darkcomet | 5c5ef078455d17ba4169bbeb41e38698d589ed2e70298403df5e6e208d313bd7

General

Target

5c5ef078455d17ba4169bbeb41e38698d589ed2e70298403df5e6e208d313bd7.exe
Size

356KB
MD5

93b88d2fd387095c11fe97a8c97b14d3
SHA1

0074842f206ae020b5e93ee74922715993ad810a
SHA256

5c5ef078455d17ba4169bbeb41e38698d589ed2e70298403df5e6e208d313bd7
SHA512

d12943eb82522533ff7125819bce045b9649cd53e6de4801e91ba0700bfbfcb73721c106c05f7ac509c9f3b2facc1c160ac37becb73d4e95e9359e7fddbadcf2

Score

10^/10

darkcomet slave evasion persistence rat trojan upx

Malware Config

Extracted

Family

darkcomet

Botnet

slave

C2

childsupport.no-ip.biz:13337

unknownpaq.no-ip.biz:6929

Mutex

DC_MUTEX-JG1WUQR

Attributes

gencode
kfapUZWkF6Yb
install
false
offline_keylogger
true
persistence
false

Signatures

Darkcomet
DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
trojan rat darkcomet
Windows security bypass 2 TTPs 1 IoCs
evasion trojan

Disabling Security Tools
T1089

Modify Registry
T1112

Processes:

cvtres.exe

description ioc process

Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" cvtres.exe
Sets file to hidden 1 TTPs 2 IoCs
Modifies file attributes to stop it showing in Explorer etc.
evasion

Hidden Files and Directories
T1158

Processes:

attrib.exeattrib.exe

pid process

880 attrib.exe
296 attrib.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	cvtres.exe

pid	process
880	attrib.exe
296	attrib.exe

UPX packed file 9 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral1/memory/1160-58-0x0000000000400000-0x00000000004B7000-memory.dmp	upx
behavioral1/memory/1160-56-0x0000000000400000-0x00000000004B7000-memory.dmp	upx
behavioral1/memory/1160-61-0x0000000000400000-0x00000000004B7000-memory.dmp	upx
behavioral1/memory/1160-59-0x0000000000400000-0x00000000004B7000-memory.dmp	upx
behavioral1/memory/1160-66-0x0000000000400000-0x00000000004B7000-memory.dmp	upx
behavioral1/memory/1160-68-0x0000000000400000-0x00000000004B7000-memory.dmp	upx
behavioral1/memory/1160-75-0x0000000000400000-0x00000000004B7000-memory.dmp	upx
behavioral1/memory/1160-76-0x0000000000400000-0x00000000004B7000-memory.dmp	upx
behavioral1/memory/1160-77-0x0000000000400000-0x00000000004B7000-memory.dmp	upx

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

reg.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-4084403625-2215941253-1760665084-1000\Software\Microsoft\Windows\CurrentVersion\Run\sitakas = "C:\\Users\\Admin\\AppData\\Local\\Temp\\5c5ef078455d17ba4169bbeb41e38698d589ed2e70298403df5e6e208d313bd7.exe"	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-4084403625-2215941253-1760665084-1000\Software\Microsoft\Windows\CurrentVersion\Run	reg.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

5c5ef078455d17ba4169bbeb41e38698d589ed2e70298403df5e6e208d313bd7.exe

description	pid	process	target process
PID 1092 set thread context of 1160	1092	5c5ef078455d17ba4169bbeb41e38698d589ed2e70298403df5e6e208d313bd7.exe	cvtres.exe

Drops file in Windows directory 2 IoCs

Processes:

attrib.exeattrib.exe

description	ioc	process
File opened for modification	C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe	attrib.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework\v2.0.50727	attrib.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Modifies registry key 1 TTPs 1 IoCs

Modify Registry
T1112

Processes:

reg.exe

pid process

972 reg.exe
Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

cvtres.exe

pid process

1160 cvtres.exe

pid	process
972	reg.exe

pid	process
1160	cvtres.exe

Suspicious use of AdjustPrivilegeToken 23 IoCs

Processes:

cvtres.exe

description	pid	process
Token: SeIncreaseQuotaPrivilege	1160	cvtres.exe
Token: SeSecurityPrivilege	1160	cvtres.exe
Token: SeTakeOwnershipPrivilege	1160	cvtres.exe
Token: SeLoadDriverPrivilege	1160	cvtres.exe
Token: SeSystemProfilePrivilege	1160	cvtres.exe
Token: SeSystemtimePrivilege	1160	cvtres.exe
Token: SeProfSingleProcessPrivilege	1160	cvtres.exe
Token: SeIncBasePriorityPrivilege	1160	cvtres.exe
Token: SeCreatePagefilePrivilege	1160	cvtres.exe
Token: SeBackupPrivilege	1160	cvtres.exe
Token: SeRestorePrivilege	1160	cvtres.exe
Token: SeShutdownPrivilege	1160	cvtres.exe
Token: SeDebugPrivilege	1160	cvtres.exe
Token: SeSystemEnvironmentPrivilege	1160	cvtres.exe
Token: SeChangeNotifyPrivilege	1160	cvtres.exe
Token: SeRemoteShutdownPrivilege	1160	cvtres.exe
Token: SeUndockPrivilege	1160	cvtres.exe
Token: SeManageVolumePrivilege	1160	cvtres.exe
Token: SeImpersonatePrivilege	1160	cvtres.exe
Token: SeCreateGlobalPrivilege	1160	cvtres.exe
Token: 33	1160	cvtres.exe
Token: 34	1160	cvtres.exe
Token: 35	1160	cvtres.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

cvtres.exe

pid process

1160 cvtres.exe

pid	process
1160	cvtres.exe

Suspicious use of WriteProcessMemory 59 IoCs

Processes:

5c5ef078455d17ba4169bbeb41e38698d589ed2e70298403df5e6e208d313bd7.execmd.execvtres.execmd.execmd.exe

description	pid	process	target process
PID 1092 wrote to memory of 1160	1092	5c5ef078455d17ba4169bbeb41e38698d589ed2e70298403df5e6e208d313bd7.exe	cvtres.exe
PID 1092 wrote to memory of 1160	1092	5c5ef078455d17ba4169bbeb41e38698d589ed2e70298403df5e6e208d313bd7.exe	cvtres.exe
PID 1092 wrote to memory of 1160	1092	5c5ef078455d17ba4169bbeb41e38698d589ed2e70298403df5e6e208d313bd7.exe	cvtres.exe
PID 1092 wrote to memory of 1160	1092	5c5ef078455d17ba4169bbeb41e38698d589ed2e70298403df5e6e208d313bd7.exe	cvtres.exe
PID 1092 wrote to memory of 1160	1092	5c5ef078455d17ba4169bbeb41e38698d589ed2e70298403df5e6e208d313bd7.exe	cvtres.exe
PID 1092 wrote to memory of 1160	1092	5c5ef078455d17ba4169bbeb41e38698d589ed2e70298403df5e6e208d313bd7.exe	cvtres.exe
PID 1092 wrote to memory of 1160	1092	5c5ef078455d17ba4169bbeb41e38698d589ed2e70298403df5e6e208d313bd7.exe	cvtres.exe
PID 1092 wrote to memory of 1160	1092	5c5ef078455d17ba4169bbeb41e38698d589ed2e70298403df5e6e208d313bd7.exe	cvtres.exe
PID 1092 wrote to memory of 1332	1092	5c5ef078455d17ba4169bbeb41e38698d589ed2e70298403df5e6e208d313bd7.exe	cmd.exe
PID 1092 wrote to memory of 1332	1092	5c5ef078455d17ba4169bbeb41e38698d589ed2e70298403df5e6e208d313bd7.exe	cmd.exe
PID 1092 wrote to memory of 1332	1092	5c5ef078455d17ba4169bbeb41e38698d589ed2e70298403df5e6e208d313bd7.exe	cmd.exe
PID 1092 wrote to memory of 1332	1092	5c5ef078455d17ba4169bbeb41e38698d589ed2e70298403df5e6e208d313bd7.exe	cmd.exe
PID 1092 wrote to memory of 624	1092	5c5ef078455d17ba4169bbeb41e38698d589ed2e70298403df5e6e208d313bd7.exe	cmd.exe
PID 1092 wrote to memory of 624	1092	5c5ef078455d17ba4169bbeb41e38698d589ed2e70298403df5e6e208d313bd7.exe	cmd.exe
PID 1092 wrote to memory of 624	1092	5c5ef078455d17ba4169bbeb41e38698d589ed2e70298403df5e6e208d313bd7.exe	cmd.exe
PID 1092 wrote to memory of 624	1092	5c5ef078455d17ba4169bbeb41e38698d589ed2e70298403df5e6e208d313bd7.exe	cmd.exe
PID 1332 wrote to memory of 972	1332	cmd.exe	reg.exe
PID 1332 wrote to memory of 972	1332	cmd.exe	reg.exe
PID 1332 wrote to memory of 972	1332	cmd.exe	reg.exe
PID 1332 wrote to memory of 972	1332	cmd.exe	reg.exe
PID 1160 wrote to memory of 268	1160	cvtres.exe	cmd.exe
PID 1160 wrote to memory of 268	1160	cvtres.exe	cmd.exe
PID 1160 wrote to memory of 268	1160	cvtres.exe	cmd.exe
PID 1160 wrote to memory of 268	1160	cvtres.exe	cmd.exe
PID 1160 wrote to memory of 668	1160	cvtres.exe	cmd.exe
PID 1160 wrote to memory of 668	1160	cvtres.exe	cmd.exe
PID 1160 wrote to memory of 668	1160	cvtres.exe	cmd.exe
PID 1160 wrote to memory of 668	1160	cvtres.exe	cmd.exe
PID 1160 wrote to memory of 704	1160	cvtres.exe	notepad.exe
PID 1160 wrote to memory of 704	1160	cvtres.exe	notepad.exe
PID 1160 wrote to memory of 704	1160	cvtres.exe	notepad.exe
PID 1160 wrote to memory of 704	1160	cvtres.exe	notepad.exe
PID 668 wrote to memory of 296	668	cmd.exe	attrib.exe
PID 668 wrote to memory of 296	668	cmd.exe	attrib.exe
PID 668 wrote to memory of 296	668	cmd.exe	attrib.exe
PID 668 wrote to memory of 296	668	cmd.exe	attrib.exe
PID 268 wrote to memory of 880	268	cmd.exe	attrib.exe
PID 268 wrote to memory of 880	268	cmd.exe	attrib.exe
PID 268 wrote to memory of 880	268	cmd.exe	attrib.exe
PID 268 wrote to memory of 880	268	cmd.exe	attrib.exe
PID 1160 wrote to memory of 704	1160	cvtres.exe	notepad.exe
PID 1160 wrote to memory of 704	1160	cvtres.exe	notepad.exe
PID 1160 wrote to memory of 704	1160	cvtres.exe	notepad.exe
PID 1160 wrote to memory of 704	1160	cvtres.exe	notepad.exe
PID 1160 wrote to memory of 704	1160	cvtres.exe	notepad.exe
PID 1160 wrote to memory of 704	1160	cvtres.exe	notepad.exe
PID 1160 wrote to memory of 704	1160	cvtres.exe	notepad.exe
PID 1160 wrote to memory of 704	1160	cvtres.exe	notepad.exe
PID 1160 wrote to memory of 704	1160	cvtres.exe	notepad.exe
PID 1160 wrote to memory of 704	1160	cvtres.exe	notepad.exe
PID 1160 wrote to memory of 704	1160	cvtres.exe	notepad.exe
PID 1160 wrote to memory of 704	1160	cvtres.exe	notepad.exe
PID 1160 wrote to memory of 704	1160	cvtres.exe	notepad.exe
PID 1160 wrote to memory of 704	1160	cvtres.exe	notepad.exe
PID 1160 wrote to memory of 704	1160	cvtres.exe	notepad.exe
PID 1160 wrote to memory of 704	1160	cvtres.exe	notepad.exe
PID 1160 wrote to memory of 704	1160	cvtres.exe	notepad.exe
PID 1160 wrote to memory of 704	1160	cvtres.exe	notepad.exe
PID 1160 wrote to memory of 704	1160	cvtres.exe	notepad.exe

Views/modifies file attributes 1 TTPs 2 IoCs
evasion

Hidden Files and Directories
T1158

Processes:

attrib.exeattrib.exe

pid process

880 attrib.exe
296 attrib.exe

pid	process
880	attrib.exe
296	attrib.exe

C:\Users\Admin\AppData\Local\Temp\5c5ef078455d17ba4169bbeb41e38698d589ed2e70298403df5e6e208d313bd7.exe
"C:\Users\Admin\AppData\Local\Temp\5c5ef078455d17ba4169bbeb41e38698d589ed2e70298403df5e6e208d313bd7.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1092

C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
2⤵
- Windows security bypass
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1160

C:\Windows\SysWOW64\notepad.exe
notepad
3⤵
PID:704

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\Microsoft.NET\Framework\v2.0.50727" +s +h
3⤵
- Suspicious use of WriteProcessMemory
PID:668

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe" +s +h
3⤵
- Suspicious use of WriteProcessMemory
PID:268

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" /c reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /f /v sitakas /t REG_SZ /d C:\Users\Admin\AppData\Local\Temp\5c5ef078455d17ba4169bbeb41e38698d589ed2e70298403df5e6e208d313bd7.exe & exit
2⤵
- Suspicious use of WriteProcessMemory
PID:1332

C:\Windows\SysWOW64\reg.exe
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /f /v sitakas /t REG_SZ /d C:\Users\Admin\AppData\Local\Temp\5c5ef078455d17ba4169bbeb41e38698d589ed2e70298403df5e6e208d313bd7.exe
3⤵
- Adds Run key to start application
- Modifies registry key
PID:972

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" /c copy C:\Users\Admin\AppData\Local\Temp\5c5ef078455d17ba4169bbeb41e38698d589ed2e70298403df5e6e208d313bd7.exe C:\Users\Admin\AppData\Local\Temp\5c5ef078455d17ba4169bbeb41e38698d589ed2e70298403df5e6e208d313bd7.exe /Y & exit
2⤵
PID:624

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe" +s +h
1⤵
- Sets file to hidden
- Drops file in Windows directory
- Views/modifies file attributes
PID:880

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\Microsoft.NET\Framework\v2.0.50727" +s +h
1⤵
- Sets file to hidden
- Drops file in Windows directory
- Views/modifies file attributes
PID:296

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Hidden Files and Directories

2

T1158

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Disabling Security Tools

1

T1089

Modify Registry

3

T1112

Hidden Files and Directories

2

T1158

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/268-69-0x0000000000000000-mapping.dmp

Download
memory/296-72-0x0000000000000000-mapping.dmp

Download
memory/624-64-0x0000000000000000-mapping.dmp

Download
memory/668-70-0x0000000000000000-mapping.dmp

Download
memory/704-71-0x0000000000000000-mapping.dmp

Download
memory/880-73-0x0000000000000000-mapping.dmp

Download
memory/972-65-0x0000000000000000-mapping.dmp

Download
memory/1092-67-0x0000000074A70000-0x000000007501B000-memory.dmp

Filesize
5.7MB

Download
memory/1092-54-0x0000000075761000-0x0000000075763000-memory.dmp

Filesize
8KB

Download
memory/1160-55-0x0000000000400000-0x00000000004B7000-memory.dmp

Filesize
732KB

Download
memory/1160-59-0x0000000000400000-0x00000000004B7000-memory.dmp

Filesize
732KB

Download
memory/1160-68-0x0000000000400000-0x00000000004B7000-memory.dmp

Filesize
732KB

Download
memory/1160-60-0x00000000004B5760-mapping.dmp

Download
memory/1160-61-0x0000000000400000-0x00000000004B7000-memory.dmp

Filesize
732KB

Download
memory/1160-56-0x0000000000400000-0x00000000004B7000-memory.dmp

Filesize
732KB

Download
memory/1160-58-0x0000000000400000-0x00000000004B7000-memory.dmp

Filesize
732KB

Download
memory/1160-66-0x0000000000400000-0x00000000004B7000-memory.dmp

Filesize
732KB

Download
memory/1160-75-0x0000000000400000-0x00000000004B7000-memory.dmp

Filesize
732KB

Download
memory/1160-76-0x0000000000400000-0x00000000004B7000-memory.dmp

Filesize
732KB

Download
memory/1160-77-0x0000000000400000-0x00000000004B7000-memory.dmp

Filesize
732KB

Download
memory/1332-63-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads