darkcomet | e34fa6dd28f1066f6ae451d150125778505fe495553c038a84570fd4919220ab

General

Target

e34fa6dd28f1066f6ae451d150125778505fe495553c038a84570fd4919220ab.exe
Size

462KB
MD5

6291866393b4b32d071b0bae7bfd6ed0
SHA1

12af81eb85ff295cda2b9009ecb929ae6406c2e8
SHA256

e34fa6dd28f1066f6ae451d150125778505fe495553c038a84570fd4919220ab
SHA512

bf79b6a51d7564ca2e4bda1cc874f3504021e86597bbfd66088f5a1a7c1360613694d3aae76136a0d5d18738f8f245c31816d80bb3c1c9fe5589ba240c82000e
SSDEEP

12288:no06zMud7opcnKe0+QfdYK9uEaEOLB11l6y7:nolLepcnF+dYrB9zs

Score

10^/10

darkcomet teamtoxic persistence rat trojan

Malware Config

Extracted

Family

darkcomet

Botnet

TeaMtOxiC

C2

youarefucked93.no-ip.org:200

Mutex

DC_MUTEX-Z0UWREH

Attributes

gencode
3E11kecy6c1H
install
false
offline_keylogger
true
persistence
false

Signatures

Darkcomet
DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
trojan rat darkcomet
Uses the VBS compiler for execution 1 TTPs

Scripting
T1064

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\Win Update = "C:\\Users\\Admin\\AppData\\Roaming\\Win Update.exe"	e34fa6dd28f1066f6ae451d150125778505fe495553c038a84570fd4919220ab.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 884 set thread context of 916	884	e34fa6dd28f1066f6ae451d150125778505fe495553c038a84570fd4919220ab.exe	27

Suspicious use of AdjustPrivilegeToken 23 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	916	vbc.exe
Token: SeSecurityPrivilege	916	vbc.exe
Token: SeTakeOwnershipPrivilege	916	vbc.exe
Token: SeLoadDriverPrivilege	916	vbc.exe
Token: SeSystemProfilePrivilege	916	vbc.exe
Token: SeSystemtimePrivilege	916	vbc.exe
Token: SeProfSingleProcessPrivilege	916	vbc.exe
Token: SeIncBasePriorityPrivilege	916	vbc.exe
Token: SeCreatePagefilePrivilege	916	vbc.exe
Token: SeBackupPrivilege	916	vbc.exe
Token: SeRestorePrivilege	916	vbc.exe
Token: SeShutdownPrivilege	916	vbc.exe
Token: SeDebugPrivilege	916	vbc.exe
Token: SeSystemEnvironmentPrivilege	916	vbc.exe
Token: SeChangeNotifyPrivilege	916	vbc.exe
Token: SeRemoteShutdownPrivilege	916	vbc.exe
Token: SeUndockPrivilege	916	vbc.exe
Token: SeManageVolumePrivilege	916	vbc.exe
Token: SeImpersonatePrivilege	916	vbc.exe
Token: SeCreateGlobalPrivilege	916	vbc.exe
Token: 33	916	vbc.exe
Token: 34	916	vbc.exe
Token: 35	916	vbc.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
916	vbc.exe

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 884 wrote to memory of 916	884	e34fa6dd28f1066f6ae451d150125778505fe495553c038a84570fd4919220ab.exe	27
PID 884 wrote to memory of 916	884	e34fa6dd28f1066f6ae451d150125778505fe495553c038a84570fd4919220ab.exe	27
PID 884 wrote to memory of 916	884	e34fa6dd28f1066f6ae451d150125778505fe495553c038a84570fd4919220ab.exe	27
PID 884 wrote to memory of 916	884	e34fa6dd28f1066f6ae451d150125778505fe495553c038a84570fd4919220ab.exe	27
PID 884 wrote to memory of 916	884	e34fa6dd28f1066f6ae451d150125778505fe495553c038a84570fd4919220ab.exe	27
PID 884 wrote to memory of 916	884	e34fa6dd28f1066f6ae451d150125778505fe495553c038a84570fd4919220ab.exe	27
PID 884 wrote to memory of 916	884	e34fa6dd28f1066f6ae451d150125778505fe495553c038a84570fd4919220ab.exe	27
PID 884 wrote to memory of 916	884	e34fa6dd28f1066f6ae451d150125778505fe495553c038a84570fd4919220ab.exe	27
PID 884 wrote to memory of 916	884	e34fa6dd28f1066f6ae451d150125778505fe495553c038a84570fd4919220ab.exe	27
PID 884 wrote to memory of 916	884	e34fa6dd28f1066f6ae451d150125778505fe495553c038a84570fd4919220ab.exe	27
PID 884 wrote to memory of 916	884	e34fa6dd28f1066f6ae451d150125778505fe495553c038a84570fd4919220ab.exe	27
PID 884 wrote to memory of 916	884	e34fa6dd28f1066f6ae451d150125778505fe495553c038a84570fd4919220ab.exe	27
PID 884 wrote to memory of 916	884	e34fa6dd28f1066f6ae451d150125778505fe495553c038a84570fd4919220ab.exe	27

C:\Users\Admin\AppData\Local\Temp\e34fa6dd28f1066f6ae451d150125778505fe495553c038a84570fd4919220ab.exe
"C:\Users\Admin\AppData\Local\Temp\e34fa6dd28f1066f6ae451d150125778505fe495553c038a84570fd4919220ab.exe"
1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:884
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
  C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:916

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scripting

1

T1064

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

Scripting

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/884-54-0x0000000075DF1000-0x0000000075DF3000-memory.dmp

Filesize
8KB

Download
memory/884-55-0x00000000740B0000-0x000000007465B000-memory.dmp

Filesize
5.7MB

Download
memory/884-75-0x00000000740B0000-0x000000007465B000-memory.dmp

Filesize
5.7MB

Download
memory/884-74-0x00000000740B0000-0x000000007465B000-memory.dmp

Filesize
5.7MB

Download
memory/916-66-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/916-63-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/916-65-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/916-59-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/916-68-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/916-70-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/916-61-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/916-72-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/916-57-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/916-56-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/916-76-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/916-77-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/916-78-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download

Analysis

Sharing