darkcomet | 37e0c72ff5d602968aa7c84e60d0690111f99c30cea4aa36381a990ac870c29f

General

Target

37e0c72ff5d602968aa7c84e60d0690111f99c30cea4aa36381a990ac870c29f.exe
Size

690KB
MD5

4f2ac7edd1bda1c4e4d629b42ce590ef
SHA1

8eb7ad9073f82112d2327b85dc47813666dda5a6
SHA256

37e0c72ff5d602968aa7c84e60d0690111f99c30cea4aa36381a990ac870c29f
SHA512

f22625988d8d284a5212e458a2593950c3e3f8a6667bee246e4be281e2a057d9b642085ad9afb7f9cd647eb4360c214b4de71fc09e6821ab4985a10888e12d55

Score

10^/10

darkcomet evasion rat trojan

Malware Config

Signatures

Darkcomet
DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
trojan rat darkcomet

Modifies firewall policy service 2 TTPs 3 IoCs

evasion

Modify Registry

T1112

Modify Existing Service

T1031

Processes:

37e0c72ff5d602968aa7c84e60d0690111f99c30cea4aa36381a990ac870c29f.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	37e0c72ff5d602968aa7c84e60d0690111f99c30cea4aa36381a990ac870c29f.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0"	37e0c72ff5d602968aa7c84e60d0690111f99c30cea4aa36381a990ac870c29f.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "0"	37e0c72ff5d602968aa7c84e60d0690111f99c30cea4aa36381a990ac870c29f.exe

Disables RegEdit via registry modification
evasion
Disables Task Manager via registry modification
evasion
Sets file to hidden 1 TTPs
Modifies file attributes to stop it showing in Explorer etc.
evasion

Hidden Files and Directories
T1158

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

37e0c72ff5d602968aa7c84e60d0690111f99c30cea4aa36381a990ac870c29f.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Control Panel\International\Geo\Nation	37e0c72ff5d602968aa7c84e60d0690111f99c30cea4aa36381a990ac870c29f.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

37e0c72ff5d602968aa7c84e60d0690111f99c30cea4aa36381a990ac870c29f.exe

pid process

888 37e0c72ff5d602968aa7c84e60d0690111f99c30cea4aa36381a990ac870c29f.exe

pid	process
888	37e0c72ff5d602968aa7c84e60d0690111f99c30cea4aa36381a990ac870c29f.exe

Suspicious use of AdjustPrivilegeToken 24 IoCs

Processes:

37e0c72ff5d602968aa7c84e60d0690111f99c30cea4aa36381a990ac870c29f.exe

description	pid	process
Token: SeIncreaseQuotaPrivilege	888	37e0c72ff5d602968aa7c84e60d0690111f99c30cea4aa36381a990ac870c29f.exe
Token: SeSecurityPrivilege	888	37e0c72ff5d602968aa7c84e60d0690111f99c30cea4aa36381a990ac870c29f.exe
Token: SeTakeOwnershipPrivilege	888	37e0c72ff5d602968aa7c84e60d0690111f99c30cea4aa36381a990ac870c29f.exe
Token: SeLoadDriverPrivilege	888	37e0c72ff5d602968aa7c84e60d0690111f99c30cea4aa36381a990ac870c29f.exe
Token: SeSystemProfilePrivilege	888	37e0c72ff5d602968aa7c84e60d0690111f99c30cea4aa36381a990ac870c29f.exe
Token: SeSystemtimePrivilege	888	37e0c72ff5d602968aa7c84e60d0690111f99c30cea4aa36381a990ac870c29f.exe
Token: SeProfSingleProcessPrivilege	888	37e0c72ff5d602968aa7c84e60d0690111f99c30cea4aa36381a990ac870c29f.exe
Token: SeIncBasePriorityPrivilege	888	37e0c72ff5d602968aa7c84e60d0690111f99c30cea4aa36381a990ac870c29f.exe
Token: SeCreatePagefilePrivilege	888	37e0c72ff5d602968aa7c84e60d0690111f99c30cea4aa36381a990ac870c29f.exe
Token: SeBackupPrivilege	888	37e0c72ff5d602968aa7c84e60d0690111f99c30cea4aa36381a990ac870c29f.exe
Token: SeRestorePrivilege	888	37e0c72ff5d602968aa7c84e60d0690111f99c30cea4aa36381a990ac870c29f.exe
Token: SeShutdownPrivilege	888	37e0c72ff5d602968aa7c84e60d0690111f99c30cea4aa36381a990ac870c29f.exe
Token: SeDebugPrivilege	888	37e0c72ff5d602968aa7c84e60d0690111f99c30cea4aa36381a990ac870c29f.exe
Token: SeSystemEnvironmentPrivilege	888	37e0c72ff5d602968aa7c84e60d0690111f99c30cea4aa36381a990ac870c29f.exe
Token: SeChangeNotifyPrivilege	888	37e0c72ff5d602968aa7c84e60d0690111f99c30cea4aa36381a990ac870c29f.exe
Token: SeRemoteShutdownPrivilege	888	37e0c72ff5d602968aa7c84e60d0690111f99c30cea4aa36381a990ac870c29f.exe
Token: SeUndockPrivilege	888	37e0c72ff5d602968aa7c84e60d0690111f99c30cea4aa36381a990ac870c29f.exe
Token: SeManageVolumePrivilege	888	37e0c72ff5d602968aa7c84e60d0690111f99c30cea4aa36381a990ac870c29f.exe
Token: SeImpersonatePrivilege	888	37e0c72ff5d602968aa7c84e60d0690111f99c30cea4aa36381a990ac870c29f.exe
Token: SeCreateGlobalPrivilege	888	37e0c72ff5d602968aa7c84e60d0690111f99c30cea4aa36381a990ac870c29f.exe
Token: 33	888	37e0c72ff5d602968aa7c84e60d0690111f99c30cea4aa36381a990ac870c29f.exe
Token: 34	888	37e0c72ff5d602968aa7c84e60d0690111f99c30cea4aa36381a990ac870c29f.exe
Token: 35	888	37e0c72ff5d602968aa7c84e60d0690111f99c30cea4aa36381a990ac870c29f.exe
Token: 36	888	37e0c72ff5d602968aa7c84e60d0690111f99c30cea4aa36381a990ac870c29f.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

37e0c72ff5d602968aa7c84e60d0690111f99c30cea4aa36381a990ac870c29f.exe

pid process

888 37e0c72ff5d602968aa7c84e60d0690111f99c30cea4aa36381a990ac870c29f.exe

pid	process
888	37e0c72ff5d602968aa7c84e60d0690111f99c30cea4aa36381a990ac870c29f.exe

Suspicious use of WriteProcessMemory 39 IoCs

Processes:

37e0c72ff5d602968aa7c84e60d0690111f99c30cea4aa36381a990ac870c29f.execmd.execmd.exe

description	pid	process	target process
PID 888 wrote to memory of 1736	888	37e0c72ff5d602968aa7c84e60d0690111f99c30cea4aa36381a990ac870c29f.exe	cmd.exe
PID 888 wrote to memory of 1736	888	37e0c72ff5d602968aa7c84e60d0690111f99c30cea4aa36381a990ac870c29f.exe	cmd.exe
PID 888 wrote to memory of 1736	888	37e0c72ff5d602968aa7c84e60d0690111f99c30cea4aa36381a990ac870c29f.exe	cmd.exe
PID 888 wrote to memory of 2924	888	37e0c72ff5d602968aa7c84e60d0690111f99c30cea4aa36381a990ac870c29f.exe	cmd.exe
PID 888 wrote to memory of 2924	888	37e0c72ff5d602968aa7c84e60d0690111f99c30cea4aa36381a990ac870c29f.exe	cmd.exe
PID 888 wrote to memory of 2924	888	37e0c72ff5d602968aa7c84e60d0690111f99c30cea4aa36381a990ac870c29f.exe	cmd.exe
PID 888 wrote to memory of 3304	888	37e0c72ff5d602968aa7c84e60d0690111f99c30cea4aa36381a990ac870c29f.exe	iexplore.exe
PID 888 wrote to memory of 3304	888	37e0c72ff5d602968aa7c84e60d0690111f99c30cea4aa36381a990ac870c29f.exe	iexplore.exe
PID 888 wrote to memory of 3304	888	37e0c72ff5d602968aa7c84e60d0690111f99c30cea4aa36381a990ac870c29f.exe	iexplore.exe
PID 888 wrote to memory of 3600	888	37e0c72ff5d602968aa7c84e60d0690111f99c30cea4aa36381a990ac870c29f.exe	explorer.exe
PID 888 wrote to memory of 3600	888	37e0c72ff5d602968aa7c84e60d0690111f99c30cea4aa36381a990ac870c29f.exe	explorer.exe
PID 888 wrote to memory of 4288	888	37e0c72ff5d602968aa7c84e60d0690111f99c30cea4aa36381a990ac870c29f.exe	notepad.exe
PID 888 wrote to memory of 4288	888	37e0c72ff5d602968aa7c84e60d0690111f99c30cea4aa36381a990ac870c29f.exe	notepad.exe
PID 888 wrote to memory of 4288	888	37e0c72ff5d602968aa7c84e60d0690111f99c30cea4aa36381a990ac870c29f.exe	notepad.exe
PID 1736 wrote to memory of 4760	1736	cmd.exe	attrib.exe
PID 1736 wrote to memory of 4760	1736	cmd.exe	attrib.exe
PID 1736 wrote to memory of 4760	1736	cmd.exe	attrib.exe
PID 888 wrote to memory of 4288	888	37e0c72ff5d602968aa7c84e60d0690111f99c30cea4aa36381a990ac870c29f.exe	notepad.exe
PID 888 wrote to memory of 4288	888	37e0c72ff5d602968aa7c84e60d0690111f99c30cea4aa36381a990ac870c29f.exe	notepad.exe
PID 888 wrote to memory of 4288	888	37e0c72ff5d602968aa7c84e60d0690111f99c30cea4aa36381a990ac870c29f.exe	notepad.exe
PID 888 wrote to memory of 4288	888	37e0c72ff5d602968aa7c84e60d0690111f99c30cea4aa36381a990ac870c29f.exe	notepad.exe
PID 888 wrote to memory of 4288	888	37e0c72ff5d602968aa7c84e60d0690111f99c30cea4aa36381a990ac870c29f.exe	notepad.exe
PID 888 wrote to memory of 4288	888	37e0c72ff5d602968aa7c84e60d0690111f99c30cea4aa36381a990ac870c29f.exe	notepad.exe
PID 888 wrote to memory of 4288	888	37e0c72ff5d602968aa7c84e60d0690111f99c30cea4aa36381a990ac870c29f.exe	notepad.exe
PID 888 wrote to memory of 4288	888	37e0c72ff5d602968aa7c84e60d0690111f99c30cea4aa36381a990ac870c29f.exe	notepad.exe
PID 888 wrote to memory of 4288	888	37e0c72ff5d602968aa7c84e60d0690111f99c30cea4aa36381a990ac870c29f.exe	notepad.exe
PID 888 wrote to memory of 4288	888	37e0c72ff5d602968aa7c84e60d0690111f99c30cea4aa36381a990ac870c29f.exe	notepad.exe
PID 888 wrote to memory of 4288	888	37e0c72ff5d602968aa7c84e60d0690111f99c30cea4aa36381a990ac870c29f.exe	notepad.exe
PID 888 wrote to memory of 4288	888	37e0c72ff5d602968aa7c84e60d0690111f99c30cea4aa36381a990ac870c29f.exe	notepad.exe
PID 888 wrote to memory of 4288	888	37e0c72ff5d602968aa7c84e60d0690111f99c30cea4aa36381a990ac870c29f.exe	notepad.exe
PID 888 wrote to memory of 4288	888	37e0c72ff5d602968aa7c84e60d0690111f99c30cea4aa36381a990ac870c29f.exe	notepad.exe
PID 888 wrote to memory of 4288	888	37e0c72ff5d602968aa7c84e60d0690111f99c30cea4aa36381a990ac870c29f.exe	notepad.exe
PID 888 wrote to memory of 4288	888	37e0c72ff5d602968aa7c84e60d0690111f99c30cea4aa36381a990ac870c29f.exe	notepad.exe
PID 888 wrote to memory of 4288	888	37e0c72ff5d602968aa7c84e60d0690111f99c30cea4aa36381a990ac870c29f.exe	notepad.exe
PID 888 wrote to memory of 4288	888	37e0c72ff5d602968aa7c84e60d0690111f99c30cea4aa36381a990ac870c29f.exe	notepad.exe
PID 888 wrote to memory of 4288	888	37e0c72ff5d602968aa7c84e60d0690111f99c30cea4aa36381a990ac870c29f.exe	notepad.exe
PID 2924 wrote to memory of 3292	2924	cmd.exe	attrib.exe
PID 2924 wrote to memory of 3292	2924	cmd.exe	attrib.exe
PID 2924 wrote to memory of 3292	2924	cmd.exe	attrib.exe

Views/modifies file attributes 1 TTPs 2 IoCs
evasion

Hidden Files and Directories
T1158

Processes:

attrib.exeattrib.exe

pid process

3292 attrib.exe
4760 attrib.exe

pid	process
3292	attrib.exe
4760	attrib.exe

C:\Users\Admin\AppData\Local\Temp\37e0c72ff5d602968aa7c84e60d0690111f99c30cea4aa36381a990ac870c29f.exe
"C:\Users\Admin\AppData\Local\Temp\37e0c72ff5d602968aa7c84e60d0690111f99c30cea4aa36381a990ac870c29f.exe"
1⤵
- Modifies firewall policy service
- Checks computer location settings
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:888

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp\37e0c72ff5d602968aa7c84e60d0690111f99c30cea4aa36381a990ac870c29f.exe" +s +h
2⤵
- Suspicious use of WriteProcessMemory
PID:1736

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Users\Admin\AppData\Local\Temp\37e0c72ff5d602968aa7c84e60d0690111f99c30cea4aa36381a990ac870c29f.exe" +s +h
3⤵
- Views/modifies file attributes
PID:4760

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp" +s +h
2⤵
- Suspicious use of WriteProcessMemory
PID:2924