darkcomet | 29fbf106f4df8b68cf66dda9a909c77c1d3a8aa8e50ee5c14b0011ac0b6ce101

Analysis

max time kernel
183s
max time network
188s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
04/10/2022, 02:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
29fbf106f4df8b68cf66dda9a909c77c1d3a8aa8e50ee5c14b0011ac0b6ce101.exe
Size 439KB
Sample221004-da42fahfg7
SHA256 29fbf106f4df8b68cf66dda9a909c77c1d3a8aa8e50ee5c14b0011ac0b6ce101
MD5 61e25bc3bdbbc06fb71d87a80966902a
SHA1 635778092ce8dfadc2fa2fa48886b97d0c5875fe
SHA512 2dad29aa18492dd68dcd809f7e43cdb00e7fd0e6e1d21c19602cc126552579db0bedd7b0fccb494106d6370c48249b219f7b922cb652019559af60fad39ac9ac
SSDEEP 12288:eqzMc8lzKyP8/5getYleqAUqq0/DbttcSseQ/LDavtmIvqzPC:eciG/1OcqaqCbqQliC
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

darkcomet apex new persistence rat trojan

Malware Config

Extracted

Family

darkcomet

Botnet

Apex New

derpnerp.no-ip.org:1604

Mutex

DC_MUTEX-XU5918Q

Attributes

gencode
kgw3PxqVSVPQ
install
false
offline_keylogger
true
persistence
false

Signatures

Darkcomet
DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
trojan rat darkcomet

Executes dropped EXE 3 IoCs

pid	Process
5116	winreg.exe
5096	qxlyi.exe
1936	cvtres.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation	winreg.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation	29fbf106f4df8b68cf66dda9a909c77c1d3a8aa8e50ee5c14b0011ac0b6ce101.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Windows\CurrentVersion\Run	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Windows Regristration = "C:\\Users\\Admin\\AppData\\winreg.exe"	reg.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 5116 set thread context of 1936	5116	winreg.exe	83

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 24 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	1936	cvtres.exe
Token: SeSecurityPrivilege	1936	cvtres.exe
Token: SeTakeOwnershipPrivilege	1936	cvtres.exe
Token: SeLoadDriverPrivilege	1936	cvtres.exe
Token: SeSystemProfilePrivilege	1936	cvtres.exe
Token: SeSystemtimePrivilege	1936	cvtres.exe
Token: SeProfSingleProcessPrivilege	1936	cvtres.exe
Token: SeIncBasePriorityPrivilege	1936	cvtres.exe
Token: SeCreatePagefilePrivilege	1936	cvtres.exe
Token: SeBackupPrivilege	1936	cvtres.exe
Token: SeRestorePrivilege	1936	cvtres.exe
Token: SeShutdownPrivilege	1936	cvtres.exe
Token: SeDebugPrivilege	1936	cvtres.exe
Token: SeSystemEnvironmentPrivilege	1936	cvtres.exe
Token: SeChangeNotifyPrivilege	1936	cvtres.exe
Token: SeRemoteShutdownPrivilege	1936	cvtres.exe
Token: SeUndockPrivilege	1936	cvtres.exe
Token: SeManageVolumePrivilege	1936	cvtres.exe
Token: SeImpersonatePrivilege	1936	cvtres.exe
Token: SeCreateGlobalPrivilege	1936	cvtres.exe
Token: 33	1936	cvtres.exe
Token: 34	1936	cvtres.exe
Token: 35	1936	cvtres.exe
Token: 36	1936	cvtres.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1936	cvtres.exe

Suspicious use of WriteProcessMemory 26 IoCs

description	pid	Process	procid_target
PID 4680 wrote to memory of 5096	4680	29fbf106f4df8b68cf66dda9a909c77c1d3a8aa8e50ee5c14b0011ac0b6ce101.exe	82
PID 4680 wrote to memory of 5096	4680	29fbf106f4df8b68cf66dda9a909c77c1d3a8aa8e50ee5c14b0011ac0b6ce101.exe	82
PID 4680 wrote to memory of 5096	4680	29fbf106f4df8b68cf66dda9a909c77c1d3a8aa8e50ee5c14b0011ac0b6ce101.exe	82
PID 4680 wrote to memory of 5116	4680	29fbf106f4df8b68cf66dda9a909c77c1d3a8aa8e50ee5c14b0011ac0b6ce101.exe	81
PID 4680 wrote to memory of 5116	4680	29fbf106f4df8b68cf66dda9a909c77c1d3a8aa8e50ee5c14b0011ac0b6ce101.exe	81
PID 4680 wrote to memory of 5116	4680	29fbf106f4df8b68cf66dda9a909c77c1d3a8aa8e50ee5c14b0011ac0b6ce101.exe	81
PID 5116 wrote to memory of 1936	5116	winreg.exe	83
PID 5116 wrote to memory of 1936	5116	winreg.exe	83
PID 5116 wrote to memory of 1936	5116	winreg.exe	83
PID 5116 wrote to memory of 1936	5116	winreg.exe	83
PID 5116 wrote to memory of 1936	5116	winreg.exe	83
PID 5116 wrote to memory of 1936	5116	winreg.exe	83
PID 5116 wrote to memory of 1936	5116	winreg.exe	83
PID 5116 wrote to memory of 1936	5116	winreg.exe	83
PID 5116 wrote to memory of 1936	5116	winreg.exe	83
PID 5116 wrote to memory of 1936	5116	winreg.exe	83
PID 5116 wrote to memory of 1936	5116	winreg.exe	83
PID 5116 wrote to memory of 1936	5116	winreg.exe	83
PID 5116 wrote to memory of 1936	5116	winreg.exe	83
PID 5116 wrote to memory of 1936	5116	winreg.exe	83
PID 5116 wrote to memory of 2024	5116	winreg.exe	84
PID 5116 wrote to memory of 2024	5116	winreg.exe	84
PID 5116 wrote to memory of 2024	5116	winreg.exe	84
PID 2024 wrote to memory of 2676	2024	cmd.exe	86
PID 2024 wrote to memory of 2676	2024	cmd.exe	86
PID 2024 wrote to memory of 2676	2024	cmd.exe	86

C:\Users\Admin\AppData\Local\Temp\29fbf106f4df8b68cf66dda9a909c77c1d3a8aa8e50ee5c14b0011ac0b6ce101.exe
"C:\Users\Admin\AppData\Local\Temp\29fbf106f4df8b68cf66dda9a909c77c1d3a8aa8e50ee5c14b0011ac0b6ce101.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4680
- C:\Users\Admin\AppData\winreg.exe
  "C:\Users\Admin\AppData\winreg.exe" cvtres.exe
  2⤵
  - Executes dropped EXE
  - Checks computer location settings
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:5116
- - C:\Users\Admin\AppData\Local\Temp\cvtres.exe
    C:\Users\Admin\AppData\Local\Temp\cvtres.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    PID:1936
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Windows Regristration" /t REG_SZ /d "C:\Users\Admin\AppData\winreg.exe
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2024
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Windows Regristration" /t REG_SZ /d "C:\Users\Admin\AppData\winreg.exe
      4⤵
      Adds Run key to start application
      PID:2676
- C:\Users\Admin\AppData\qxlyi.exe
  "C:\Users\Admin\AppData\qxlyi.exe"
  2⤵
  - Executes dropped EXE
  PID:5096

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

cvtres.exe

Path C:\Users\Admin\AppData\Local\Temp\cvtres.exe
Size 1024B
SHA256 9d5efce48ed68dcb4caaa7fbecaf47ce2cab0a023afc6ceed682d1d532823773
MD5 54b1c45da8980b32759042e2c3c78dfb
SHA1 11e8bc2db98786c69e5dadf53d00ff3ee03d64f8
SHA512 73169989b97a032fe923272fbe4bc27be77e491d125b360120fc1e02419d99f807b1f62a3edaff85ebfd16e9c240ec295be9431cfe4d6c353f0cf0dbeec4d2ac
MD5 SHA1 SHA512

Submit Download

cvtres.exe

Path C:\Users\Admin\AppData\Local\Temp\cvtres.exe
Size 1024B
SHA256 9d5efce48ed68dcb4caaa7fbecaf47ce2cab0a023afc6ceed682d1d532823773
MD5 54b1c45da8980b32759042e2c3c78dfb
SHA1 11e8bc2db98786c69e5dadf53d00ff3ee03d64f8
SHA512 73169989b97a032fe923272fbe4bc27be77e491d125b360120fc1e02419d99f807b1f62a3edaff85ebfd16e9c240ec295be9431cfe4d6c353f0cf0dbeec4d2ac
MD5 SHA1 SHA512

Submit Download

qxlyi.exe

Path C:\Users\Admin\AppData\qxlyi.exe
Size 35KB
SHA256 dbe908e543cac9c75e17554f2120eef2eedd08efad7665f87981d34d40b17b34
MD5 b5c8f8e1de690d9b59a79e1ab0d9da5f
SHA1 ebe4a79aec4f5c4a3a0672925f2d7d8a8466dd8d
SHA512 450723a92fa6067dd4688d244ee0bda2bdcb64705a6bd41d530cf0c7da6c8d10d7cc0dcaea7e15f822413846ee01540d42bcd4cc452ba2cb173f1ef26f6b1805
SSDEEP 384:EkvwKwq6uvaQDjCaGiwjRtL9x/zbQD8WIFIBWZyJLk24jXPl6k3XE+O53t26YwcK:5VjC1hVNbMSaIA2XPkclC
MD5 SHA1 SHA512 SSDEEP

Submit Download

qxlyi.exe

Path C:\Users\Admin\AppData\qxlyi.exe
Size 35KB
SHA256 dbe908e543cac9c75e17554f2120eef2eedd08efad7665f87981d34d40b17b34
MD5 b5c8f8e1de690d9b59a79e1ab0d9da5f
SHA1 ebe4a79aec4f5c4a3a0672925f2d7d8a8466dd8d
SHA512 450723a92fa6067dd4688d244ee0bda2bdcb64705a6bd41d530cf0c7da6c8d10d7cc0dcaea7e15f822413846ee01540d42bcd4cc452ba2cb173f1ef26f6b1805
SSDEEP 384:EkvwKwq6uvaQDjCaGiwjRtL9x/zbQD8WIFIBWZyJLk24jXPl6k3XE+O53t26YwcK:5VjC1hVNbMSaIA2XPkclC
MD5 SHA1 SHA512 SSDEEP

Submit Download

winreg.exe

Path C:\Users\Admin\AppData\winreg.exe
Size 403KB
SHA256 66b4ce0762ef75a37bca54c50ed5e86873378817520199a9e568af8829214323
MD5 70e36247d42c2a8af16d4b56d23359ce
SHA1 cc05ebb12f8fb589215aa42a4cf51ed77713edf5
SHA512 2fcdd2f13fdaf9c9cfdb6a406d741cac8335e33c18d5d090e87422bfb023070bb93fde85857ada6f0b79e8a7f5f68d6bfd9efd6d51e0a20fe351d26dafba4954
SSDEEP 12288:jc8lzKyP8/5getYleqAUqq0/DbttcSseQ/LDavtmIvqz:jciG/1OcqaqCbqQl
MD5 SHA1 SHA512 SSDEEP

Submit Download

winreg.exe

Path C:\Users\Admin\AppData\winreg.exe
Size 403KB
SHA256 66b4ce0762ef75a37bca54c50ed5e86873378817520199a9e568af8829214323
MD5 70e36247d42c2a8af16d4b56d23359ce
SHA1 cc05ebb12f8fb589215aa42a4cf51ed77713edf5
SHA512 2fcdd2f13fdaf9c9cfdb6a406d741cac8335e33c18d5d090e87422bfb023070bb93fde85857ada6f0b79e8a7f5f68d6bfd9efd6d51e0a20fe351d26dafba4954
SSDEEP 12288:jc8lzKyP8/5getYleqAUqq0/DbttcSseQ/LDavtmIvqz:jciG/1OcqaqCbqQl
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1936-144-0x0000000000400000-0x00000000004B2000-memory.dmp

Download

memory/1936-151-0x0000000000400000-0x00000000004B2000-memory.dmp

Download

memory/1936-156-0x0000000000400000-0x00000000004B2000-memory.dmp

Download

memory/1936-161-0x0000000000400000-0x00000000004B2000-memory.dmp

Download

memory/1936-147-0x0000000000400000-0x00000000004B2000-memory.dmp

Download

memory/1936-149-0x0000000000400000-0x00000000004B2000-memory.dmp

Download

memory/4680-138-0x0000000074B10000-0x00000000750C1000-memory.dmp

Download

memory/4680-140-0x0000000074B10000-0x00000000750C1000-memory.dmp

Download

memory/4680-142-0x0000000074B10000-0x00000000750C1000-memory.dmp

Download

memory/5096-154-0x0000000000EB0000-0x0000000000EC0000-memory.dmp

Download

memory/5096-155-0x00000000058A0000-0x000000000593C000-memory.dmp

Download

memory/5096-157-0x0000000005EF0000-0x0000000006494000-memory.dmp

Download

memory/5096-158-0x0000000005940000-0x00000000059D2000-memory.dmp

Download

memory/5096-159-0x0000000005860000-0x000000000586A000-memory.dmp

Download

memory/5096-160-0x0000000005AA0000-0x0000000005AF6000-memory.dmp

Download

memory/5116-141-0x0000000074B10000-0x00000000750C1000-memory.dmp

Download

memory/5116-153-0x0000000074B10000-0x00000000750C1000-memory.dmp

Download

memory/5116-139-0x0000000074B10000-0x00000000750C1000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads