darkcomet | 4e05d1c1bbf19ecff2826bdc0364ba33ba481b1d5ef410c2935d2e46cbe3c8dc

Analysis

max time kernel
44s
max time network
50s
platform
windows7_x64
resource
win7-20220715-en
resource tags

arch:x64arch:x86image:win7-20220715-enlocale:en-usos:windows7-x64system
submitted
20-07-2022 18:59

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4e05d1c1bbf19ecff2826bdc0364ba33ba481b1d5ef410c2935d2e46cbe3c8dc.exe
Size

710KB
MD5

723eb801cc44fb0b2015aaf6b22d5ce0
SHA1

ab1f314a668ef290254373ff2fd50701d2ab8fb5
SHA256

4e05d1c1bbf19ecff2826bdc0364ba33ba481b1d5ef410c2935d2e46cbe3c8dc
SHA512

bfca907880677df3b9815e61bb66afaed8bfb7dae9fcb54eb1247364e0605e5595e9849771aa45d446af5031014f9ff2a6f247a83ac6eddc87bb612906f68011

Score

10^/10

darkcomet failed rat trojan

Malware Config

Extracted

Family

darkcomet

Botnet

failed

aansteker.no-ip.org:1604

Mutex

DC_MUTEX-D0ZXHQN

Attributes

InstallPath
MSDCSC\msdcsc.exe
gencode
Vop0iAhj9wUz
install
true
offline_keylogger
true
persistence
true
reg_key
MicroUpdate

Signatures

Darkcomet
DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
trojan rat darkcomet

Suspicious use of SetThreadContext 1 IoCs

Processes:

4e05d1c1bbf19ecff2826bdc0364ba33ba481b1d5ef410c2935d2e46cbe3c8dc.exe

description	pid	process	target process
PID 1772 set thread context of 2000	1772	4e05d1c1bbf19ecff2826bdc0364ba33ba481b1d5ef410c2935d2e46cbe3c8dc.exe	4e05d1c1bbf19ecff2826bdc0364ba33ba481b1d5ef410c2935d2e46cbe3c8dc.exe

Suspicious use of WriteProcessMemory 13 IoCs

Processes:

4e05d1c1bbf19ecff2826bdc0364ba33ba481b1d5ef410c2935d2e46cbe3c8dc.exe

description	pid	process	target process
PID 1772 wrote to memory of 2000	1772	4e05d1c1bbf19ecff2826bdc0364ba33ba481b1d5ef410c2935d2e46cbe3c8dc.exe	4e05d1c1bbf19ecff2826bdc0364ba33ba481b1d5ef410c2935d2e46cbe3c8dc.exe
PID 1772 wrote to memory of 2000	1772	4e05d1c1bbf19ecff2826bdc0364ba33ba481b1d5ef410c2935d2e46cbe3c8dc.exe	4e05d1c1bbf19ecff2826bdc0364ba33ba481b1d5ef410c2935d2e46cbe3c8dc.exe
PID 1772 wrote to memory of 2000	1772	4e05d1c1bbf19ecff2826bdc0364ba33ba481b1d5ef410c2935d2e46cbe3c8dc.exe	4e05d1c1bbf19ecff2826bdc0364ba33ba481b1d5ef410c2935d2e46cbe3c8dc.exe
PID 1772 wrote to memory of 2000	1772	4e05d1c1bbf19ecff2826bdc0364ba33ba481b1d5ef410c2935d2e46cbe3c8dc.exe	4e05d1c1bbf19ecff2826bdc0364ba33ba481b1d5ef410c2935d2e46cbe3c8dc.exe
PID 1772 wrote to memory of 2000	1772	4e05d1c1bbf19ecff2826bdc0364ba33ba481b1d5ef410c2935d2e46cbe3c8dc.exe	4e05d1c1bbf19ecff2826bdc0364ba33ba481b1d5ef410c2935d2e46cbe3c8dc.exe
PID 1772 wrote to memory of 2000	1772	4e05d1c1bbf19ecff2826bdc0364ba33ba481b1d5ef410c2935d2e46cbe3c8dc.exe	4e05d1c1bbf19ecff2826bdc0364ba33ba481b1d5ef410c2935d2e46cbe3c8dc.exe
PID 1772 wrote to memory of 2000	1772	4e05d1c1bbf19ecff2826bdc0364ba33ba481b1d5ef410c2935d2e46cbe3c8dc.exe	4e05d1c1bbf19ecff2826bdc0364ba33ba481b1d5ef410c2935d2e46cbe3c8dc.exe
PID 1772 wrote to memory of 2000	1772	4e05d1c1bbf19ecff2826bdc0364ba33ba481b1d5ef410c2935d2e46cbe3c8dc.exe	4e05d1c1bbf19ecff2826bdc0364ba33ba481b1d5ef410c2935d2e46cbe3c8dc.exe
PID 1772 wrote to memory of 2000	1772	4e05d1c1bbf19ecff2826bdc0364ba33ba481b1d5ef410c2935d2e46cbe3c8dc.exe	4e05d1c1bbf19ecff2826bdc0364ba33ba481b1d5ef410c2935d2e46cbe3c8dc.exe
PID 1772 wrote to memory of 2000	1772	4e05d1c1bbf19ecff2826bdc0364ba33ba481b1d5ef410c2935d2e46cbe3c8dc.exe	4e05d1c1bbf19ecff2826bdc0364ba33ba481b1d5ef410c2935d2e46cbe3c8dc.exe
PID 1772 wrote to memory of 2000	1772	4e05d1c1bbf19ecff2826bdc0364ba33ba481b1d5ef410c2935d2e46cbe3c8dc.exe	4e05d1c1bbf19ecff2826bdc0364ba33ba481b1d5ef410c2935d2e46cbe3c8dc.exe
PID 1772 wrote to memory of 2000	1772	4e05d1c1bbf19ecff2826bdc0364ba33ba481b1d5ef410c2935d2e46cbe3c8dc.exe	4e05d1c1bbf19ecff2826bdc0364ba33ba481b1d5ef410c2935d2e46cbe3c8dc.exe
PID 1772 wrote to memory of 2000	1772	4e05d1c1bbf19ecff2826bdc0364ba33ba481b1d5ef410c2935d2e46cbe3c8dc.exe	4e05d1c1bbf19ecff2826bdc0364ba33ba481b1d5ef410c2935d2e46cbe3c8dc.exe

C:\Users\Admin\AppData\Local\Temp\4e05d1c1bbf19ecff2826bdc0364ba33ba481b1d5ef410c2935d2e46cbe3c8dc.exe
"C:\Users\Admin\AppData\Local\Temp\4e05d1c1bbf19ecff2826bdc0364ba33ba481b1d5ef410c2935d2e46cbe3c8dc.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1772

C:\Users\Admin\AppData\Local\Temp\4e05d1c1bbf19ecff2826bdc0364ba33ba481b1d5ef410c2935d2e46cbe3c8dc.exe
C:\Users\Admin\AppData\Local\Temp\4e05d1c1bbf19ecff2826bdc0364ba33ba481b1d5ef410c2935d2e46cbe3c8dc.exe
2⤵
PID:2000

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2000-54-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/2000-55-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/2000-57-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/2000-60-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/2000-63-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/2000-67-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/2000-70-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/2000-73-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/2000-76-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/2000-78-0x000000000048F888-mapping.dmp

Download