darkcomet | 557f557cdd7fd4398dce9bb06b7690caf4dbc4f6753f8c1b10b6ab5c5937db5a

General

Target

557f557cdd7fd4398dce9bb06b7690caf4dbc4f6753f8c1b10b6ab5c5937db5a.exe
Size

540KB
MD5

c3edae9a4c8911ab76987f8c0a251603
SHA1

bb69324baa60a51fce26e820676e4d5778db2f6f
SHA256

557f557cdd7fd4398dce9bb06b7690caf4dbc4f6753f8c1b10b6ab5c5937db5a
SHA512

3e79a9b6c3506622ce0b3f5ae02d86bca1ba878057bf4d7fe617cd69d7be1629e959e7f542d52c89bea8327599d9fe09c4c836e3ee97274658ebf40e3747c525

Score

10^/10

darkcomet bootkit persistence rat trojan

Malware Config

Signatures

Darkcomet
DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
trojan rat darkcomet

Checks BIOS information in registry 2 TTPs 1 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

557f557cdd7fd4398dce9bb06b7690caf4dbc4f6753f8c1b10b6ab5c5937db5a.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate	557f557cdd7fd4398dce9bb06b7690caf4dbc4f6753f8c1b10b6ab5c5937db5a.exe

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
bootkit persistence

Bootkit
T1067

Processes:

557f557cdd7fd4398dce9bb06b7690caf4dbc4f6753f8c1b10b6ab5c5937db5a.exe

description ioc process

File opened for modification \??\PhysicalDrive0 557f557cdd7fd4398dce9bb06b7690caf4dbc4f6753f8c1b10b6ab5c5937db5a.exe

description	ioc	process
File opened for modification	\??\PhysicalDrive0	557f557cdd7fd4398dce9bb06b7690caf4dbc4f6753f8c1b10b6ab5c5937db5a.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

557f557cdd7fd4398dce9bb06b7690caf4dbc4f6753f8c1b10b6ab5c5937db5a.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	557f557cdd7fd4398dce9bb06b7690caf4dbc4f6753f8c1b10b6ab5c5937db5a.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	557f557cdd7fd4398dce9bb06b7690caf4dbc4f6753f8c1b10b6ab5c5937db5a.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	557f557cdd7fd4398dce9bb06b7690caf4dbc4f6753f8c1b10b6ab5c5937db5a.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	557f557cdd7fd4398dce9bb06b7690caf4dbc4f6753f8c1b10b6ab5c5937db5a.exe

Enumerates system info in registry 2 TTPs 1 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

557f557cdd7fd4398dce9bb06b7690caf4dbc4f6753f8c1b10b6ab5c5937db5a.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	557f557cdd7fd4398dce9bb06b7690caf4dbc4f6753f8c1b10b6ab5c5937db5a.exe

Modifies registry class 3 IoCs

Processes:

557f557cdd7fd4398dce9bb06b7690caf4dbc4f6753f8c1b10b6ab5c5937db5a.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.key	557f557cdd7fd4398dce9bb06b7690caf4dbc4f6753f8c1b10b6ab5c5937db5a.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.key\	557f557cdd7fd4398dce9bb06b7690caf4dbc4f6753f8c1b10b6ab5c5937db5a.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.key\ = "regfile"	557f557cdd7fd4398dce9bb06b7690caf4dbc4f6753f8c1b10b6ab5c5937db5a.exe

Suspicious use of AdjustPrivilegeToken 23 IoCs

Processes:

557f557cdd7fd4398dce9bb06b7690caf4dbc4f6753f8c1b10b6ab5c5937db5a.exe

description	pid	process
Token: SeIncreaseQuotaPrivilege	1952	557f557cdd7fd4398dce9bb06b7690caf4dbc4f6753f8c1b10b6ab5c5937db5a.exe
Token: SeSecurityPrivilege	1952	557f557cdd7fd4398dce9bb06b7690caf4dbc4f6753f8c1b10b6ab5c5937db5a.exe
Token: SeTakeOwnershipPrivilege	1952	557f557cdd7fd4398dce9bb06b7690caf4dbc4f6753f8c1b10b6ab5c5937db5a.exe
Token: SeLoadDriverPrivilege	1952	557f557cdd7fd4398dce9bb06b7690caf4dbc4f6753f8c1b10b6ab5c5937db5a.exe
Token: SeSystemProfilePrivilege	1952	557f557cdd7fd4398dce9bb06b7690caf4dbc4f6753f8c1b10b6ab5c5937db5a.exe
Token: SeSystemtimePrivilege	1952	557f557cdd7fd4398dce9bb06b7690caf4dbc4f6753f8c1b10b6ab5c5937db5a.exe
Token: SeProfSingleProcessPrivilege	1952	557f557cdd7fd4398dce9bb06b7690caf4dbc4f6753f8c1b10b6ab5c5937db5a.exe
Token: SeIncBasePriorityPrivilege	1952	557f557cdd7fd4398dce9bb06b7690caf4dbc4f6753f8c1b10b6ab5c5937db5a.exe
Token: SeCreatePagefilePrivilege	1952	557f557cdd7fd4398dce9bb06b7690caf4dbc4f6753f8c1b10b6ab5c5937db5a.exe
Token: SeBackupPrivilege	1952	557f557cdd7fd4398dce9bb06b7690caf4dbc4f6753f8c1b10b6ab5c5937db5a.exe
Token: SeRestorePrivilege	1952	557f557cdd7fd4398dce9bb06b7690caf4dbc4f6753f8c1b10b6ab5c5937db5a.exe
Token: SeShutdownPrivilege	1952	557f557cdd7fd4398dce9bb06b7690caf4dbc4f6753f8c1b10b6ab5c5937db5a.exe
Token: SeDebugPrivilege	1952	557f557cdd7fd4398dce9bb06b7690caf4dbc4f6753f8c1b10b6ab5c5937db5a.exe
Token: SeSystemEnvironmentPrivilege	1952	557f557cdd7fd4398dce9bb06b7690caf4dbc4f6753f8c1b10b6ab5c5937db5a.exe
Token: SeChangeNotifyPrivilege	1952	557f557cdd7fd4398dce9bb06b7690caf4dbc4f6753f8c1b10b6ab5c5937db5a.exe
Token: SeRemoteShutdownPrivilege	1952	557f557cdd7fd4398dce9bb06b7690caf4dbc4f6753f8c1b10b6ab5c5937db5a.exe
Token: SeUndockPrivilege	1952	557f557cdd7fd4398dce9bb06b7690caf4dbc4f6753f8c1b10b6ab5c5937db5a.exe
Token: SeManageVolumePrivilege	1952	557f557cdd7fd4398dce9bb06b7690caf4dbc4f6753f8c1b10b6ab5c5937db5a.exe
Token: SeImpersonatePrivilege	1952	557f557cdd7fd4398dce9bb06b7690caf4dbc4f6753f8c1b10b6ab5c5937db5a.exe
Token: SeCreateGlobalPrivilege	1952	557f557cdd7fd4398dce9bb06b7690caf4dbc4f6753f8c1b10b6ab5c5937db5a.exe
Token: 33	1952	557f557cdd7fd4398dce9bb06b7690caf4dbc4f6753f8c1b10b6ab5c5937db5a.exe
Token: 34	1952	557f557cdd7fd4398dce9bb06b7690caf4dbc4f6753f8c1b10b6ab5c5937db5a.exe
Token: 35	1952	557f557cdd7fd4398dce9bb06b7690caf4dbc4f6753f8c1b10b6ab5c5937db5a.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

557f557cdd7fd4398dce9bb06b7690caf4dbc4f6753f8c1b10b6ab5c5937db5a.exe

pid process

1952 557f557cdd7fd4398dce9bb06b7690caf4dbc4f6753f8c1b10b6ab5c5937db5a.exe

pid	process
1952	557f557cdd7fd4398dce9bb06b7690caf4dbc4f6753f8c1b10b6ab5c5937db5a.exe

C:\Users\Admin\AppData\Local\Temp\557f557cdd7fd4398dce9bb06b7690caf4dbc4f6753f8c1b10b6ab5c5937db5a.exe
"C:\Users\Admin\AppData\Local\Temp\557f557cdd7fd4398dce9bb06b7690caf4dbc4f6753f8c1b10b6ab5c5937db5a.exe"
1⤵
- Checks BIOS information in registry
- Writes to the Master Boot Record (MBR)
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1952

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Bootkit

1

T1067

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

3

T1012

System Information Discovery

3

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1952-54-0x0000000075B61000-0x0000000075B63000-memory.dmp

Filesize
8KB

Download
memory/1952-55-0x0000000013140000-0x0000000013270000-memory.dmp

Filesize
1.2MB

Download
memory/1952-56-0x0000000001D00000-0x0000000001D03000-memory.dmp

Filesize
12KB

Download
memory/1952-57-0x0000000013140000-0x0000000013270000-memory.dmp

Filesize
1.2MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads