darkcomet | d7d1c3306e39345ffbc2139666f1ad2493c5f44a2013568651a5a0b8794fdca4

General

Target

d7d1c3306e39345ffbc2139666f1ad2493c5f44a2013568651a5a0b8794fdca4.exe
Size

658KB
MD5

c6e98794d2a7a96b58e6931af36bb2a5
SHA1

ee15ac66f20a5ffab46bcfbffcd6348514385970
SHA256

d7d1c3306e39345ffbc2139666f1ad2493c5f44a2013568651a5a0b8794fdca4
SHA512

a83da52e17d87fa840ad2f9fbabd21127262de18e8a799986078ca7c3355a55e8fa93c750b0795b547c15c4ce7724d3539869e91e4f4e91104970cf808503ada

Score

10^/10

darkcomet guest16_min persistence rat trojan

Malware Config

Extracted

Family

darkcomet

Botnet

Guest16_min

C2

192.168.137.154:1604

Mutex

DCMIN_MUTEX-2UDD0SF

Attributes

InstallPath
DCSCMIN\IMDCSC.exe
gencode
wRAmEt6SW9Sa
install
true
offline_keylogger
true
persistence
false
reg_key
DarkComet RAT

Signatures

Darkcomet
DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
trojan rat darkcomet

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1004

Modify Registry

T1112

Processes:

d7d1c3306e39345ffbc2139666f1ad2493c5f44a2013568651a5a0b8794fdca4.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Users\\Admin\\Documents\\DCSCMIN\\IMDCSC.exe"	d7d1c3306e39345ffbc2139666f1ad2493c5f44a2013568651a5a0b8794fdca4.exe

Executes dropped EXE 1 IoCs

Processes:

IMDCSC.exe

pid process

612 IMDCSC.exe

pid	process
612	IMDCSC.exe

Loads dropped DLL 2 IoCs

Processes:

d7d1c3306e39345ffbc2139666f1ad2493c5f44a2013568651a5a0b8794fdca4.exe

pid	process
1936	d7d1c3306e39345ffbc2139666f1ad2493c5f44a2013568651a5a0b8794fdca4.exe
1936	d7d1c3306e39345ffbc2139666f1ad2493c5f44a2013568651a5a0b8794fdca4.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

d7d1c3306e39345ffbc2139666f1ad2493c5f44a2013568651a5a0b8794fdca4.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-335065374-4263250628-1829373619-1000\Software\Microsoft\Windows\CurrentVersion\Run\DarkComet RAT = "C:\\Users\\Admin\\Documents\\DCSCMIN\\IMDCSC.exe"	d7d1c3306e39345ffbc2139666f1ad2493c5f44a2013568651a5a0b8794fdca4.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 46 IoCs

Processes:

d7d1c3306e39345ffbc2139666f1ad2493c5f44a2013568651a5a0b8794fdca4.exeIMDCSC.exe

description	pid	process
Token: SeIncreaseQuotaPrivilege	1936	d7d1c3306e39345ffbc2139666f1ad2493c5f44a2013568651a5a0b8794fdca4.exe
Token: SeSecurityPrivilege	1936	d7d1c3306e39345ffbc2139666f1ad2493c5f44a2013568651a5a0b8794fdca4.exe
Token: SeTakeOwnershipPrivilege	1936	d7d1c3306e39345ffbc2139666f1ad2493c5f44a2013568651a5a0b8794fdca4.exe
Token: SeLoadDriverPrivilege	1936	d7d1c3306e39345ffbc2139666f1ad2493c5f44a2013568651a5a0b8794fdca4.exe
Token: SeSystemProfilePrivilege	1936	d7d1c3306e39345ffbc2139666f1ad2493c5f44a2013568651a5a0b8794fdca4.exe
Token: SeSystemtimePrivilege	1936	d7d1c3306e39345ffbc2139666f1ad2493c5f44a2013568651a5a0b8794fdca4.exe
Token: SeProfSingleProcessPrivilege	1936	d7d1c3306e39345ffbc2139666f1ad2493c5f44a2013568651a5a0b8794fdca4.exe
Token: SeIncBasePriorityPrivilege	1936	d7d1c3306e39345ffbc2139666f1ad2493c5f44a2013568651a5a0b8794fdca4.exe
Token: SeCreatePagefilePrivilege	1936	d7d1c3306e39345ffbc2139666f1ad2493c5f44a2013568651a5a0b8794fdca4.exe
Token: SeBackupPrivilege	1936	d7d1c3306e39345ffbc2139666f1ad2493c5f44a2013568651a5a0b8794fdca4.exe
Token: SeRestorePrivilege	1936	d7d1c3306e39345ffbc2139666f1ad2493c5f44a2013568651a5a0b8794fdca4.exe
Token: SeShutdownPrivilege	1936	d7d1c3306e39345ffbc2139666f1ad2493c5f44a2013568651a5a0b8794fdca4.exe
Token: SeDebugPrivilege	1936	d7d1c3306e39345ffbc2139666f1ad2493c5f44a2013568651a5a0b8794fdca4.exe
Token: SeSystemEnvironmentPrivilege	1936	d7d1c3306e39345ffbc2139666f1ad2493c5f44a2013568651a5a0b8794fdca4.exe
Token: SeChangeNotifyPrivilege	1936	d7d1c3306e39345ffbc2139666f1ad2493c5f44a2013568651a5a0b8794fdca4.exe
Token: SeRemoteShutdownPrivilege	1936	d7d1c3306e39345ffbc2139666f1ad2493c5f44a2013568651a5a0b8794fdca4.exe
Token: SeUndockPrivilege	1936	d7d1c3306e39345ffbc2139666f1ad2493c5f44a2013568651a5a0b8794fdca4.exe
Token: SeManageVolumePrivilege	1936	d7d1c3306e39345ffbc2139666f1ad2493c5f44a2013568651a5a0b8794fdca4.exe
Token: SeImpersonatePrivilege	1936	d7d1c3306e39345ffbc2139666f1ad2493c5f44a2013568651a5a0b8794fdca4.exe
Token: SeCreateGlobalPrivilege	1936	d7d1c3306e39345ffbc2139666f1ad2493c5f44a2013568651a5a0b8794fdca4.exe
Token: 33	1936	d7d1c3306e39345ffbc2139666f1ad2493c5f44a2013568651a5a0b8794fdca4.exe
Token: 34	1936	d7d1c3306e39345ffbc2139666f1ad2493c5f44a2013568651a5a0b8794fdca4.exe
Token: 35	1936	d7d1c3306e39345ffbc2139666f1ad2493c5f44a2013568651a5a0b8794fdca4.exe
Token: SeIncreaseQuotaPrivilege	612	IMDCSC.exe
Token: SeSecurityPrivilege	612	IMDCSC.exe
Token: SeTakeOwnershipPrivilege	612	IMDCSC.exe
Token: SeLoadDriverPrivilege	612	IMDCSC.exe
Token: SeSystemProfilePrivilege	612	IMDCSC.exe
Token: SeSystemtimePrivilege	612	IMDCSC.exe
Token: SeProfSingleProcessPrivilege	612	IMDCSC.exe
Token: SeIncBasePriorityPrivilege	612	IMDCSC.exe
Token: SeCreatePagefilePrivilege	612	IMDCSC.exe
Token: SeBackupPrivilege	612	IMDCSC.exe
Token: SeRestorePrivilege	612	IMDCSC.exe
Token: SeShutdownPrivilege	612	IMDCSC.exe
Token: SeDebugPrivilege	612	IMDCSC.exe
Token: SeSystemEnvironmentPrivilege	612	IMDCSC.exe
Token: SeChangeNotifyPrivilege	612	IMDCSC.exe
Token: SeRemoteShutdownPrivilege	612	IMDCSC.exe
Token: SeUndockPrivilege	612	IMDCSC.exe
Token: SeManageVolumePrivilege	612	IMDCSC.exe
Token: SeImpersonatePrivilege	612	IMDCSC.exe
Token: SeCreateGlobalPrivilege	612	IMDCSC.exe
Token: 33	612	IMDCSC.exe
Token: 34	612	IMDCSC.exe
Token: 35	612	IMDCSC.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

IMDCSC.exe

pid process

612 IMDCSC.exe

pid	process
612	IMDCSC.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

d7d1c3306e39345ffbc2139666f1ad2493c5f44a2013568651a5a0b8794fdca4.exe

description	pid	process	target process
PID 1936 wrote to memory of 612	1936	d7d1c3306e39345ffbc2139666f1ad2493c5f44a2013568651a5a0b8794fdca4.exe	IMDCSC.exe
PID 1936 wrote to memory of 612	1936	d7d1c3306e39345ffbc2139666f1ad2493c5f44a2013568651a5a0b8794fdca4.exe	IMDCSC.exe
PID 1936 wrote to memory of 612	1936	d7d1c3306e39345ffbc2139666f1ad2493c5f44a2013568651a5a0b8794fdca4.exe	IMDCSC.exe
PID 1936 wrote to memory of 612	1936	d7d1c3306e39345ffbc2139666f1ad2493c5f44a2013568651a5a0b8794fdca4.exe	IMDCSC.exe

C:\Users\Admin\AppData\Local\Temp\d7d1c3306e39345ffbc2139666f1ad2493c5f44a2013568651a5a0b8794fdca4.exe
"C:\Users\Admin\AppData\Local\Temp\d7d1c3306e39345ffbc2139666f1ad2493c5f44a2013568651a5a0b8794fdca4.exe"
1⤵
- Modifies WinLogon for persistence
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1936

C:\Users\Admin\Documents\DCSCMIN\IMDCSC.exe
"C:\Users\Admin\Documents\DCSCMIN\IMDCSC.exe"
2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:612

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Winlogon Helper DLL

1

T1004

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

2

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\Documents\DCSCMIN\IMDCSC.exe
Filesize
658KB

MD5
c6e98794d2a7a96b58e6931af36bb2a5

SHA1
ee15ac66f20a5ffab46bcfbffcd6348514385970

SHA256
d7d1c3306e39345ffbc2139666f1ad2493c5f44a2013568651a5a0b8794fdca4

SHA512
a83da52e17d87fa840ad2f9fbabd21127262de18e8a799986078ca7c3355a55e8fa93c750b0795b547c15c4ce7724d3539869e91e4f4e91104970cf808503ada

Download Submit
C:\Users\Admin\Documents\DCSCMIN\IMDCSC.exe
Filesize
658KB

MD5
c6e98794d2a7a96b58e6931af36bb2a5

SHA1
ee15ac66f20a5ffab46bcfbffcd6348514385970

SHA256
d7d1c3306e39345ffbc2139666f1ad2493c5f44a2013568651a5a0b8794fdca4

SHA512
a83da52e17d87fa840ad2f9fbabd21127262de18e8a799986078ca7c3355a55e8fa93c750b0795b547c15c4ce7724d3539869e91e4f4e91104970cf808503ada

Download Submit
\Users\Admin\Documents\DCSCMIN\IMDCSC.exe
Filesize
658KB

MD5
c6e98794d2a7a96b58e6931af36bb2a5

SHA1
ee15ac66f20a5ffab46bcfbffcd6348514385970

SHA256
d7d1c3306e39345ffbc2139666f1ad2493c5f44a2013568651a5a0b8794fdca4

SHA512
a83da52e17d87fa840ad2f9fbabd21127262de18e8a799986078ca7c3355a55e8fa93c750b0795b547c15c4ce7724d3539869e91e4f4e91104970cf808503ada

Download Submit
\Users\Admin\Documents\DCSCMIN\IMDCSC.exe
Filesize
658KB

MD5
c6e98794d2a7a96b58e6931af36bb2a5

SHA1
ee15ac66f20a5ffab46bcfbffcd6348514385970

SHA256
d7d1c3306e39345ffbc2139666f1ad2493c5f44a2013568651a5a0b8794fdca4

SHA512
a83da52e17d87fa840ad2f9fbabd21127262de18e8a799986078ca7c3355a55e8fa93c750b0795b547c15c4ce7724d3539869e91e4f4e91104970cf808503ada

Download Submit
memory/612-57-0x0000000000000000-mapping.dmp

Download
memory/1936-54-0x0000000075D01000-0x0000000075D03000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads