darkcomet | 6a7094256c550e2b09363147e579f221637dc311ca29bfc4e7afc7c5e5847dba

General

Target

6a7094256c550e2b09363147e579f221637dc311ca29bfc4e7afc7c5e5847dba.exe
Size

1.6MB
MD5

189d808e63b0cab773bf93e2d223aa1e
SHA1

ba8ae355509c8c73cd53e32d09f3b756a9876884
SHA256

6a7094256c550e2b09363147e579f221637dc311ca29bfc4e7afc7c5e5847dba
SHA512

5cd92c6f1675b6ecafc8cb713625aeca66576b368cadb186c95f283e676b1bda8e328c1d40d307e7049280b47d831413d5153cefb55b6096012c59af564e3642

Score

10^/10

darkcomet modiloader june 10 19 persistence rat trojan upx

Malware Config

Extracted

Family

darkcomet

Botnet

June 10 19

C2

bio4kobs.geekgalaxy.com:1605

Mutex

DC_MUTEX-3UZXKGG

Attributes

gencode
cKHdyd1DkDNv
install
false
offline_keylogger
true
persistence
false

Signatures

Darkcomet
DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
trojan rat darkcomet
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader

ModiLoader Second Stage 4 IoCs

Processes:

resource	yara_rule
\Users\Admin\AppData\Local\Cache.exe	modiloader_stage2
\Users\Admin\AppData\Local\Cache.exe	modiloader_stage2
C:\Users\Admin\AppData\Local\Cache.exe	modiloader_stage2
C:\Users\Admin\AppData\Local\Cache.exe	modiloader_stage2

Executes dropped EXE 1 IoCs

Processes:

Cache.exe

pid process

1652 Cache.exe

pid	process
1652	Cache.exe

UPX packed file 6 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral1/memory/1528-77-0x0000000000400000-0x00000000004B7000-memory.dmp	upx
behavioral1/memory/1528-79-0x0000000000400000-0x00000000004B7000-memory.dmp	upx
behavioral1/memory/1528-82-0x0000000000400000-0x00000000004B7000-memory.dmp	upx
behavioral1/memory/1528-83-0x0000000000400000-0x00000000004B7000-memory.dmp	upx
behavioral1/memory/1528-85-0x0000000000400000-0x00000000004B7000-memory.dmp	upx
behavioral1/memory/1528-88-0x0000000000400000-0x00000000004B7000-memory.dmp	upx

Loads dropped DLL 2 IoCs

Processes:

6a7094256c550e2b09363147e579f221637dc311ca29bfc4e7afc7c5e5847dba.exe

pid	process
288	6a7094256c550e2b09363147e579f221637dc311ca29bfc4e7afc7c5e5847dba.exe
288	6a7094256c550e2b09363147e579f221637dc311ca29bfc4e7afc7c5e5847dba.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

ctfmon.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3440072777-2118400376-1759599358-1000\Software\Microsoft\Windows\CurrentVersion\Run\rzfiot = "C:\\Users\\Admin\\AppData\\Local\\rzfiot\\rzfiot.vbs"	ctfmon.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

ctfmon.exe

description pid process target process

PID 1148 set thread context of 1528 1148 ctfmon.exe logagent.exe

description	pid	process	target process
PID 1148 set thread context of 1528	1148	ctfmon.exe	logagent.exe

Suspicious use of AdjustPrivilegeToken 23 IoCs

Processes:

logagent.exe

description	pid	process
Token: SeIncreaseQuotaPrivilege	1528	logagent.exe
Token: SeSecurityPrivilege	1528	logagent.exe
Token: SeTakeOwnershipPrivilege	1528	logagent.exe
Token: SeLoadDriverPrivilege	1528	logagent.exe
Token: SeSystemProfilePrivilege	1528	logagent.exe
Token: SeSystemtimePrivilege	1528	logagent.exe
Token: SeProfSingleProcessPrivilege	1528	logagent.exe
Token: SeIncBasePriorityPrivilege	1528	logagent.exe
Token: SeCreatePagefilePrivilege	1528	logagent.exe
Token: SeBackupPrivilege	1528	logagent.exe
Token: SeRestorePrivilege	1528	logagent.exe
Token: SeShutdownPrivilege	1528	logagent.exe
Token: SeDebugPrivilege	1528	logagent.exe
Token: SeSystemEnvironmentPrivilege	1528	logagent.exe
Token: SeChangeNotifyPrivilege	1528	logagent.exe
Token: SeRemoteShutdownPrivilege	1528	logagent.exe
Token: SeUndockPrivilege	1528	logagent.exe
Token: SeManageVolumePrivilege	1528	logagent.exe
Token: SeImpersonatePrivilege	1528	logagent.exe
Token: SeCreateGlobalPrivilege	1528	logagent.exe
Token: 33	1528	logagent.exe
Token: 34	1528	logagent.exe
Token: 35	1528	logagent.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

logagent.exe

pid process

1528 logagent.exe

pid	process
1528	logagent.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

6a7094256c550e2b09363147e579f221637dc311ca29bfc4e7afc7c5e5847dba.exeCache.exe

description	pid	process	target process
PID 288 wrote to memory of 1652	288	6a7094256c550e2b09363147e579f221637dc311ca29bfc4e7afc7c5e5847dba.exe	Cache.exe
PID 288 wrote to memory of 1652	288	6a7094256c550e2b09363147e579f221637dc311ca29bfc4e7afc7c5e5847dba.exe	Cache.exe
PID 288 wrote to memory of 1652	288	6a7094256c550e2b09363147e579f221637dc311ca29bfc4e7afc7c5e5847dba.exe	Cache.exe
PID 288 wrote to memory of 1652	288	6a7094256c550e2b09363147e579f221637dc311ca29bfc4e7afc7c5e5847dba.exe	Cache.exe
PID 1652 wrote to memory of 1148	1652	Cache.exe	ctfmon.exe
PID 1652 wrote to memory of 1148	1652	Cache.exe	ctfmon.exe
PID 1652 wrote to memory of 1148	1652	Cache.exe	ctfmon.exe
PID 1652 wrote to memory of 1148	1652	Cache.exe	ctfmon.exe
PID 1652 wrote to memory of 1148	1652	Cache.exe	ctfmon.exe
PID 1652 wrote to memory of 1148	1652	Cache.exe	ctfmon.exe
PID 1652 wrote to memory of 1148	1652	Cache.exe	ctfmon.exe
PID 1652 wrote to memory of 1148	1652	Cache.exe	ctfmon.exe
PID 1652 wrote to memory of 1148	1652	Cache.exe	ctfmon.exe
PID 1652 wrote to memory of 1148	1652	Cache.exe	ctfmon.exe
PID 1652 wrote to memory of 1148	1652	Cache.exe	ctfmon.exe
PID 1652 wrote to memory of 1148	1652	Cache.exe	ctfmon.exe
PID 1652 wrote to memory of 1148	1652	Cache.exe	ctfmon.exe
PID 1652 wrote to memory of 1148	1652	Cache.exe	ctfmon.exe
PID 1652 wrote to memory of 1148	1652	Cache.exe	ctfmon.exe
PID 1652 wrote to memory of 1148	1652	Cache.exe	ctfmon.exe
PID 1652 wrote to memory of 1148	1652	Cache.exe	ctfmon.exe
PID 1652 wrote to memory of 1148	1652	Cache.exe	ctfmon.exe
PID 1652 wrote to memory of 1148	1652	Cache.exe	ctfmon.exe
PID 1652 wrote to memory of 1148	1652	Cache.exe	ctfmon.exe
PID 1652 wrote to memory of 1148	1652	Cache.exe	ctfmon.exe
PID 1652 wrote to memory of 1148	1652	Cache.exe	ctfmon.exe
PID 1652 wrote to memory of 1148	1652	Cache.exe	ctfmon.exe
PID 1652 wrote to memory of 1148	1652	Cache.exe	ctfmon.exe
PID 1652 wrote to memory of 1148	1652	Cache.exe	ctfmon.exe
PID 1652 wrote to memory of 1148	1652	Cache.exe	ctfmon.exe
PID 1652 wrote to memory of 1148	1652	Cache.exe	ctfmon.exe
PID 1652 wrote to memory of 1148	1652	Cache.exe	ctfmon.exe
PID 1652 wrote to memory of 1148	1652	Cache.exe	ctfmon.exe
PID 1652 wrote to memory of 1148	1652	Cache.exe	ctfmon.exe
PID 1652 wrote to memory of 1148	1652	Cache.exe	ctfmon.exe
PID 1652 wrote to memory of 1148	1652	Cache.exe	ctfmon.exe
PID 1652 wrote to memory of 1148	1652	Cache.exe	ctfmon.exe
PID 1652 wrote to memory of 1148	1652	Cache.exe	ctfmon.exe
PID 1652 wrote to memory of 1148	1652	Cache.exe	ctfmon.exe
PID 1652 wrote to memory of 1148	1652	Cache.exe	ctfmon.exe
PID 1652 wrote to memory of 1148	1652	Cache.exe	ctfmon.exe
PID 1652 wrote to memory of 1148	1652	Cache.exe	ctfmon.exe
PID 1652 wrote to memory of 1148	1652	Cache.exe	ctfmon.exe
PID 1652 wrote to memory of 1148	1652	Cache.exe	ctfmon.exe
PID 1652 wrote to memory of 1148	1652	Cache.exe	ctfmon.exe
PID 1652 wrote to memory of 1148	1652	Cache.exe	ctfmon.exe
PID 1652 wrote to memory of 1148	1652	Cache.exe	ctfmon.exe
PID 1652 wrote to memory of 1148	1652	Cache.exe	ctfmon.exe
PID 1652 wrote to memory of 1148	1652	Cache.exe	ctfmon.exe
PID 1652 wrote to memory of 1148	1652	Cache.exe	ctfmon.exe
PID 1652 wrote to memory of 1148	1652	Cache.exe	ctfmon.exe
PID 1652 wrote to memory of 1148	1652	Cache.exe	ctfmon.exe
PID 1652 wrote to memory of 1148	1652	Cache.exe	ctfmon.exe
PID 1652 wrote to memory of 1148	1652	Cache.exe	ctfmon.exe
PID 1652 wrote to memory of 1148	1652	Cache.exe	ctfmon.exe
PID 1652 wrote to memory of 1148	1652	Cache.exe	ctfmon.exe
PID 1652 wrote to memory of 1148	1652	Cache.exe	ctfmon.exe
PID 1652 wrote to memory of 1148	1652	Cache.exe	ctfmon.exe
PID 1652 wrote to memory of 1148	1652	Cache.exe	ctfmon.exe
PID 1652 wrote to memory of 1148	1652	Cache.exe	ctfmon.exe
PID 1652 wrote to memory of 1148	1652	Cache.exe	ctfmon.exe
PID 1652 wrote to memory of 1148	1652	Cache.exe	ctfmon.exe
PID 1652 wrote to memory of 1148	1652	Cache.exe	ctfmon.exe
PID 1652 wrote to memory of 1148	1652	Cache.exe	ctfmon.exe

C:\Users\Admin\AppData\Local\Temp\6a7094256c550e2b09363147e579f221637dc311ca29bfc4e7afc7c5e5847dba.exe
"C:\Users\Admin\AppData\Local\Temp\6a7094256c550e2b09363147e579f221637dc311ca29bfc4e7afc7c5e5847dba.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:288

C:\Users\Admin\AppData\Local\Cache.exe
C:\Users\Admin\AppData\Local\Cache.exe
2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1652

C:\Windows\SysWOW64\ctfmon.exe
ctfmon.exe
3⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
PID:1148

C:\Windows\SysWOW64\logagent.exe
logagent.exe
4⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1528

C:\Windows\SysWOW64\notepad.exe
notepad
5⤵
PID:856

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Cache.exe
Filesize
413KB

MD5
c6db6ae46411c10036f472634524d56e

SHA1
edea43634f29770ae45806a3784c92d936cb39d0

SHA256
5d383909ae9cb8cd0cd947c6dd7c1b4efa4c6ee390ac205c796ee659c7846261

SHA512
b898f47b688f51f36ef6eb49b9d84abcac7c72beacf5eba61a53f8d1e9173bf3180917538826fac52bcecedf075fe56052f0f5658b757048f8e957eb675c54ec

Download Submit
C:\Users\Admin\AppData\Local\Cache.exe
Filesize
413KB

MD5
c6db6ae46411c10036f472634524d56e

SHA1
edea43634f29770ae45806a3784c92d936cb39d0

SHA256
5d383909ae9cb8cd0cd947c6dd7c1b4efa4c6ee390ac205c796ee659c7846261

SHA512
b898f47b688f51f36ef6eb49b9d84abcac7c72beacf5eba61a53f8d1e9173bf3180917538826fac52bcecedf075fe56052f0f5658b757048f8e957eb675c54ec

Download Submit
C:\Users\Admin\AppData\Local\Tm.bmp
Filesize
690KB

MD5
b18c102b88890dec91896b5a591bd59d

SHA1
9cd180e2d83f72013d4be79dc0f59abbb33ec159

SHA256
fabc7103396904bd7d967c81ffea1218c1cc7adf5bc33d7ff29fdcbc206bb0f2

SHA512
14a1fe14b825cd7c8bf230a6aeb5bc74d9738ab2cbe715e8dcd0056a12a19184c0b636f80d699d465989372b0dbcd1a3905a49c218dd96170c79a09c2f4567d1

Download Submit
\Users\Admin\AppData\Local\Cache.exe
Filesize
413KB

MD5
c6db6ae46411c10036f472634524d56e

SHA1
edea43634f29770ae45806a3784c92d936cb39d0

SHA256
5d383909ae9cb8cd0cd947c6dd7c1b4efa4c6ee390ac205c796ee659c7846261

SHA512
b898f47b688f51f36ef6eb49b9d84abcac7c72beacf5eba61a53f8d1e9173bf3180917538826fac52bcecedf075fe56052f0f5658b757048f8e957eb675c54ec

Download Submit
\Users\Admin\AppData\Local\Cache.exe
Filesize
413KB

MD5
c6db6ae46411c10036f472634524d56e

SHA1
edea43634f29770ae45806a3784c92d936cb39d0

SHA256
5d383909ae9cb8cd0cd947c6dd7c1b4efa4c6ee390ac205c796ee659c7846261

SHA512
b898f47b688f51f36ef6eb49b9d84abcac7c72beacf5eba61a53f8d1e9173bf3180917538826fac52bcecedf075fe56052f0f5658b757048f8e957eb675c54ec

Download Submit
memory/288-54-0x0000000076191000-0x0000000076193000-memory.dmp

Filesize
8KB

Download
memory/288-55-0x0000000000400000-0x00000000005DC000-memory.dmp

Filesize
1.9MB

Download
memory/288-56-0x0000000000400000-0x00000000005DC000-memory.dmp

Filesize
1.9MB

Download
memory/288-61-0x0000000000400000-0x00000000005DC000-memory.dmp

Filesize
1.9MB

Download
memory/856-86-0x0000000000000000-mapping.dmp

Download
memory/1148-74-0x0000000020010000-0x00000000200A0000-memory.dmp

Filesize
576KB

Download
memory/1148-84-0x0000000020010000-0x00000000200A0000-memory.dmp

Filesize
576KB

Download
memory/1148-72-0x0000000020010000-0x00000000200A0000-memory.dmp

Filesize
576KB

Download
memory/1148-65-0x0000000000000000-mapping.dmp

Download
memory/1528-77-0x0000000000400000-0x00000000004B7000-memory.dmp

Filesize
732KB

Download
memory/1528-78-0x00000000004B5680-mapping.dmp

Download
memory/1528-79-0x0000000000400000-0x00000000004B7000-memory.dmp

Filesize
732KB

Download
memory/1528-75-0x0000000000400000-0x00000000004B7000-memory.dmp

Filesize
732KB

Download
memory/1528-82-0x0000000000400000-0x00000000004B7000-memory.dmp

Filesize
732KB

Download
memory/1528-83-0x0000000000400000-0x00000000004B7000-memory.dmp

Filesize
732KB

Download
memory/1528-85-0x0000000000400000-0x00000000004B7000-memory.dmp

Filesize
732KB

Download
memory/1528-88-0x0000000000400000-0x00000000004B7000-memory.dmp

Filesize
732KB

Download
memory/1652-66-0x0000000020010000-0x00000000200A0000-memory.dmp

Filesize
576KB

Download
memory/1652-59-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads