darkcomet | 619a89b25ff451282ac15cb9f2d1b65ae3be708af486d0cf93ab7de24ca70864

General

Target

619a89b25ff451282ac15cb9f2d1b65ae3be708af486d0cf93ab7de24ca70864.exe
Size

700KB
MD5

342eb181947548cb5470897f322580c7
SHA1

3875c583deb9c3be016a75f573cfe3ee062a67dd
SHA256

619a89b25ff451282ac15cb9f2d1b65ae3be708af486d0cf93ab7de24ca70864
SHA512

e4da115529384f38722b0e7bb7a78ee1b7158009a41ebbdea2dec40fb51614e6d8bcd8395e35f2d800a2e29fcfe4870fface085b74c746539b9dcf13423d9a13

Score

10^/10

darkcomet guest18 rat trojan

Malware Config

Extracted

Family

darkcomet

Botnet

Guest18

C2

127.0.0.1:1604

mitsosan.no-ip.biz:1604

Mutex

DC_MUTEX-EK9DQ8H

Attributes

gencode
V2uuLtV8CNMk
install
false
offline_keylogger
true
persistence
false

Signatures

Darkcomet
DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
trojan rat darkcomet
Uses the VBS compiler for execution 1 TTPs

Scripting
T1064
Suspicious use of SetThreadContext 1 IoCs

Processes:

619a89b25ff451282ac15cb9f2d1b65ae3be708af486d0cf93ab7de24ca70864.exe

description pid process target process

PID 888 set thread context of 884 888 619a89b25ff451282ac15cb9f2d1b65ae3be708af486d0cf93ab7de24ca70864.exe vbc.exe

description	pid	process	target process
PID 888 set thread context of 884	888	619a89b25ff451282ac15cb9f2d1b65ae3be708af486d0cf93ab7de24ca70864.exe	vbc.exe

Suspicious use of AdjustPrivilegeToken 23 IoCs

Processes:

vbc.exe

description	pid	process
Token: SeIncreaseQuotaPrivilege	884	vbc.exe
Token: SeSecurityPrivilege	884	vbc.exe
Token: SeTakeOwnershipPrivilege	884	vbc.exe
Token: SeLoadDriverPrivilege	884	vbc.exe
Token: SeSystemProfilePrivilege	884	vbc.exe
Token: SeSystemtimePrivilege	884	vbc.exe
Token: SeProfSingleProcessPrivilege	884	vbc.exe
Token: SeIncBasePriorityPrivilege	884	vbc.exe
Token: SeCreatePagefilePrivilege	884	vbc.exe
Token: SeBackupPrivilege	884	vbc.exe
Token: SeRestorePrivilege	884	vbc.exe
Token: SeShutdownPrivilege	884	vbc.exe
Token: SeDebugPrivilege	884	vbc.exe
Token: SeSystemEnvironmentPrivilege	884	vbc.exe
Token: SeChangeNotifyPrivilege	884	vbc.exe
Token: SeRemoteShutdownPrivilege	884	vbc.exe
Token: SeUndockPrivilege	884	vbc.exe
Token: SeManageVolumePrivilege	884	vbc.exe
Token: SeImpersonatePrivilege	884	vbc.exe
Token: SeCreateGlobalPrivilege	884	vbc.exe
Token: 33	884	vbc.exe
Token: 34	884	vbc.exe
Token: 35	884	vbc.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

vbc.exe

pid process

884 vbc.exe

pid	process
884	vbc.exe

Suspicious use of WriteProcessMemory 13 IoCs

Processes:

619a89b25ff451282ac15cb9f2d1b65ae3be708af486d0cf93ab7de24ca70864.exe

description	pid	process	target process
PID 888 wrote to memory of 884	888	619a89b25ff451282ac15cb9f2d1b65ae3be708af486d0cf93ab7de24ca70864.exe	vbc.exe
PID 888 wrote to memory of 884	888	619a89b25ff451282ac15cb9f2d1b65ae3be708af486d0cf93ab7de24ca70864.exe	vbc.exe
PID 888 wrote to memory of 884	888	619a89b25ff451282ac15cb9f2d1b65ae3be708af486d0cf93ab7de24ca70864.exe	vbc.exe
PID 888 wrote to memory of 884	888	619a89b25ff451282ac15cb9f2d1b65ae3be708af486d0cf93ab7de24ca70864.exe	vbc.exe
PID 888 wrote to memory of 884	888	619a89b25ff451282ac15cb9f2d1b65ae3be708af486d0cf93ab7de24ca70864.exe	vbc.exe
PID 888 wrote to memory of 884	888	619a89b25ff451282ac15cb9f2d1b65ae3be708af486d0cf93ab7de24ca70864.exe	vbc.exe
PID 888 wrote to memory of 884	888	619a89b25ff451282ac15cb9f2d1b65ae3be708af486d0cf93ab7de24ca70864.exe	vbc.exe
PID 888 wrote to memory of 884	888	619a89b25ff451282ac15cb9f2d1b65ae3be708af486d0cf93ab7de24ca70864.exe	vbc.exe
PID 888 wrote to memory of 884	888	619a89b25ff451282ac15cb9f2d1b65ae3be708af486d0cf93ab7de24ca70864.exe	vbc.exe
PID 888 wrote to memory of 884	888	619a89b25ff451282ac15cb9f2d1b65ae3be708af486d0cf93ab7de24ca70864.exe	vbc.exe
PID 888 wrote to memory of 884	888	619a89b25ff451282ac15cb9f2d1b65ae3be708af486d0cf93ab7de24ca70864.exe	vbc.exe
PID 888 wrote to memory of 884	888	619a89b25ff451282ac15cb9f2d1b65ae3be708af486d0cf93ab7de24ca70864.exe	vbc.exe
PID 888 wrote to memory of 884	888	619a89b25ff451282ac15cb9f2d1b65ae3be708af486d0cf93ab7de24ca70864.exe	vbc.exe

C:\Users\Admin\AppData\Local\Temp\619a89b25ff451282ac15cb9f2d1b65ae3be708af486d0cf93ab7de24ca70864.exe
"C:\Users\Admin\AppData\Local\Temp\619a89b25ff451282ac15cb9f2d1b65ae3be708af486d0cf93ab7de24ca70864.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:888

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
2⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:884

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scripting

1

T1064

Persistence

Privilege Escalation

Defense Evasion

Scripting

1

T1064

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/884-66-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/884-59-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/884-77-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/884-57-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/884-68-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/884-65-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/884-63-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/884-70-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/884-56-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/884-76-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/884-61-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/884-71-0x000000000048F888-mapping.dmp

Download
memory/884-72-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/884-75-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/888-74-0x0000000074250000-0x00000000747FB000-memory.dmp

Filesize
5.7MB

Download
memory/888-55-0x0000000074250000-0x00000000747FB000-memory.dmp

Filesize
5.7MB

Download
memory/888-54-0x0000000075BB1000-0x0000000075BB3000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing