darkcomet | 1e23a8c32750549cce7c07c6d2f657b8bf3d4d818553ca82086aca3964e88e89

General

Target
1e23a8c32750549cce7c07c6d2f657b8bf3d4d818553ca82086aca3964e88e89.exe
Size 853KB
Sample221003-njczesdfd3
SHA256 1e23a8c32750549cce7c07c6d2f657b8bf3d4d818553ca82086aca3964e88e89
MD5 695c32bacd35691dd28286e75ec7afb0
SHA1 a96d0dad6b5f1100c286895df5565cdb9404ff21
SHA512 328073e5d79987df9614ce3ead88a5b35194290e89aa5d34ba4081f32df51652691d18f8a4fa5fd624898eca1c20dfc7978d4a1522a3727971475e69e396d6ab
SSDEEP 24576:UL4wOheqn4XpUoTrKoO3J7p/1nrXG7p/on6HehNHLz:lwOaUwrKog7ptXvndhNrz
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

darkcomet vittima rat trojan

Malware Config

Extracted

Family

darkcomet

Botnet

Vittima

C2

xblitz.no-ip.biz:1604

Mutex

DC_MUTEX-1L07FZZ

Attributes

gencode
20p7fMDkycyd
install
false
offline_keylogger
true
persistence
false

Signatures

Darkcomet
DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
trojan rat darkcomet

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 4856 set thread context of 4800	4856	1e23a8c32750549cce7c07c6d2f657b8bf3d4d818553ca82086aca3964e88e89.exe	83
PID 4800 set thread context of 684	4800	1e23a8c32750549cce7c07c6d2f657b8bf3d4d818553ca82086aca3964e88e89.exe	84

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 24 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	684	1e23a8c32750549cce7c07c6d2f657b8bf3d4d818553ca82086aca3964e88e89.exe
Token: SeSecurityPrivilege	684	1e23a8c32750549cce7c07c6d2f657b8bf3d4d818553ca82086aca3964e88e89.exe
Token: SeTakeOwnershipPrivilege	684	1e23a8c32750549cce7c07c6d2f657b8bf3d4d818553ca82086aca3964e88e89.exe
Token: SeLoadDriverPrivilege	684	1e23a8c32750549cce7c07c6d2f657b8bf3d4d818553ca82086aca3964e88e89.exe
Token: SeSystemProfilePrivilege	684	1e23a8c32750549cce7c07c6d2f657b8bf3d4d818553ca82086aca3964e88e89.exe
Token: SeSystemtimePrivilege	684	1e23a8c32750549cce7c07c6d2f657b8bf3d4d818553ca82086aca3964e88e89.exe
Token: SeProfSingleProcessPrivilege	684	1e23a8c32750549cce7c07c6d2f657b8bf3d4d818553ca82086aca3964e88e89.exe
Token: SeIncBasePriorityPrivilege	684	1e23a8c32750549cce7c07c6d2f657b8bf3d4d818553ca82086aca3964e88e89.exe
Token: SeCreatePagefilePrivilege	684	1e23a8c32750549cce7c07c6d2f657b8bf3d4d818553ca82086aca3964e88e89.exe
Token: SeBackupPrivilege	684	1e23a8c32750549cce7c07c6d2f657b8bf3d4d818553ca82086aca3964e88e89.exe
Token: SeRestorePrivilege	684	1e23a8c32750549cce7c07c6d2f657b8bf3d4d818553ca82086aca3964e88e89.exe
Token: SeShutdownPrivilege	684	1e23a8c32750549cce7c07c6d2f657b8bf3d4d818553ca82086aca3964e88e89.exe
Token: SeDebugPrivilege	684	1e23a8c32750549cce7c07c6d2f657b8bf3d4d818553ca82086aca3964e88e89.exe
Token: SeSystemEnvironmentPrivilege	684	1e23a8c32750549cce7c07c6d2f657b8bf3d4d818553ca82086aca3964e88e89.exe
Token: SeChangeNotifyPrivilege	684	1e23a8c32750549cce7c07c6d2f657b8bf3d4d818553ca82086aca3964e88e89.exe
Token: SeRemoteShutdownPrivilege	684	1e23a8c32750549cce7c07c6d2f657b8bf3d4d818553ca82086aca3964e88e89.exe
Token: SeUndockPrivilege	684	1e23a8c32750549cce7c07c6d2f657b8bf3d4d818553ca82086aca3964e88e89.exe
Token: SeManageVolumePrivilege	684	1e23a8c32750549cce7c07c6d2f657b8bf3d4d818553ca82086aca3964e88e89.exe
Token: SeImpersonatePrivilege	684	1e23a8c32750549cce7c07c6d2f657b8bf3d4d818553ca82086aca3964e88e89.exe
Token: SeCreateGlobalPrivilege	684	1e23a8c32750549cce7c07c6d2f657b8bf3d4d818553ca82086aca3964e88e89.exe
Token: 33	684	1e23a8c32750549cce7c07c6d2f657b8bf3d4d818553ca82086aca3964e88e89.exe
Token: 34	684	1e23a8c32750549cce7c07c6d2f657b8bf3d4d818553ca82086aca3964e88e89.exe
Token: 35	684	1e23a8c32750549cce7c07c6d2f657b8bf3d4d818553ca82086aca3964e88e89.exe
Token: 36	684	1e23a8c32750549cce7c07c6d2f657b8bf3d4d818553ca82086aca3964e88e89.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
684	1e23a8c32750549cce7c07c6d2f657b8bf3d4d818553ca82086aca3964e88e89.exe

Suspicious use of WriteProcessMemory 23 IoCs

description	pid	Process	procid_target
PID 4856 wrote to memory of 4800	4856	1e23a8c32750549cce7c07c6d2f657b8bf3d4d818553ca82086aca3964e88e89.exe	83
PID 4856 wrote to memory of 4800	4856	1e23a8c32750549cce7c07c6d2f657b8bf3d4d818553ca82086aca3964e88e89.exe	83
PID 4856 wrote to memory of 4800	4856	1e23a8c32750549cce7c07c6d2f657b8bf3d4d818553ca82086aca3964e88e89.exe	83
PID 4856 wrote to memory of 4800	4856	1e23a8c32750549cce7c07c6d2f657b8bf3d4d818553ca82086aca3964e88e89.exe	83
PID 4856 wrote to memory of 4800	4856	1e23a8c32750549cce7c07c6d2f657b8bf3d4d818553ca82086aca3964e88e89.exe	83
PID 4856 wrote to memory of 4800	4856	1e23a8c32750549cce7c07c6d2f657b8bf3d4d818553ca82086aca3964e88e89.exe	83
PID 4856 wrote to memory of 4800	4856	1e23a8c32750549cce7c07c6d2f657b8bf3d4d818553ca82086aca3964e88e89.exe	83
PID 4856 wrote to memory of 4800	4856	1e23a8c32750549cce7c07c6d2f657b8bf3d4d818553ca82086aca3964e88e89.exe	83
PID 4856 wrote to memory of 4800	4856	1e23a8c32750549cce7c07c6d2f657b8bf3d4d818553ca82086aca3964e88e89.exe	83
PID 4800 wrote to memory of 684	4800	1e23a8c32750549cce7c07c6d2f657b8bf3d4d818553ca82086aca3964e88e89.exe	84
PID 4800 wrote to memory of 684	4800	1e23a8c32750549cce7c07c6d2f657b8bf3d4d818553ca82086aca3964e88e89.exe	84
PID 4800 wrote to memory of 684	4800	1e23a8c32750549cce7c07c6d2f657b8bf3d4d818553ca82086aca3964e88e89.exe	84
PID 4800 wrote to memory of 684	4800	1e23a8c32750549cce7c07c6d2f657b8bf3d4d818553ca82086aca3964e88e89.exe	84
PID 4800 wrote to memory of 684	4800	1e23a8c32750549cce7c07c6d2f657b8bf3d4d818553ca82086aca3964e88e89.exe	84
PID 4800 wrote to memory of 684	4800	1e23a8c32750549cce7c07c6d2f657b8bf3d4d818553ca82086aca3964e88e89.exe	84
PID 4800 wrote to memory of 684	4800	1e23a8c32750549cce7c07c6d2f657b8bf3d4d818553ca82086aca3964e88e89.exe	84
PID 4800 wrote to memory of 684	4800	1e23a8c32750549cce7c07c6d2f657b8bf3d4d818553ca82086aca3964e88e89.exe	84
PID 4800 wrote to memory of 684	4800	1e23a8c32750549cce7c07c6d2f657b8bf3d4d818553ca82086aca3964e88e89.exe	84
PID 4800 wrote to memory of 684	4800	1e23a8c32750549cce7c07c6d2f657b8bf3d4d818553ca82086aca3964e88e89.exe	84
PID 4800 wrote to memory of 684	4800	1e23a8c32750549cce7c07c6d2f657b8bf3d4d818553ca82086aca3964e88e89.exe	84
PID 4800 wrote to memory of 684	4800	1e23a8c32750549cce7c07c6d2f657b8bf3d4d818553ca82086aca3964e88e89.exe	84
PID 4800 wrote to memory of 684	4800	1e23a8c32750549cce7c07c6d2f657b8bf3d4d818553ca82086aca3964e88e89.exe	84
PID 4800 wrote to memory of 684	4800	1e23a8c32750549cce7c07c6d2f657b8bf3d4d818553ca82086aca3964e88e89.exe	84

C:\Users\Admin\AppData\Local\Temp\1e23a8c32750549cce7c07c6d2f657b8bf3d4d818553ca82086aca3964e88e89.exe
"C:\Users\Admin\AppData\Local\Temp\1e23a8c32750549cce7c07c6d2f657b8bf3d4d818553ca82086aca3964e88e89.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4856
- C:\Users\Admin\AppData\Local\Temp\1e23a8c32750549cce7c07c6d2f657b8bf3d4d818553ca82086aca3964e88e89.exe
  C:\Users\Admin\AppData\Local\Temp\1e23a8c32750549cce7c07c6d2f657b8bf3d4d818553ca82086aca3964e88e89.exe
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:4800
- - C:\Users\Admin\AppData\Local\Temp\1e23a8c32750549cce7c07c6d2f657b8bf3d4d818553ca82086aca3964e88e89.exe
    C:\Users\Admin\AppData\Local\Temp\1e23a8c32750549cce7c07c6d2f657b8bf3d4d818553ca82086aca3964e88e89.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    PID:684

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/684-138-0x0000000000400000-0x00000000004B2000-memory.dmp

Download

memory/684-139-0x0000000000400000-0x00000000004B2000-memory.dmp

Download

memory/684-141-0x0000000000400000-0x00000000004B2000-memory.dmp

Download

memory/684-142-0x0000000000400000-0x00000000004B2000-memory.dmp

Download

memory/684-143-0x0000000000400000-0x00000000004B2000-memory.dmp

Download

memory/4800-133-0x0000000000400000-0x00000000004C0000-memory.dmp

Download

memory/4800-134-0x0000000000400000-0x00000000004C0000-memory.dmp

Download

memory/4800-136-0x0000000000400000-0x00000000004C0000-memory.dmp

Download

memory/4800-140-0x0000000000400000-0x00000000004C0000-memory.dmp

Download

memory/4856-135-0x0000000002220000-0x0000000002224000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads