darkcomet | 1bbec5e758d94f01b4e1d74e5b7ff2a7ed1a4ee77d06d7ffbdab6a4f73cefae6

Analysis

max time kernel
191s
max time network
216s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
20/10/2022, 21:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1bbec5e758d94f01b4e1d74e5b7ff2a7ed1a4ee77d06d7ffbdab6a4f73cefae6.exe
Size

749KB
MD5

486094543b418964041685380836c5c0
SHA1

77f671708dab7a0c197fa88917e8184acd7eb4b6
SHA256

1bbec5e758d94f01b4e1d74e5b7ff2a7ed1a4ee77d06d7ffbdab6a4f73cefae6
SHA512

a5e37ddbe9774a3ceef8eda21ea2c5440a0c432e1f2c210aa3597b92a274d155e79b76611c6d2717badc85943a576f61e634f63a742c5d397208fb7adb15101f
SSDEEP

12288:Fe+4JcBpdjfoFCY0EhCv09u1dqHUsvx2jWjjwwdwDCLO2dM61KROO4:k+4mJfoIY0Zv09u1AHpp2jWjjGDvkM65

Score

10^/10

darkcomet guest16_min persistence rat trojan

Malware Config

Extracted

Family

darkcomet

Botnet

Guest16_min

149.86.65.13:1604

Mutex

DCMIN_MUTEX-Z59R0DZ

Attributes

InstallPath
DCSCMIN\IMDCSC.exe
gencode
Q4hFgbBFCulb
install
true
offline_keylogger
true
persistence
false
reg_key
DarkComet RAT

Signatures

Darkcomet
DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
trojan rat darkcomet

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Users\\Admin\\Documents\\DCSCMIN\\IMDCSC.exe"	1bbec5e758d94f01b4e1d74e5b7ff2a7ed1a4ee77d06d7ffbdab6a4f73cefae6.exe

Executes dropped EXE 2 IoCs

pid	Process
1684	IMDCSC.exe
1880	IMDCSC.exe

Loads dropped DLL 2 IoCs

pid	Process
1672	1bbec5e758d94f01b4e1d74e5b7ff2a7ed1a4ee77d06d7ffbdab6a4f73cefae6.exe
1672	1bbec5e758d94f01b4e1d74e5b7ff2a7ed1a4ee77d06d7ffbdab6a4f73cefae6.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\DarkComet RAT = "C:\\Users\\Admin\\Documents\\DCSCMIN\\IMDCSC.exe"	1bbec5e758d94f01b4e1d74e5b7ff2a7ed1a4ee77d06d7ffbdab6a4f73cefae6.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 948 set thread context of 1672	948	1bbec5e758d94f01b4e1d74e5b7ff2a7ed1a4ee77d06d7ffbdab6a4f73cefae6.exe	28
PID 1684 set thread context of 1880	1684	IMDCSC.exe	30

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 46 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	1672	1bbec5e758d94f01b4e1d74e5b7ff2a7ed1a4ee77d06d7ffbdab6a4f73cefae6.exe
Token: SeSecurityPrivilege	1672	1bbec5e758d94f01b4e1d74e5b7ff2a7ed1a4ee77d06d7ffbdab6a4f73cefae6.exe
Token: SeTakeOwnershipPrivilege	1672	1bbec5e758d94f01b4e1d74e5b7ff2a7ed1a4ee77d06d7ffbdab6a4f73cefae6.exe
Token: SeLoadDriverPrivilege	1672	1bbec5e758d94f01b4e1d74e5b7ff2a7ed1a4ee77d06d7ffbdab6a4f73cefae6.exe
Token: SeSystemProfilePrivilege	1672	1bbec5e758d94f01b4e1d74e5b7ff2a7ed1a4ee77d06d7ffbdab6a4f73cefae6.exe
Token: SeSystemtimePrivilege	1672	1bbec5e758d94f01b4e1d74e5b7ff2a7ed1a4ee77d06d7ffbdab6a4f73cefae6.exe
Token: SeProfSingleProcessPrivilege	1672	1bbec5e758d94f01b4e1d74e5b7ff2a7ed1a4ee77d06d7ffbdab6a4f73cefae6.exe
Token: SeIncBasePriorityPrivilege	1672	1bbec5e758d94f01b4e1d74e5b7ff2a7ed1a4ee77d06d7ffbdab6a4f73cefae6.exe
Token: SeCreatePagefilePrivilege	1672	1bbec5e758d94f01b4e1d74e5b7ff2a7ed1a4ee77d06d7ffbdab6a4f73cefae6.exe
Token: SeBackupPrivilege	1672	1bbec5e758d94f01b4e1d74e5b7ff2a7ed1a4ee77d06d7ffbdab6a4f73cefae6.exe
Token: SeRestorePrivilege	1672	1bbec5e758d94f01b4e1d74e5b7ff2a7ed1a4ee77d06d7ffbdab6a4f73cefae6.exe
Token: SeShutdownPrivilege	1672	1bbec5e758d94f01b4e1d74e5b7ff2a7ed1a4ee77d06d7ffbdab6a4f73cefae6.exe
Token: SeDebugPrivilege	1672	1bbec5e758d94f01b4e1d74e5b7ff2a7ed1a4ee77d06d7ffbdab6a4f73cefae6.exe
Token: SeSystemEnvironmentPrivilege	1672	1bbec5e758d94f01b4e1d74e5b7ff2a7ed1a4ee77d06d7ffbdab6a4f73cefae6.exe
Token: SeChangeNotifyPrivilege	1672	1bbec5e758d94f01b4e1d74e5b7ff2a7ed1a4ee77d06d7ffbdab6a4f73cefae6.exe
Token: SeRemoteShutdownPrivilege	1672	1bbec5e758d94f01b4e1d74e5b7ff2a7ed1a4ee77d06d7ffbdab6a4f73cefae6.exe
Token: SeUndockPrivilege	1672	1bbec5e758d94f01b4e1d74e5b7ff2a7ed1a4ee77d06d7ffbdab6a4f73cefae6.exe
Token: SeManageVolumePrivilege	1672	1bbec5e758d94f01b4e1d74e5b7ff2a7ed1a4ee77d06d7ffbdab6a4f73cefae6.exe
Token: SeImpersonatePrivilege	1672	1bbec5e758d94f01b4e1d74e5b7ff2a7ed1a4ee77d06d7ffbdab6a4f73cefae6.exe
Token: SeCreateGlobalPrivilege	1672	1bbec5e758d94f01b4e1d74e5b7ff2a7ed1a4ee77d06d7ffbdab6a4f73cefae6.exe
Token: 33	1672	1bbec5e758d94f01b4e1d74e5b7ff2a7ed1a4ee77d06d7ffbdab6a4f73cefae6.exe
Token: 34	1672	1bbec5e758d94f01b4e1d74e5b7ff2a7ed1a4ee77d06d7ffbdab6a4f73cefae6.exe
Token: 35	1672	1bbec5e758d94f01b4e1d74e5b7ff2a7ed1a4ee77d06d7ffbdab6a4f73cefae6.exe
Token: SeIncreaseQuotaPrivilege	1880	IMDCSC.exe
Token: SeSecurityPrivilege	1880	IMDCSC.exe
Token: SeTakeOwnershipPrivilege	1880	IMDCSC.exe
Token: SeLoadDriverPrivilege	1880	IMDCSC.exe
Token: SeSystemProfilePrivilege	1880	IMDCSC.exe
Token: SeSystemtimePrivilege	1880	IMDCSC.exe
Token: SeProfSingleProcessPrivilege	1880	IMDCSC.exe
Token: SeIncBasePriorityPrivilege	1880	IMDCSC.exe
Token: SeCreatePagefilePrivilege	1880	IMDCSC.exe
Token: SeBackupPrivilege	1880	IMDCSC.exe
Token: SeRestorePrivilege	1880	IMDCSC.exe
Token: SeShutdownPrivilege	1880	IMDCSC.exe
Token: SeDebugPrivilege	1880	IMDCSC.exe
Token: SeSystemEnvironmentPrivilege	1880	IMDCSC.exe
Token: SeChangeNotifyPrivilege	1880	IMDCSC.exe
Token: SeRemoteShutdownPrivilege	1880	IMDCSC.exe
Token: SeUndockPrivilege	1880	IMDCSC.exe
Token: SeManageVolumePrivilege	1880	IMDCSC.exe
Token: SeImpersonatePrivilege	1880	IMDCSC.exe
Token: SeCreateGlobalPrivilege	1880	IMDCSC.exe
Token: 33	1880	IMDCSC.exe
Token: 34	1880	IMDCSC.exe
Token: 35	1880	IMDCSC.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
948	1bbec5e758d94f01b4e1d74e5b7ff2a7ed1a4ee77d06d7ffbdab6a4f73cefae6.exe
1684	IMDCSC.exe
1880	IMDCSC.exe

Suspicious use of WriteProcessMemory 36 IoCs

description	pid	Process	procid_target
PID 948 wrote to memory of 1672	948	1bbec5e758d94f01b4e1d74e5b7ff2a7ed1a4ee77d06d7ffbdab6a4f73cefae6.exe	28
PID 948 wrote to memory of 1672	948	1bbec5e758d94f01b4e1d74e5b7ff2a7ed1a4ee77d06d7ffbdab6a4f73cefae6.exe	28
PID 948 wrote to memory of 1672	948	1bbec5e758d94f01b4e1d74e5b7ff2a7ed1a4ee77d06d7ffbdab6a4f73cefae6.exe	28
PID 948 wrote to memory of 1672	948	1bbec5e758d94f01b4e1d74e5b7ff2a7ed1a4ee77d06d7ffbdab6a4f73cefae6.exe	28
PID 948 wrote to memory of 1672	948	1bbec5e758d94f01b4e1d74e5b7ff2a7ed1a4ee77d06d7ffbdab6a4f73cefae6.exe	28
PID 948 wrote to memory of 1672	948	1bbec5e758d94f01b4e1d74e5b7ff2a7ed1a4ee77d06d7ffbdab6a4f73cefae6.exe	28
PID 948 wrote to memory of 1672	948	1bbec5e758d94f01b4e1d74e5b7ff2a7ed1a4ee77d06d7ffbdab6a4f73cefae6.exe	28
PID 948 wrote to memory of 1672	948	1bbec5e758d94f01b4e1d74e5b7ff2a7ed1a4ee77d06d7ffbdab6a4f73cefae6.exe	28
PID 948 wrote to memory of 1672	948	1bbec5e758d94f01b4e1d74e5b7ff2a7ed1a4ee77d06d7ffbdab6a4f73cefae6.exe	28
PID 948 wrote to memory of 1672	948	1bbec5e758d94f01b4e1d74e5b7ff2a7ed1a4ee77d06d7ffbdab6a4f73cefae6.exe	28
PID 948 wrote to memory of 1672	948	1bbec5e758d94f01b4e1d74e5b7ff2a7ed1a4ee77d06d7ffbdab6a4f73cefae6.exe	28
PID 948 wrote to memory of 1672	948	1bbec5e758d94f01b4e1d74e5b7ff2a7ed1a4ee77d06d7ffbdab6a4f73cefae6.exe	28
PID 948 wrote to memory of 1672	948	1bbec5e758d94f01b4e1d74e5b7ff2a7ed1a4ee77d06d7ffbdab6a4f73cefae6.exe	28
PID 948 wrote to memory of 1672	948	1bbec5e758d94f01b4e1d74e5b7ff2a7ed1a4ee77d06d7ffbdab6a4f73cefae6.exe	28
PID 948 wrote to memory of 1672	948	1bbec5e758d94f01b4e1d74e5b7ff2a7ed1a4ee77d06d7ffbdab6a4f73cefae6.exe	28
PID 948 wrote to memory of 1672	948	1bbec5e758d94f01b4e1d74e5b7ff2a7ed1a4ee77d06d7ffbdab6a4f73cefae6.exe	28
PID 1672 wrote to memory of 1684	1672	1bbec5e758d94f01b4e1d74e5b7ff2a7ed1a4ee77d06d7ffbdab6a4f73cefae6.exe	29
PID 1672 wrote to memory of 1684	1672	1bbec5e758d94f01b4e1d74e5b7ff2a7ed1a4ee77d06d7ffbdab6a4f73cefae6.exe	29
PID 1672 wrote to memory of 1684	1672	1bbec5e758d94f01b4e1d74e5b7ff2a7ed1a4ee77d06d7ffbdab6a4f73cefae6.exe	29
PID 1672 wrote to memory of 1684	1672	1bbec5e758d94f01b4e1d74e5b7ff2a7ed1a4ee77d06d7ffbdab6a4f73cefae6.exe	29
PID 1684 wrote to memory of 1880	1684	IMDCSC.exe	30
PID 1684 wrote to memory of 1880	1684	IMDCSC.exe	30
PID 1684 wrote to memory of 1880	1684	IMDCSC.exe	30
PID 1684 wrote to memory of 1880	1684	IMDCSC.exe	30
PID 1684 wrote to memory of 1880	1684	IMDCSC.exe	30
PID 1684 wrote to memory of 1880	1684	IMDCSC.exe	30
PID 1684 wrote to memory of 1880	1684	IMDCSC.exe	30
PID 1684 wrote to memory of 1880	1684	IMDCSC.exe	30
PID 1684 wrote to memory of 1880	1684	IMDCSC.exe	30
PID 1684 wrote to memory of 1880	1684	IMDCSC.exe	30
PID 1684 wrote to memory of 1880	1684	IMDCSC.exe	30
PID 1684 wrote to memory of 1880	1684	IMDCSC.exe	30
PID 1684 wrote to memory of 1880	1684	IMDCSC.exe	30
PID 1684 wrote to memory of 1880	1684	IMDCSC.exe	30
PID 1684 wrote to memory of 1880	1684	IMDCSC.exe	30
PID 1684 wrote to memory of 1880	1684	IMDCSC.exe	30

C:\Users\Admin\AppData\Local\Temp\1bbec5e758d94f01b4e1d74e5b7ff2a7ed1a4ee77d06d7ffbdab6a4f73cefae6.exe
"C:\Users\Admin\AppData\Local\Temp\1bbec5e758d94f01b4e1d74e5b7ff2a7ed1a4ee77d06d7ffbdab6a4f73cefae6.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:948
- C:\Users\Admin\AppData\Local\Temp\1bbec5e758d94f01b4e1d74e5b7ff2a7ed1a4ee77d06d7ffbdab6a4f73cefae6.exe
  "C:\Users\Admin\AppData\Local\Temp\1bbec5e758d94f01b4e1d74e5b7ff2a7ed1a4ee77d06d7ffbdab6a4f73cefae6.exe"
  2⤵
  - Modifies WinLogon for persistence
  - Loads dropped DLL
  - Adds Run key to start application
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1672
- - C:\Users\Admin\Documents\DCSCMIN\IMDCSC.exe
    "C:\Users\Admin\Documents\DCSCMIN\IMDCSC.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1684
  - - C:\Users\Admin\Documents\DCSCMIN\IMDCSC.exe
      "C:\Users\Admin\Documents\DCSCMIN\IMDCSC.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of SetWindowsHookEx
      PID:1880

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Winlogon Helper DLL

T1004

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\Documents\DCSCMIN\IMDCSC.exe

Filesize
749KB

MD5
486094543b418964041685380836c5c0

SHA1
77f671708dab7a0c197fa88917e8184acd7eb4b6

SHA256
1bbec5e758d94f01b4e1d74e5b7ff2a7ed1a4ee77d06d7ffbdab6a4f73cefae6

SHA512
a5e37ddbe9774a3ceef8eda21ea2c5440a0c432e1f2c210aa3597b92a274d155e79b76611c6d2717badc85943a576f61e634f63a742c5d397208fb7adb15101f

Download Submit
C:\Users\Admin\Documents\DCSCMIN\IMDCSC.exe

Filesize
749KB

MD5
486094543b418964041685380836c5c0

SHA1
77f671708dab7a0c197fa88917e8184acd7eb4b6

SHA256
1bbec5e758d94f01b4e1d74e5b7ff2a7ed1a4ee77d06d7ffbdab6a4f73cefae6

SHA512
a5e37ddbe9774a3ceef8eda21ea2c5440a0c432e1f2c210aa3597b92a274d155e79b76611c6d2717badc85943a576f61e634f63a742c5d397208fb7adb15101f

Download Submit
C:\Users\Admin\Documents\DCSCMIN\IMDCSC.exe

Filesize
749KB

MD5
486094543b418964041685380836c5c0

SHA1
77f671708dab7a0c197fa88917e8184acd7eb4b6

SHA256
1bbec5e758d94f01b4e1d74e5b7ff2a7ed1a4ee77d06d7ffbdab6a4f73cefae6

SHA512
a5e37ddbe9774a3ceef8eda21ea2c5440a0c432e1f2c210aa3597b92a274d155e79b76611c6d2717badc85943a576f61e634f63a742c5d397208fb7adb15101f

Download Submit
\Users\Admin\Documents\DCSCMIN\IMDCSC.exe

Filesize
749KB

MD5
486094543b418964041685380836c5c0

SHA1
77f671708dab7a0c197fa88917e8184acd7eb4b6

SHA256
1bbec5e758d94f01b4e1d74e5b7ff2a7ed1a4ee77d06d7ffbdab6a4f73cefae6

SHA512
a5e37ddbe9774a3ceef8eda21ea2c5440a0c432e1f2c210aa3597b92a274d155e79b76611c6d2717badc85943a576f61e634f63a742c5d397208fb7adb15101f

Download Submit
\Users\Admin\Documents\DCSCMIN\IMDCSC.exe

Filesize
749KB

MD5
486094543b418964041685380836c5c0

SHA1
77f671708dab7a0c197fa88917e8184acd7eb4b6

SHA256
1bbec5e758d94f01b4e1d74e5b7ff2a7ed1a4ee77d06d7ffbdab6a4f73cefae6

SHA512
a5e37ddbe9774a3ceef8eda21ea2c5440a0c432e1f2c210aa3597b92a274d155e79b76611c6d2717badc85943a576f61e634f63a742c5d397208fb7adb15101f

Download Submit
memory/948-60-0x0000000000270000-0x0000000000276000-memory.dmp

Filesize
24KB

Download
memory/948-56-0x0000000076041000-0x0000000076043000-memory.dmp

Filesize
8KB

Download
memory/1672-57-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/1672-62-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/1672-69-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/1672-59-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/1880-78-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/1880-79-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads