2c.exe
788	78d9b951e8a890aaddc1cc31116708800b3851f4f4c073c72325c26c6e407d2c.exe
1632	msadrh10.exe
788	78d9b951e8a890aaddc1cc31116708800b3851f4f4c073c72325c26c6e407d2c.exe
1632	msadrh10.exe
788	78d9b951e8a890aaddc1cc31116708800b3851f4f4c073c72325c26c6e407d2c.exe
1632	msadrh10.exe
788	78d9b951e8a890aaddc1cc31116708800b3851f4f4c073c72325c26c6e407d2c.exe
1632	msadrh10.exe
788	78d9b951e8a890aaddc1cc31116708800b3851f4f4c073c72325c26c6e407d2c.exe
1632	msadrh10.exe
788	78d9b951e8a890aaddc1cc31116708800b3851f4f4c073c72325c26c6e407d2c.exe
1632	msadrh10.exe
788	78d9b951e8a890aaddc1cc31116708800b3851f4f4c073c72325c26c6e407d2c.exe
1632	msadrh10.exe
788	78d9b951e8a890aaddc1cc31116708800b3851f4f4c073c72325c26c6e407d2c.exe
1632	msadrh10.exe
788	78d9b951e8a890aaddc1cc31116708800b3851f4f4c073c72325c26c6e407d2c.exe
1632	msadrh10.exe
788	78d9b951e8a890aaddc1cc31116708800b3851f4f4c073c72325c26c6e407d2c.exe
1632	msadrh10.exe
788	78d9b951e8a890aaddc1cc31116708800b3851f4f4c073c72325c26c6e407d2c.exe
1632	msadrh10.exe
788	78d9b951e8a890aaddc1cc31116708800b3851f4f4c073c72325c26c6e407d2c.exe
1632	msadrh10.exe
788	78d9b951e8a890aaddc1cc31116708800b3851f4f4c073c72325c26c6e407d2c.exe
1632	msadrh10.exe
788	78d9b951e8a890aaddc1cc31116708800b3851f4f4c073c72325c26c6e407d2c.exe
1632	msadrh10.exe
788	78d9b951e8a890aaddc1cc31116708800b3851f4f4c073c72325c26c6e407d2c.exe
1632	msadrh10.exe
788	78d9b951e8a890aaddc1cc31116708800b3851f4f4c073c72325c26c6e407d2c.exe
1632	msadrh10.exe
788	78d9b951e8a890aaddc1cc31116708800b3851f4f4c073c72325c26c6e407d2c.exe
1632	msadrh10.exe
788	78d9b951e8a890aaddc1cc31116708800b3851f4f4c073c72325c26c6e407d2c.exe
1632	msadrh10.exe
788	78d9b951e8a890aaddc1cc31116708800b3851f4f4c073c72325c26c6e407d2c.exe
1632	msadrh10.exe
788	78d9b951e8a890aaddc1cc31116708800b3851f4f4c073c72325c26c6e407d2c.exe
1632	msadrh10.exe
788	78d9b951e8a890aaddc1cc31116708800b3851f4f4c073c72325c26c6e407d2c.exe
1632	msadrh10.exe
788	78d9b951e8a890aaddc1cc31116708800b3851f4f4c073c72325c26c6e407d2c.exe
1632	msadrh10.exe
788	78d9b951e8a890aaddc1cc31116708800b3851f4f4c073c72325c26c6e407d2c.exe
1632	msadrh10.exe
788	78d9b951e8a890aaddc1cc31116708800b3851f4f4c073c72325c26c6e407d2c.exe
1632	msadrh10.exe
788	78d9b951e8a890aaddc1cc31116708800b3851f4f4c073c72325c26c6e407d2c.exe
1632	msadrh10.exe
788	78d9b951e8a890aaddc1cc31116708800b3851f4f4c073c72325c26c6e407d2c.exe
1632	msadrh10.exe
788	78d9b951e8a890aaddc1cc31116708800b3851f4f4c073c72325c26c6e407d2c.exe
1632	msadrh10.exe
788	78d9b951e8a890aaddc1cc31116708800b3851f4f4c073c72325c26c6e407d2c.exe
1632	msadrh10.exe
788	78d9b951e8a890aaddc1cc31116708800b3851f4f4c073c72325c26c6e407d2c.exe
1632	msadrh10.exe

Suspicious use of AdjustPrivilegeToken 49 IoCs

Processes:

78d9b951e8a890aaddc1cc31116708800b3851f4f4c073c72325c26c6e407d2c.exeAppLaunch.exemsadrh10.exelsasrv.exeAppLaunch.exe

description	pid	process
Token: SeDebugPrivilege	788	78d9b951e8a890aaddc1cc31116708800b3851f4f4c073c72325c26c6e407d2c.exe
Token: SeIncreaseQuotaPrivilege	1260	AppLaunch.exe
Token: SeSecurityPrivilege	1260	AppLaunch.exe
Token: SeTakeOwnershipPrivilege	1260	AppLaunch.exe
Token: SeLoadDriverPrivilege	1260	AppLaunch.exe
Token: SeSystemProfilePrivilege	1260	AppLaunch.exe
Token: SeSystemtimePrivilege	1260	AppLaunch.exe
Token: SeProfSingleProcessPrivilege	1260	AppLaunch.exe
Token: SeIncBasePriorityPrivilege	1260	AppLaunch.exe
Token: SeCreatePagefilePrivilege	1260	AppLaunch.exe
Token: SeBackupPrivilege	1260	AppLaunch.exe
Token: SeRestorePrivilege	1260	AppLaunch.exe
Token: SeShutdownPrivilege	1260	AppLaunch.exe
Token: SeDebugPrivilege	1260	AppLaunch.exe
Token: SeSystemEnvironmentPrivilege	1260	AppLaunch.exe
Token: SeChangeNotifyPrivilege	1260	AppLaunch.exe
Token: SeRemoteShutdownPrivilege	1260	AppLaunch.exe
Token: SeUndockPrivilege	1260	AppLaunch.exe
Token: SeManageVolumePrivilege	1260	AppLaunch.exe
Token: SeImpersonatePrivilege	1260	AppLaunch.exe
Token: SeCreateGlobalPrivilege	1260	AppLaunch.exe
Token: 33	1260	AppLaunch.exe
Token: 34	1260	AppLaunch.exe
Token: 35	1260	AppLaunch.exe
Token: SeDebugPrivilege	1632	msadrh10.exe
Token: SeDebugPrivilege	1452	lsasrv.exe
Token: SeIncreaseQuotaPrivilege	908	AppLaunch.exe
Token: SeSecurityPrivilege	908	AppLaunch.exe
Token: SeTakeOwnershipPrivilege	908	AppLaunch.exe
Token: SeLoadDriverPrivilege	908	AppLaunch.exe
Token: SeSystemProfilePrivilege	908	AppLaunch.exe
Token: SeSystemtimePrivilege	908	AppLaunch.exe
Token: SeProfSingleProcessPrivilege	908	AppLaunch.exe
Token: SeIncBasePriorityPrivilege	908	AppLaunch.exe
Token: SeCreatePagefilePrivilege	908	AppLaunch.exe
Token: SeBackupPrivilege	908	AppLaunch.exe
Token: SeRestorePrivilege	908	AppLaunch.exe
Token: SeShutdownPrivilege	908	AppLaunch.exe
Token: SeDebugPrivilege	908	AppLaunch.exe
Token: SeSystemEnvironmentPrivilege	908	AppLaunch.exe
Token: SeChangeNotifyPrivilege	908	AppLaunch.exe
Token: SeRemoteShutdownPrivilege	908	AppLaunch.exe
Token: SeUndockPrivilege	908	AppLaunch.exe
Token: SeManageVolumePrivilege	908	AppLaunch.exe
Token: SeImpersonatePrivilege	908	AppLaunch.exe
Token: SeCreateGlobalPrivilege	908	AppLaunch.exe
Token: 33	908	AppLaunch.exe
Token: 34	908	AppLaunch.exe
Token: 35	908	AppLaunch.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

AppLaunch.exe

pid process

1260 AppLaunch.exe

pid	process
1260	AppLaunch.exe

Suspicious use of WriteProcessMemory 30 IoCs

Processes:

78d9b951e8a890aaddc1cc31116708800b3851f4f4c073c72325c26c6e407d2c.exemsadrh10.exelsasrv.exe

description	pid	process	target process
PID 788 wrote to memory of 1260	788	78d9b951e8a890aaddc1cc31116708800b3851f4f4c073c72325c26c6e407d2c.exe	AppLaunch.exe
PID 788 wrote to memory of 1260	788	78d9b951e8a890aaddc1cc31116708800b3851f4f4c073c72325c26c6e407d2c.exe	AppLaunch.exe
PID 788 wrote to memory of 1260	788	78d9b951e8a890aaddc1cc31116708800b3851f4f4c073c72325c26c6e407d2c.exe	AppLaunch.exe
PID 788 wrote to memory of 1260	788	78d9b951e8a890aaddc1cc31116708800b3851f4f4c073c72325c26c6e407d2c.exe	AppLaunch.exe
PID 788 wrote to memory of 1260	788	78d9b951e8a890aaddc1cc31116708800b3851f4f4c073c72325c26c6e407d2c.exe	AppLaunch.exe
PID 788 wrote to memory of 1260	788	78d9b951e8a890aaddc1cc31116708800b3851f4f4c073c72325c26c6e407d2c.exe	AppLaunch.exe
PID 788 wrote to memory of 1260	788	78d9b951e8a890aaddc1cc31116708800b3851f4f4c073c72325c26c6e407d2c.exe	AppLaunch.exe
PID 788 wrote to memory of 1260	788	78d9b951e8a890aaddc1cc31116708800b3851f4f4c073c72325c26c6e407d2c.exe	AppLaunch.exe
PID 788 wrote to memory of 1260	788	78d9b951e8a890aaddc1cc31116708800b3851f4f4c073c72325c26c6e407d2c.exe	AppLaunch.exe
PID 788 wrote to memory of 1260	788	78d9b951e8a890aaddc1cc31116708800b3851f4f4c073c72325c26c6e407d2c.exe	AppLaunch.exe
PID 788 wrote to memory of 1260	788	78d9b951e8a890aaddc1cc31116708800b3851f4f4c073c72325c26c6e407d2c.exe	AppLaunch.exe
PID 788 wrote to memory of 1632	788	78d9b951e8a890aaddc1cc31116708800b3851f4f4c073c72325c26c6e407d2c.exe	msadrh10.exe
PID 788 wrote to memory of 1632	788	78d9b951e8a890aaddc1cc31116708800b3851f4f4c073c72325c26c6e407d2c.exe	msadrh10.exe
PID 788 wrote to memory of 1632	788	78d9b951e8a890aaddc1cc31116708800b3851f4f4c073c72325c26c6e407d2c.exe	msadrh10.exe
PID 788 wrote to memory of 1632	788	78d9b951e8a890aaddc1cc31116708800b3851f4f4c073c72325c26c6e407d2c.exe	msadrh10.exe
PID 1632 wrote to memory of 1452	1632	msadrh10.exe	lsasrv.exe
PID 1632 wrote to memory of 1452	1632	msadrh10.exe	lsasrv.exe
PID 1632 wrote to memory of 1452	1632	msadrh10.exe	lsasrv.exe
PID 1632 wrote to memory of 1452	1632	msadrh10.exe	lsasrv.exe
PID 1452 wrote to memory of 908	1452	lsasrv.exe	AppLaunch.exe
PID 1452 wrote to memory of 908	1452	lsasrv.exe	AppLaunch.exe
PID 1452 wrote to memory of 908	1452	lsasrv.exe	AppLaunch.exe
PID 1452 wrote to memory of 908	1452	lsasrv.exe	AppLaunch.exe
PID 1452 wrote to memory of 908	1452	lsasrv.exe	AppLaunch.exe
PID 1452 wrote to memory of 908	1452	lsasrv.exe	AppLaunch.exe
PID 1452 wrote to memory of 908	1452	lsasrv.exe	AppLaunch.exe
PID 1452 wrote to memory of 908	1452	lsasrv.exe	AppLaunch.exe
PID 1452 wrote to memory of 908	1452	lsasrv.exe	AppLaunch.exe
PID 1452 wrote to memory of 908	1452	lsasrv.exe	AppLaunch.exe
PID 1452 wrote to memory of 908	1452	lsasrv.exe	AppLaunch.exe

C:\Users\Admin\AppData\Local\Temp\78d9b951e8a890aaddc1cc31116708800b3851f4f4c073c72325c26c6e407d2c.exe
"C:\Users\Admin\AppData\Local\Temp\78d9b951e8a890aaddc1cc31116708800b3851f4f4c073c72325c26c6e407d2c.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:788

C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
2⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1260

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\msadrh10.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\msadrh10.exe"
2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1632

C:\Users\Admin\AppData\Local\Temp\lsasrv.exe
"C:\Users\Admin\AppData\Local\Temp\lsasrv.exe"
3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1452

C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
4⤵
- Suspicious use of AdjustPrivilegeToken
PID:908

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\lsasrv.exe
MD5
e2c65291f42b8587e4f3bdcfc0c114f0

SHA1
4da09c5b590a278cb38c35c2233ff39d4b4bc788

SHA256
78d9b951e8a890aaddc1cc31116708800b3851f4f4c073c72325c26c6e407d2c

SHA512
6c2398e7646e6670fef030792ea533a271be67b3e995111b33a05faa2a05a288804f6c085f9841aed53366a9586a764ee0aea27a5e0a42efcb746cc3191e437a

Download Submit
C:\Users\Admin\AppData\Local\Temp\lsasrv.exe
MD5
e2c65291f42b8587e4f3bdcfc0c114f0

SHA1
4da09c5b590a278cb38c35c2233ff39d4b4bc788

SHA256
78d9b951e8a890aaddc1cc31116708800b3851f4f4c073c72325c26c6e407d2c

SHA512
6c2398e7646e6670fef030792ea533a271be67b3e995111b33a05faa2a05a288804f6c085f9841aed53366a9586a764ee0aea27a5e0a42efcb746cc3191e437a

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\msadrh10.exe
MD5
583c2519171b4818732c7a605bee30e6

SHA1
361056c9c4513d35a865538db3c147ff9000e0d7

SHA256
d2f78c23be8ba6af4a1fadd9c04ef20700f97779bf9aacf23b8bcdc5303d4e0c

SHA512
070210681607b493d8279aafec1fd912e6aeb38e17c2667fb5a7a7e6664808ce3b97b210ab6c53d03f7af29743dfaadcfa9222ae0b00b3258f98383c254c7857

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\msadrh10.exe
MD5
583c2519171b4818732c7a605bee30e6

SHA1
361056c9c4513d35a865538db3c147ff9000e0d7

SHA256
d2f78c23be8ba6af4a1fadd9c04ef20700f97779bf9aacf23b8bcdc5303d4e0c

SHA512
070210681607b493d8279aafec1fd912e6aeb38e17c2667fb5a7a7e6664808ce3b97b210ab6c53d03f7af29743dfaadcfa9222ae0b00b3258f98383c254c7857

Download Submit
\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\msadrh10.exe
MD5
583c2519171b4818732c7a605bee30e6

SHA1
361056c9c4513d35a865538db3c147ff9000e0d7

SHA256
d2f78c23be8ba6af4a1fadd9c04ef20700f97779bf9aacf23b8bcdc5303d4e0c

SHA512
070210681607b493d8279aafec1fd912e6aeb38e17c2667fb5a7a7e6664808ce3b97b210ab6c53d03f7af29743dfaadcfa9222ae0b00b3258f98383c254c7857

Download Submit
\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\msadrh10.exe
MD5
583c2519171b4818732c7a605bee30e6

SHA1
361056c9c4513d35a865538db3c147ff9000e0d7

SHA256
d2f78c23be8ba6af4a1fadd9c04ef20700f97779bf9aacf23b8bcdc5303d4e0c

SHA512
070210681607b493d8279aafec1fd912e6aeb38e17c2667fb5a7a7e6664808ce3b97b210ab6c53d03f7af29743dfaadcfa9222ae0b00b3258f98383c254c7857

Download Submit
memory/788-59-0x0000000075551000-0x0000000075553000-memory.dmp

Filesize
8KB

Download
memory/788-60-0x0000000002160000-0x0000000002161000-memory.dmp

Filesize
4KB

Download
memory/908-77-0x00000000004B5670-mapping.dmp

Download
memory/908-79-0x0000000000260000-0x0000000000261000-memory.dmp

Filesize
4KB

Download
memory/1260-62-0x00000000004B5670-mapping.dmp

Download
memory/1260-61-0x0000000000400000-0x00000000004B7000-memory.dmp

Filesize
732KB

Download
memory/1260-73-0x0000000000270000-0x0000000000271000-memory.dmp

Filesize
4KB

Download
memory/1452-70-0x0000000000000000-mapping.dmp

Download
memory/1452-75-0x00000000022D0000-0x00000000022D1000-memory.dmp

Filesize
4KB

Download
memory/1632-66-0x0000000000000000-mapping.dmp

Download
memory/1632-74-0x0000000000AC0000-0x0000000000AC2000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads