darkcomet | 619a89b25ff451282ac15cb9f2d1b65ae3be708af486d0cf93ab7de24ca70864

Analysis

max time kernel
151s
max time network
161s
platform
windows10-2004_x64
resource
win10v2004-20220721-en
resource tags

arch:x64arch:x86image:win10v2004-20220721-enlocale:en-usos:windows10-2004-x64system
submitted
30-07-2022 20:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

619a89b25ff451282ac15cb9f2d1b65ae3be708af486d0cf93ab7de24ca70864.exe
Size

700KB
MD5

342eb181947548cb5470897f322580c7
SHA1

3875c583deb9c3be016a75f573cfe3ee062a67dd
SHA256

619a89b25ff451282ac15cb9f2d1b65ae3be708af486d0cf93ab7de24ca70864
SHA512

e4da115529384f38722b0e7bb7a78ee1b7158009a41ebbdea2dec40fb51614e6d8bcd8395e35f2d800a2e29fcfe4870fface085b74c746539b9dcf13423d9a13

Score

10^/10

darkcomet guest18 rat trojan

Malware Config

Extracted

Family

darkcomet

Botnet

Guest18

127.0.0.1:1604

mitsosan.no-ip.biz:1604

Mutex

DC_MUTEX-EK9DQ8H

Attributes

gencode
V2uuLtV8CNMk
install
false
offline_keylogger
true
persistence
false

Signatures

Darkcomet
DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
trojan rat darkcomet
Uses the VBS compiler for execution 1 TTPs

Scripting
T1064

Suspicious use of SetThreadContext 1 IoCs

Processes:

619a89b25ff451282ac15cb9f2d1b65ae3be708af486d0cf93ab7de24ca70864.exe

description	pid	process	target process
PID 4564 set thread context of 5080	4564	619a89b25ff451282ac15cb9f2d1b65ae3be708af486d0cf93ab7de24ca70864.exe	vbc.exe

Suspicious use of AdjustPrivilegeToken 24 IoCs

Processes:

vbc.exe

description	pid	process
Token: SeIncreaseQuotaPrivilege	5080	vbc.exe
Token: SeSecurityPrivilege	5080	vbc.exe
Token: SeTakeOwnershipPrivilege	5080	vbc.exe
Token: SeLoadDriverPrivilege	5080	vbc.exe
Token: SeSystemProfilePrivilege	5080	vbc.exe
Token: SeSystemtimePrivilege	5080	vbc.exe
Token: SeProfSingleProcessPrivilege	5080	vbc.exe
Token: SeIncBasePriorityPrivilege	5080	vbc.exe
Token: SeCreatePagefilePrivilege	5080	vbc.exe
Token: SeBackupPrivilege	5080	vbc.exe
Token: SeRestorePrivilege	5080	vbc.exe
Token: SeShutdownPrivilege	5080	vbc.exe
Token: SeDebugPrivilege	5080	vbc.exe
Token: SeSystemEnvironmentPrivilege	5080	vbc.exe
Token: SeChangeNotifyPrivilege	5080	vbc.exe
Token: SeRemoteShutdownPrivilege	5080	vbc.exe
Token: SeUndockPrivilege	5080	vbc.exe
Token: SeManageVolumePrivilege	5080	vbc.exe
Token: SeImpersonatePrivilege	5080	vbc.exe
Token: SeCreateGlobalPrivilege	5080	vbc.exe
Token: 33	5080	vbc.exe
Token: 34	5080	vbc.exe
Token: 35	5080	vbc.exe
Token: 36	5080	vbc.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

vbc.exe

pid process

5080 vbc.exe

pid	process
5080	vbc.exe

Suspicious use of WriteProcessMemory 14 IoCs

Processes:

619a89b25ff451282ac15cb9f2d1b65ae3be708af486d0cf93ab7de24ca70864.exe

description	pid	process	target process
PID 4564 wrote to memory of 5080	4564	619a89b25ff451282ac15cb9f2d1b65ae3be708af486d0cf93ab7de24ca70864.exe	vbc.exe
PID 4564 wrote to memory of 5080	4564	619a89b25ff451282ac15cb9f2d1b65ae3be708af486d0cf93ab7de24ca70864.exe	vbc.exe
PID 4564 wrote to memory of 5080	4564	619a89b25ff451282ac15cb9f2d1b65ae3be708af486d0cf93ab7de24ca70864.exe	vbc.exe
PID 4564 wrote to memory of 5080	4564	619a89b25ff451282ac15cb9f2d1b65ae3be708af486d0cf93ab7de24ca70864.exe	vbc.exe
PID 4564 wrote to memory of 5080	4564	619a89b25ff451282ac15cb9f2d1b65ae3be708af486d0cf93ab7de24ca70864.exe	vbc.exe
PID 4564 wrote to memory of 5080	4564	619a89b25ff451282ac15cb9f2d1b65ae3be708af486d0cf93ab7de24ca70864.exe	vbc.exe
PID 4564 wrote to memory of 5080	4564	619a89b25ff451282ac15cb9f2d1b65ae3be708af486d0cf93ab7de24ca70864.exe	vbc.exe
PID 4564 wrote to memory of 5080	4564	619a89b25ff451282ac15cb9f2d1b65ae3be708af486d0cf93ab7de24ca70864.exe	vbc.exe
PID 4564 wrote to memory of 5080	4564	619a89b25ff451282ac15cb9f2d1b65ae3be708af486d0cf93ab7de24ca70864.exe	vbc.exe
PID 4564 wrote to memory of 5080	4564	619a89b25ff451282ac15cb9f2d1b65ae3be708af486d0cf93ab7de24ca70864.exe	vbc.exe
PID 4564 wrote to memory of 5080	4564	619a89b25ff451282ac15cb9f2d1b65ae3be708af486d0cf93ab7de24ca70864.exe	vbc.exe
PID 4564 wrote to memory of 5080	4564	619a89b25ff451282ac15cb9f2d1b65ae3be708af486d0cf93ab7de24ca70864.exe	vbc.exe
PID 4564 wrote to memory of 5080	4564	619a89b25ff451282ac15cb9f2d1b65ae3be708af486d0cf93ab7de24ca70864.exe	vbc.exe
PID 4564 wrote to memory of 5080	4564	619a89b25ff451282ac15cb9f2d1b65ae3be708af486d0cf93ab7de24ca70864.exe	vbc.exe

C:\Users\Admin\AppData\Local\Temp\619a89b25ff451282ac15cb9f2d1b65ae3be708af486d0cf93ab7de24ca70864.exe
"C:\Users\Admin\AppData\Local\Temp\619a89b25ff451282ac15cb9f2d1b65ae3be708af486d0cf93ab7de24ca70864.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4564

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
2⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:5080

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scripting

T1064

Persistence

Privilege Escalation

Defense Evasion

Scripting

T1064

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4564-130-0x0000000074FD0000-0x0000000075581000-memory.dmp

Filesize
5.7MB

Download
memory/4564-135-0x0000000074FD0000-0x0000000075581000-memory.dmp

Filesize
5.7MB

Download
memory/5080-131-0x0000000000000000-mapping.dmp

Download
memory/5080-132-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/5080-133-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/5080-134-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/5080-136-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/5080-137-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download