darkcomet | 07bb3b2e7cf89aba283ffd7af3daba65b50fcd620a25fb945cc85e7d64b9094b

General

Target

xcgb.exe

Score

10^/10

darkcomet evasion persistence rat trojan

Malware Config

Signatures

Darkcomet
DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
trojan rat darkcomet

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1004

Modify Registry

T1112

Processes:

xcgb.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Users\\Admin\\Documents\\MSDCSC\\darkcomet.exe"	xcgb.exe

Executes dropped EXE 1 IoCs

Processes:

darkcomet.exe

pid process

496 darkcomet.exe
Sets file to hidden 1 TTPs
Modifies file attributes to stop it showing in Explorer etc.
evasion

Hidden Files and Directories
T1158

pid	process
496	darkcomet.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

xcgb.exedarkcomet.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Windows\CurrentVersion\Run\DarkCometInstall = "C:\\Users\\Admin\\Documents\\MSDCSC\\darkcomet.exe"	xcgb.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Windows\CurrentVersion\Run\DarkCometInstall = "C:\\Users\\Admin\\Documents\\MSDCSC\\darkcomet.exe"	darkcomet.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

darkcomet.exe

pid process

496 darkcomet.exe

pid	process
496	darkcomet.exe

Suspicious use of AdjustPrivilegeToken 48 IoCs

Processes:

xcgb.exedarkcomet.exe

description	pid	process
Token: SeIncreaseQuotaPrivilege	4652	xcgb.exe
Token: SeSecurityPrivilege	4652	xcgb.exe
Token: SeTakeOwnershipPrivilege	4652	xcgb.exe
Token: SeLoadDriverPrivilege	4652	xcgb.exe
Token: SeSystemProfilePrivilege	4652	xcgb.exe
Token: SeSystemtimePrivilege	4652	xcgb.exe
Token: SeProfSingleProcessPrivilege	4652	xcgb.exe
Token: SeIncBasePriorityPrivilege	4652	xcgb.exe
Token: SeCreatePagefilePrivilege	4652	xcgb.exe
Token: SeBackupPrivilege	4652	xcgb.exe
Token: SeRestorePrivilege	4652	xcgb.exe
Token: SeShutdownPrivilege	4652	xcgb.exe
Token: SeDebugPrivilege	4652	xcgb.exe
Token: SeSystemEnvironmentPrivilege	4652	xcgb.exe
Token: SeChangeNotifyPrivilege	4652	xcgb.exe
Token: SeRemoteShutdownPrivilege	4652	xcgb.exe
Token: SeUndockPrivilege	4652	xcgb.exe
Token: SeManageVolumePrivilege	4652	xcgb.exe
Token: SeImpersonatePrivilege	4652	xcgb.exe
Token: SeCreateGlobalPrivilege	4652	xcgb.exe
Token: 33	4652	xcgb.exe
Token: 34	4652	xcgb.exe
Token: 35	4652	xcgb.exe
Token: 36	4652	xcgb.exe
Token: SeIncreaseQuotaPrivilege	496	darkcomet.exe
Token: SeSecurityPrivilege	496	darkcomet.exe
Token: SeTakeOwnershipPrivilege	496	darkcomet.exe
Token: SeLoadDriverPrivilege	496	darkcomet.exe
Token: SeSystemProfilePrivilege	496	darkcomet.exe
Token: SeSystemtimePrivilege	496	darkcomet.exe
Token: SeProfSingleProcessPrivilege	496	darkcomet.exe
Token: SeIncBasePriorityPrivilege	496	darkcomet.exe
Token: SeCreatePagefilePrivilege	496	darkcomet.exe
Token: SeBackupPrivilege	496	darkcomet.exe
Token: SeRestorePrivilege	496	darkcomet.exe
Token: SeShutdownPrivilege	496	darkcomet.exe
Token: SeDebugPrivilege	496	darkcomet.exe
Token: SeSystemEnvironmentPrivilege	496	darkcomet.exe
Token: SeChangeNotifyPrivilege	496	darkcomet.exe
Token: SeRemoteShutdownPrivilege	496	darkcomet.exe
Token: SeUndockPrivilege	496	darkcomet.exe
Token: SeManageVolumePrivilege	496	darkcomet.exe
Token: SeImpersonatePrivilege	496	darkcomet.exe
Token: SeCreateGlobalPrivilege	496	darkcomet.exe
Token: 33	496	darkcomet.exe
Token: 34	496	darkcomet.exe
Token: 35	496	darkcomet.exe
Token: 36	496	darkcomet.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

darkcomet.exe

pid process

496 darkcomet.exe

pid	process
496	darkcomet.exe

Suspicious use of WriteProcessMemory 20 IoCs

Processes:

xcgb.exedarkcomet.execmd.execmd.exe

description	pid	process	target process
PID 4652 wrote to memory of 3680	4652	xcgb.exe	cmd.exe
PID 4652 wrote to memory of 3680	4652	xcgb.exe	cmd.exe
PID 4652 wrote to memory of 3680	4652	xcgb.exe	cmd.exe
PID 4652 wrote to memory of 3684	4652	xcgb.exe	cmd.exe
PID 4652 wrote to memory of 3684	4652	xcgb.exe	cmd.exe
PID 4652 wrote to memory of 3684	4652	xcgb.exe	cmd.exe
PID 4652 wrote to memory of 496	4652	xcgb.exe	darkcomet.exe
PID 4652 wrote to memory of 496	4652	xcgb.exe	darkcomet.exe
PID 4652 wrote to memory of 496	4652	xcgb.exe	darkcomet.exe
PID 496 wrote to memory of 4256	496	darkcomet.exe	iexplore.exe
PID 496 wrote to memory of 4256	496	darkcomet.exe	iexplore.exe
PID 496 wrote to memory of 4256	496	darkcomet.exe	iexplore.exe
PID 496 wrote to memory of 3224	496	darkcomet.exe	explorer.exe
PID 496 wrote to memory of 3224	496	darkcomet.exe	explorer.exe
PID 3680 wrote to memory of 4276	3680	cmd.exe	attrib.exe
PID 3680 wrote to memory of 4276	3680	cmd.exe	attrib.exe
PID 3680 wrote to memory of 4276	3680	cmd.exe	attrib.exe
PID 3684 wrote to memory of 3240	3684	cmd.exe	attrib.exe
PID 3684 wrote to memory of 3240	3684	cmd.exe	attrib.exe
PID 3684 wrote to memory of 3240	3684	cmd.exe	attrib.exe

Views/modifies file attributes 1 TTPs 2 IoCs
evasion

Hidden Files and Directories
T1158

Processes:

attrib.exeattrib.exe

pid process

4276 attrib.exe
3240 attrib.exe

pid	process
4276	attrib.exe
3240	attrib.exe

C:\Users\Admin\AppData\Local\Temp\xcgb.exe
"C:\Users\Admin\AppData\Local\Temp\xcgb.exe"
1⤵
- Modifies WinLogon for persistence
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4652

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp\xcgb.exe" +s +h
2⤵
- Suspicious use of WriteProcessMemory
PID:3680

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Users\Admin\AppData\Local\Temp\xcgb.exe" +s +h
3⤵
- Views/modifies file attributes
PID:4276

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp" +s +h
2⤵
- Suspicious use of WriteProcessMemory
PID:3684

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Users\Admin\AppData\Local\Temp" +s +h
3⤵
- Views/modifies file attributes
PID:3240

C:\Users\Admin\Documents\MSDCSC\darkcomet.exe
"C:\Users\Admin\Documents\MSDCSC\darkcomet.exe"
2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:496

C:\Program Files (x86)\Internet Explorer\iexplore.exe
"C:\Program Files (x86)\Internet Explorer\iexplore.exe"
3⤵
PID:4256

C:\Windows\explorer.exe
"C:\Windows\explorer.exe"
3⤵
PID:3224

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Hidden Files and Directories

2

T1158

Registry Run Keys / Startup Folder

Winlogon Helper DLL

Privilege Escalation

Defense Evasion

Hidden Files and Directories

Modify Registry

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\Documents\MSDCSC\darkcomet.exe

MD5
c0e4f49d4ea30fe8e04fdba223b44f24

SHA1
42d85163e18f35fd435b5f96a0bce10b8336b440

SHA256
230351e5b4ee08a6583797d942967b059aec63c32eb26427f45d4ff64701b3fe

SHA512
127923ce8310070ef1083b66f92ad5b7faeabb29f2540554fd833e6132d85478f55415344127760f04fe44a7ef8a0acd243d1dec5279510567a4a64777911abc

Download Submit
C:\Users\Admin\Documents\MSDCSC\darkcomet.exe

MD5
c0e4f49d4ea30fe8e04fdba223b44f24

SHA1
42d85163e18f35fd435b5f96a0bce10b8336b440

SHA256
230351e5b4ee08a6583797d942967b059aec63c32eb26427f45d4ff64701b3fe

SHA512
127923ce8310070ef1083b66f92ad5b7faeabb29f2540554fd833e6132d85478f55415344127760f04fe44a7ef8a0acd243d1dec5279510567a4a64777911abc

Download Submit
memory/496-117-0x0000000000000000-mapping.dmp

Download
memory/496-122-0x0000000001FF0000-0x0000000001FF1000-memory.dmp

Filesize
4KB

Download
memory/3240-121-0x0000000000000000-mapping.dmp

Download
memory/3680-115-0x0000000000000000-mapping.dmp

Download
memory/3684-116-0x0000000000000000-mapping.dmp

Download
memory/4276-120-0x0000000000000000-mapping.dmp

Download
memory/4652-114-0x0000000002230000-0x0000000002231000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads