darkcomet | 5dc48759d2e77819a209451c585deed3cb3ce1f85abd5149fc463c406c449d02

General

Target

5dc48759d2e77819a209451c585deed3cb3ce1f85abd5149fc463c406c449d02.exe
Size

1.6MB
MD5

92886606355e8ec3d7ee9d8486be5e07
SHA1

5d4bc8f1553042b0389286fa4d42d88cab4315a2
SHA256

5dc48759d2e77819a209451c585deed3cb3ce1f85abd5149fc463c406c449d02
SHA512

9ffda35b0a636d1836af0ccb5ec6d281d178be8ebaa931543c17c3bd09943be6d1f4cac8296c3db944cdaf5567f04f691697f72e397cf2fe667e462c1797a6ec

Score

10^/10

darkcomet work6 rat trojan

Malware Config

Extracted

Family

darkcomet

Botnet

work6

C2

leavemealone.ddnsking.com:1690

Mutex

DC_MUTEX-SHB1EEW

Attributes

gencode
ZiuqLeDH8raq
install
false
offline_keylogger
true
persistence
false

Signatures

Darkcomet
DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
trojan rat darkcomet

Suspicious use of SetThreadContext 1 IoCs

Processes:

5dc48759d2e77819a209451c585deed3cb3ce1f85abd5149fc463c406c449d02.exe

description	pid	process	target process
PID 3984 set thread context of 100	3984	5dc48759d2e77819a209451c585deed3cb3ce1f85abd5149fc463c406c449d02.exe	RegSvcs.exe

Suspicious use of AdjustPrivilegeToken 24 IoCs

Processes:

RegSvcs.exe

description	pid	process
Token: SeIncreaseQuotaPrivilege	100	RegSvcs.exe
Token: SeSecurityPrivilege	100	RegSvcs.exe
Token: SeTakeOwnershipPrivilege	100	RegSvcs.exe
Token: SeLoadDriverPrivilege	100	RegSvcs.exe
Token: SeSystemProfilePrivilege	100	RegSvcs.exe
Token: SeSystemtimePrivilege	100	RegSvcs.exe
Token: SeProfSingleProcessPrivilege	100	RegSvcs.exe
Token: SeIncBasePriorityPrivilege	100	RegSvcs.exe
Token: SeCreatePagefilePrivilege	100	RegSvcs.exe
Token: SeBackupPrivilege	100	RegSvcs.exe
Token: SeRestorePrivilege	100	RegSvcs.exe
Token: SeShutdownPrivilege	100	RegSvcs.exe
Token: SeDebugPrivilege	100	RegSvcs.exe
Token: SeSystemEnvironmentPrivilege	100	RegSvcs.exe
Token: SeChangeNotifyPrivilege	100	RegSvcs.exe
Token: SeRemoteShutdownPrivilege	100	RegSvcs.exe
Token: SeUndockPrivilege	100	RegSvcs.exe
Token: SeManageVolumePrivilege	100	RegSvcs.exe
Token: SeImpersonatePrivilege	100	RegSvcs.exe
Token: SeCreateGlobalPrivilege	100	RegSvcs.exe
Token: 33	100	RegSvcs.exe
Token: 34	100	RegSvcs.exe
Token: 35	100	RegSvcs.exe
Token: 36	100	RegSvcs.exe

Suspicious use of FindShellTrayWindow 6 IoCs

Processes:

5dc48759d2e77819a209451c585deed3cb3ce1f85abd5149fc463c406c449d02.exe

pid	process
3984	5dc48759d2e77819a209451c585deed3cb3ce1f85abd5149fc463c406c449d02.exe
3984	5dc48759d2e77819a209451c585deed3cb3ce1f85abd5149fc463c406c449d02.exe
3984	5dc48759d2e77819a209451c585deed3cb3ce1f85abd5149fc463c406c449d02.exe
3984	5dc48759d2e77819a209451c585deed3cb3ce1f85abd5149fc463c406c449d02.exe
3984	5dc48759d2e77819a209451c585deed3cb3ce1f85abd5149fc463c406c449d02.exe
3984	5dc48759d2e77819a209451c585deed3cb3ce1f85abd5149fc463c406c449d02.exe

Suspicious use of SendNotifyMessage 6 IoCs

Processes:

5dc48759d2e77819a209451c585deed3cb3ce1f85abd5149fc463c406c449d02.exe

pid	process
3984	5dc48759d2e77819a209451c585deed3cb3ce1f85abd5149fc463c406c449d02.exe
3984	5dc48759d2e77819a209451c585deed3cb3ce1f85abd5149fc463c406c449d02.exe
3984	5dc48759d2e77819a209451c585deed3cb3ce1f85abd5149fc463c406c449d02.exe
3984	5dc48759d2e77819a209451c585deed3cb3ce1f85abd5149fc463c406c449d02.exe
3984	5dc48759d2e77819a209451c585deed3cb3ce1f85abd5149fc463c406c449d02.exe
3984	5dc48759d2e77819a209451c585deed3cb3ce1f85abd5149fc463c406c449d02.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

RegSvcs.exe

pid process

100 RegSvcs.exe

pid	process
100	RegSvcs.exe

Suspicious use of WriteProcessMemory 14 IoCs

Processes:

5dc48759d2e77819a209451c585deed3cb3ce1f85abd5149fc463c406c449d02.exe

description	pid	process	target process
PID 3984 wrote to memory of 100	3984	5dc48759d2e77819a209451c585deed3cb3ce1f85abd5149fc463c406c449d02.exe	RegSvcs.exe
PID 3984 wrote to memory of 100	3984	5dc48759d2e77819a209451c585deed3cb3ce1f85abd5149fc463c406c449d02.exe	RegSvcs.exe
PID 3984 wrote to memory of 100	3984	5dc48759d2e77819a209451c585deed3cb3ce1f85abd5149fc463c406c449d02.exe	RegSvcs.exe
PID 3984 wrote to memory of 100	3984	5dc48759d2e77819a209451c585deed3cb3ce1f85abd5149fc463c406c449d02.exe	RegSvcs.exe
PID 3984 wrote to memory of 100	3984	5dc48759d2e77819a209451c585deed3cb3ce1f85abd5149fc463c406c449d02.exe	RegSvcs.exe
PID 3984 wrote to memory of 100	3984	5dc48759d2e77819a209451c585deed3cb3ce1f85abd5149fc463c406c449d02.exe	RegSvcs.exe
PID 3984 wrote to memory of 100	3984	5dc48759d2e77819a209451c585deed3cb3ce1f85abd5149fc463c406c449d02.exe	RegSvcs.exe
PID 3984 wrote to memory of 100	3984	5dc48759d2e77819a209451c585deed3cb3ce1f85abd5149fc463c406c449d02.exe	RegSvcs.exe
PID 3984 wrote to memory of 100	3984	5dc48759d2e77819a209451c585deed3cb3ce1f85abd5149fc463c406c449d02.exe	RegSvcs.exe
PID 3984 wrote to memory of 100	3984	5dc48759d2e77819a209451c585deed3cb3ce1f85abd5149fc463c406c449d02.exe	RegSvcs.exe
PID 3984 wrote to memory of 100	3984	5dc48759d2e77819a209451c585deed3cb3ce1f85abd5149fc463c406c449d02.exe	RegSvcs.exe
PID 3984 wrote to memory of 100	3984	5dc48759d2e77819a209451c585deed3cb3ce1f85abd5149fc463c406c449d02.exe	RegSvcs.exe
PID 3984 wrote to memory of 100	3984	5dc48759d2e77819a209451c585deed3cb3ce1f85abd5149fc463c406c449d02.exe	RegSvcs.exe
PID 3984 wrote to memory of 100	3984	5dc48759d2e77819a209451c585deed3cb3ce1f85abd5149fc463c406c449d02.exe	RegSvcs.exe

C:\Users\Admin\AppData\Local\Temp\5dc48759d2e77819a209451c585deed3cb3ce1f85abd5149fc463c406c449d02.exe
"C:\Users\Admin\AppData\Local\Temp\5dc48759d2e77819a209451c585deed3cb3ce1f85abd5149fc463c406c449d02.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3984

C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"
2⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:100

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/100-131-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/100-130-0x0000000000000000-mapping.dmp

Download
memory/100-132-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/100-133-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/100-134-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/100-135-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads