darkcomet | a7ce7aa4e597fc1c600c296794fcf02e2328ccb33f6a6b9fed1039257ff0c0fb

Analysis

max time kernel
155s
max time network
170s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
04/10/2022, 02:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
a7ce7aa4e597fc1c600c296794fcf02e2328ccb33f6a6b9fed1039257ff0c0fb.exe
Size 683KB
Sample221004-c8nlnsheh4
SHA256 a7ce7aa4e597fc1c600c296794fcf02e2328ccb33f6a6b9fed1039257ff0c0fb
MD5 6418cd297527bf058d2def7b1a52df9f
SHA1 b75058861501dd1013fd864da9a6630d032efabd
SHA512 deb1928a77eee3cfc5ff05ae37ee39df25ff9761ceea09baa202c35e7188e2ccae7fbf908f3132792c88500a7db6c3ffd18b9302c0048303d68970fc8c6575a2
SSDEEP 12288:DUAoFuH6zsfjSmzMvXJV7lXMlUc5kij6JAV/WMu5l2eXVuT0pAY43W07hUbi9z4q:DISLS0S5V7qic5kk6JoWMClvXaK4J9Ua
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

darkcomet h4ck persistence rat trojan

Malware Config

Extracted

Family

darkcomet

Botnet

H4ck

talts.no-ip.biz:12204

Mutex

DC_MUTEX-Z3S15JC

Attributes

gencode
zCMa2JD867ev
install
false
offline_keylogger
true
persistence
false

Signatures

Darkcomet
DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
trojan rat darkcomet

Executes dropped EXE 1 IoCs

pid	Process
1972	RISTO.scr

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	RISTO.scr
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	a7ce7aa4e597fc1c600c296794fcf02e2328ccb33f6a6b9fed1039257ff0c0fb.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RISTO = "C:\\Users\\Admin\\AppData\\Local\\Temp\\RISTO.scr"	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Windows\CurrentVersion\Run	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RISTO = "C:\\Users\\Admin\\AppData\\Local\\Temp\\RISTO.scr"	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Windows\CurrentVersion\Run	reg.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1972 set thread context of 4796	1972	RISTO.scr	87

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 26 IoCs

description	pid	Process
Token: SeDebugPrivilege	4376	a7ce7aa4e597fc1c600c296794fcf02e2328ccb33f6a6b9fed1039257ff0c0fb.exe
Token: SeDebugPrivilege	1972	RISTO.scr
Token: SeIncreaseQuotaPrivilege	4796	cvtres.exe
Token: SeSecurityPrivilege	4796	cvtres.exe
Token: SeTakeOwnershipPrivilege	4796	cvtres.exe
Token: SeLoadDriverPrivilege	4796	cvtres.exe
Token: SeSystemProfilePrivilege	4796	cvtres.exe
Token: SeSystemtimePrivilege	4796	cvtres.exe
Token: SeProfSingleProcessPrivilege	4796	cvtres.exe
Token: SeIncBasePriorityPrivilege	4796	cvtres.exe
Token: SeCreatePagefilePrivilege	4796	cvtres.exe
Token: SeBackupPrivilege	4796	cvtres.exe
Token: SeRestorePrivilege	4796	cvtres.exe
Token: SeShutdownPrivilege	4796	cvtres.exe
Token: SeDebugPrivilege	4796	cvtres.exe
Token: SeSystemEnvironmentPrivilege	4796	cvtres.exe
Token: SeChangeNotifyPrivilege	4796	cvtres.exe
Token: SeRemoteShutdownPrivilege	4796	cvtres.exe
Token: SeUndockPrivilege	4796	cvtres.exe
Token: SeManageVolumePrivilege	4796	cvtres.exe
Token: SeImpersonatePrivilege	4796	cvtres.exe
Token: SeCreateGlobalPrivilege	4796	cvtres.exe
Token: 33	4796	cvtres.exe
Token: 34	4796	cvtres.exe
Token: 35	4796	cvtres.exe
Token: 36	4796	cvtres.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4796	cvtres.exe

Suspicious use of WriteProcessMemory 29 IoCs

description	pid	Process	procid_target
PID 4376 wrote to memory of 1744	4376	a7ce7aa4e597fc1c600c296794fcf02e2328ccb33f6a6b9fed1039257ff0c0fb.exe	82
PID 4376 wrote to memory of 1744	4376	a7ce7aa4e597fc1c600c296794fcf02e2328ccb33f6a6b9fed1039257ff0c0fb.exe	82
PID 4376 wrote to memory of 1744	4376	a7ce7aa4e597fc1c600c296794fcf02e2328ccb33f6a6b9fed1039257ff0c0fb.exe	82
PID 4376 wrote to memory of 1972	4376	a7ce7aa4e597fc1c600c296794fcf02e2328ccb33f6a6b9fed1039257ff0c0fb.exe	81
PID 4376 wrote to memory of 1972	4376	a7ce7aa4e597fc1c600c296794fcf02e2328ccb33f6a6b9fed1039257ff0c0fb.exe	81
PID 4376 wrote to memory of 1972	4376	a7ce7aa4e597fc1c600c296794fcf02e2328ccb33f6a6b9fed1039257ff0c0fb.exe	81
PID 1972 wrote to memory of 3008	1972	RISTO.scr	84
PID 1972 wrote to memory of 3008	1972	RISTO.scr	84
PID 1972 wrote to memory of 3008	1972	RISTO.scr	84
PID 1744 wrote to memory of 2612	1744	cmd.exe	86
PID 1744 wrote to memory of 2612	1744	cmd.exe	86
PID 1744 wrote to memory of 2612	1744	cmd.exe	86
PID 3008 wrote to memory of 1468	3008	cmd.exe	88
PID 3008 wrote to memory of 1468	3008	cmd.exe	88
PID 3008 wrote to memory of 1468	3008	cmd.exe	88
PID 1972 wrote to memory of 4796	1972	RISTO.scr	87
PID 1972 wrote to memory of 4796	1972	RISTO.scr	87
PID 1972 wrote to memory of 4796	1972	RISTO.scr	87
PID 1972 wrote to memory of 4796	1972	RISTO.scr	87
PID 1972 wrote to memory of 4796	1972	RISTO.scr	87
PID 1972 wrote to memory of 4796	1972	RISTO.scr	87
PID 1972 wrote to memory of 4796	1972	RISTO.scr	87
PID 1972 wrote to memory of 4796	1972	RISTO.scr	87
PID 1972 wrote to memory of 4796	1972	RISTO.scr	87
PID 1972 wrote to memory of 4796	1972	RISTO.scr	87
PID 1972 wrote to memory of 4796	1972	RISTO.scr	87
PID 1972 wrote to memory of 4796	1972	RISTO.scr	87
PID 1972 wrote to memory of 4796	1972	RISTO.scr	87
PID 1972 wrote to memory of 4796	1972	RISTO.scr	87

C:\Users\Admin\AppData\Local\Temp\a7ce7aa4e597fc1c600c296794fcf02e2328ccb33f6a6b9fed1039257ff0c0fb.exe
"C:\Users\Admin\AppData\Local\Temp\a7ce7aa4e597fc1c600c296794fcf02e2328ccb33f6a6b9fed1039257ff0c0fb.exe"
1⤵
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4376
- C:\Users\Admin\AppData\Local\Temp\RISTO.scr
  "C:\Users\Admin\AppData\Local\Temp\RISTO.scr" /S
  2⤵
  - Executes dropped EXE
  - Checks computer location settings
  - Suspicious use of SetThreadContext
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1972
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "RISTO" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\RISTO.scr
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3008
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "RISTO" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\RISTO.scr
      4⤵
      Adds Run key to start application
      PID:1468
- - C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
    C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    PID:4796
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "RISTO" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\RISTO.scr
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1744
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "RISTO" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\RISTO.scr
    3⤵
    - Adds Run key to start application
    PID:2612

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RISTO.scr

Path C:\Users\Admin\AppData\Local\Temp\RISTO.scr
Size 683KB
SHA256 a7ce7aa4e597fc1c600c296794fcf02e2328ccb33f6a6b9fed1039257ff0c0fb
MD5 6418cd297527bf058d2def7b1a52df9f
SHA1 b75058861501dd1013fd864da9a6630d032efabd
SHA512 deb1928a77eee3cfc5ff05ae37ee39df25ff9761ceea09baa202c35e7188e2ccae7fbf908f3132792c88500a7db6c3ffd18b9302c0048303d68970fc8c6575a2
SSDEEP 12288:DUAoFuH6zsfjSmzMvXJV7lXMlUc5kij6JAV/WMu5l2eXVuT0pAY43W07hUbi9z4q:DISLS0S5V7qic5kk6JoWMClvXaK4J9Ua
MD5 SHA1 SHA512 SSDEEP

Submit Download

RISTO.scr

Path C:\Users\Admin\AppData\Local\Temp\RISTO.scr
Size 683KB
SHA256 a7ce7aa4e597fc1c600c296794fcf02e2328ccb33f6a6b9fed1039257ff0c0fb
MD5 6418cd297527bf058d2def7b1a52df9f
SHA1 b75058861501dd1013fd864da9a6630d032efabd
SHA512 deb1928a77eee3cfc5ff05ae37ee39df25ff9761ceea09baa202c35e7188e2ccae7fbf908f3132792c88500a7db6c3ffd18b9302c0048303d68970fc8c6575a2
SSDEEP 12288:DUAoFuH6zsfjSmzMvXJV7lXMlUc5kij6JAV/WMu5l2eXVuT0pAY43W07hUbi9z4q:DISLS0S5V7qic5kk6JoWMClvXaK4J9Ua
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1972-146-0x00000000750D0000-0x0000000075681000-memory.dmp

Download

memory/1972-138-0x00000000750D0000-0x0000000075681000-memory.dmp

Download

memory/4376-132-0x00000000750D0000-0x0000000075681000-memory.dmp

Download

memory/4376-137-0x00000000750D0000-0x0000000075681000-memory.dmp

Download

memory/4796-143-0x0000000000400000-0x00000000004B2000-memory.dmp

Download

memory/4796-144-0x0000000000400000-0x00000000004B2000-memory.dmp

Download

memory/4796-145-0x0000000000400000-0x00000000004B2000-memory.dmp

Download

memory/4796-147-0x0000000000400000-0x00000000004B2000-memory.dmp

Download

memory/4796-148-0x0000000000400000-0x00000000004B2000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads