darkcomet | 85ab080597b47467ad4145a456c9cc85da9036a2892b7ebd06121f05c9dcb7ad

Analysis

max time kernel
151s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
19/10/2022, 22:23

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
85ab080597b47467ad4145a456c9cc85da9036a2892b7ebd06121f05c9dcb7ad.exe
Size 668KB
Sample221019-2a4mnsbbbq
SHA256 85ab080597b47467ad4145a456c9cc85da9036a2892b7ebd06121f05c9dcb7ad
MD5 a13bb28a1775aacb5d648c0b4efada40
SHA1 b97cc6e019a4a52e411eb1e75d349d18364bb0a0
SHA512 f770c55d7b933a27c1450c9b38fd988c9ccc82f6bd572fe81f3aa41202eeededcc193c2daa57b860fec28d062313cd9ea8244f9baff73bf5c3873500b3f8660b
SSDEEP 12288:9hp8giY4D6Qk5riGBVZ6Oh5ZYOZ90xHPlbGPT0uRawf6yYVgxP+eyCgPdYq3NIX0:9X8gj4bk5r7VZ6s5ZFZ9YHPtGPouRn6d
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

darkcomet persistence rat trojan upx

Malware Config

Signatures

Darkcomet
DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
trojan rat darkcomet

Executes dropped EXE 2 IoCs

pid	Process
1540	winini.exe
5020	cvtres.exe

UPX packed file 7 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/5020-139-0x0000000000400000-0x00000000004C7000-memory.dmp	upx
behavioral2/memory/5020-142-0x0000000000400000-0x00000000004C7000-memory.dmp	upx
behavioral2/memory/5020-143-0x0000000000400000-0x00000000004C7000-memory.dmp	upx
behavioral2/memory/5020-146-0x0000000000400000-0x00000000004C7000-memory.dmp	upx
behavioral2/memory/5020-147-0x0000000000400000-0x00000000004C7000-memory.dmp	upx
behavioral2/memory/5020-148-0x0000000000400000-0x00000000004C7000-memory.dmp	upx
behavioral2/memory/5020-149-0x0000000000400000-0x00000000004C7000-memory.dmp	upx

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation	85ab080597b47467ad4145a456c9cc85da9036a2892b7ebd06121f05c9dcb7ad.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Windows Live = "C:\\Users\\Admin\\AppData\\Local\\Temp\\winini.exe"	winini.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1540 set thread context of 5020	1540	winini.exe	85

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 24 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	5020	cvtres.exe
Token: SeSecurityPrivilege	5020	cvtres.exe
Token: SeTakeOwnershipPrivilege	5020	cvtres.exe
Token: SeLoadDriverPrivilege	5020	cvtres.exe
Token: SeSystemProfilePrivilege	5020	cvtres.exe
Token: SeSystemtimePrivilege	5020	cvtres.exe
Token: SeProfSingleProcessPrivilege	5020	cvtres.exe
Token: SeIncBasePriorityPrivilege	5020	cvtres.exe
Token: SeCreatePagefilePrivilege	5020	cvtres.exe
Token: SeBackupPrivilege	5020	cvtres.exe
Token: SeRestorePrivilege	5020	cvtres.exe
Token: SeShutdownPrivilege	5020	cvtres.exe
Token: SeDebugPrivilege	5020	cvtres.exe
Token: SeSystemEnvironmentPrivilege	5020	cvtres.exe
Token: SeChangeNotifyPrivilege	5020	cvtres.exe
Token: SeRemoteShutdownPrivilege	5020	cvtres.exe
Token: SeUndockPrivilege	5020	cvtres.exe
Token: SeManageVolumePrivilege	5020	cvtres.exe
Token: SeImpersonatePrivilege	5020	cvtres.exe
Token: SeCreateGlobalPrivilege	5020	cvtres.exe
Token: 33	5020	cvtres.exe
Token: 34	5020	cvtres.exe
Token: 35	5020	cvtres.exe
Token: 36	5020	cvtres.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 400 wrote to memory of 1540	400	85ab080597b47467ad4145a456c9cc85da9036a2892b7ebd06121f05c9dcb7ad.exe	82
PID 400 wrote to memory of 1540	400	85ab080597b47467ad4145a456c9cc85da9036a2892b7ebd06121f05c9dcb7ad.exe	82
PID 400 wrote to memory of 1540	400	85ab080597b47467ad4145a456c9cc85da9036a2892b7ebd06121f05c9dcb7ad.exe	82
PID 1540 wrote to memory of 5020	1540	winini.exe	85
PID 1540 wrote to memory of 5020	1540	winini.exe	85
PID 1540 wrote to memory of 5020	1540	winini.exe	85
PID 1540 wrote to memory of 5020	1540	winini.exe	85
PID 1540 wrote to memory of 5020	1540	winini.exe	85
PID 1540 wrote to memory of 5020	1540	winini.exe	85
PID 1540 wrote to memory of 5020	1540	winini.exe	85
PID 1540 wrote to memory of 5020	1540	winini.exe	85

C:\Users\Admin\AppData\Local\Temp\85ab080597b47467ad4145a456c9cc85da9036a2892b7ebd06121f05c9dcb7ad.exe
"C:\Users\Admin\AppData\Local\Temp\85ab080597b47467ad4145a456c9cc85da9036a2892b7ebd06121f05c9dcb7ad.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:400
- C:\Users\Admin\AppData\Local\Temp\winini.exe
  "C:\Users\Admin\AppData\Local\Temp\winini.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:1540
- - C:\Users\Admin\AppData\Local\Temp\cvtres.exe
    C:\Users\Admin\AppData\Local\Temp\cvtres.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    PID:5020

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

cvtres.exe

Path C:\Users\Admin\AppData\Local\Temp\cvtres.exe
Size 34KB
SHA256 3a0f2936b8c45e8ba3458d69d7859a63844469e698652e15fb56639d32f40cc9
MD5 e118330b4629b12368d91b9df6488be0
SHA1 ce90218c7e3b90df2a3409ec253048bb6472c2fd
SHA512 ac91c04cb20223dbaaf594440cb778dff36e857921be427c8528ba4c6cdb3e8bf8e71e1ae8af7bde9c04ff5b97b379231625bc1a2b66aba2f98cd340cd8a94b0
SSDEEP 768:Paq4bp49YK+2Cza0pS6icHmMl9CvwOElkn3yKdn5y85p3:ud4+KTMVJHmMsEBKdn5vj
MD5 SHA1 SHA512 SSDEEP

Submit Download

cvtres.exe

Path C:\Users\Admin\AppData\Local\Temp\cvtres.exe
Size 34KB
SHA256 3a0f2936b8c45e8ba3458d69d7859a63844469e698652e15fb56639d32f40cc9
MD5 e118330b4629b12368d91b9df6488be0
SHA1 ce90218c7e3b90df2a3409ec253048bb6472c2fd
SHA512 ac91c04cb20223dbaaf594440cb778dff36e857921be427c8528ba4c6cdb3e8bf8e71e1ae8af7bde9c04ff5b97b379231625bc1a2b66aba2f98cd340cd8a94b0
SSDEEP 768:Paq4bp49YK+2Cza0pS6icHmMl9CvwOElkn3yKdn5y85p3:ud4+KTMVJHmMsEBKdn5vj
MD5 SHA1 SHA512 SSDEEP

Submit Download

winini.exe

Path C:\Users\Admin\AppData\Local\Temp\winini.exe
Size 452KB
SHA256 eacf3caaf3cb282b283ad908958293800bc458e5c2398b3b2c6196ee21b451a1
MD5 ee466b594a32f4f804e4d4fbdbf289d5
SHA1 7711bfb8f5d23dffed2d7ef8aff60c4aaebc6de7
SHA512 046e14f60a5a68cd4a69368f914d993eedbd661dd3dd5d242d78e9369a8ce8ea17975e672d2ec007335c64211b1615395376a4f6e137f5a6b82319940712b66e
SSDEEP 12288:gUtGnCATSNpETBLeuEqXE3z6qI/SRkLm:RGCsSrGhAz6ZukLm
MD5 SHA1 SHA512 SSDEEP

Submit Download

winini.exe

Path C:\Users\Admin\AppData\Local\Temp\winini.exe
Size 452KB
SHA256 eacf3caaf3cb282b283ad908958293800bc458e5c2398b3b2c6196ee21b451a1
MD5 ee466b594a32f4f804e4d4fbdbf289d5
SHA1 7711bfb8f5d23dffed2d7ef8aff60c4aaebc6de7
SHA512 046e14f60a5a68cd4a69368f914d993eedbd661dd3dd5d242d78e9369a8ce8ea17975e672d2ec007335c64211b1615395376a4f6e137f5a6b82319940712b66e
SSDEEP 12288:gUtGnCATSNpETBLeuEqXE3z6qI/SRkLm:RGCsSrGhAz6ZukLm
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/400-136-0x0000000074B10000-0x00000000750C1000-memory.dmp

Download

memory/400-132-0x0000000074B10000-0x00000000750C1000-memory.dmp

Download

memory/1540-137-0x0000000074B10000-0x00000000750C1000-memory.dmp

Download

memory/1540-145-0x0000000074B10000-0x00000000750C1000-memory.dmp

Download

memory/5020-139-0x0000000000400000-0x00000000004C7000-memory.dmp

Download

memory/5020-142-0x0000000000400000-0x00000000004C7000-memory.dmp

Download

memory/5020-143-0x0000000000400000-0x00000000004C7000-memory.dmp

Download

memory/5020-146-0x0000000000400000-0x00000000004C7000-memory.dmp

Download

memory/5020-147-0x0000000000400000-0x00000000004C7000-memory.dmp

Download

memory/5020-148-0x0000000000400000-0x00000000004C7000-memory.dmp

Download

memory/5020-149-0x0000000000400000-0x00000000004C7000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads