darkcomet | 1899946bc8a0c6236273c13301749aace2c90889f38653aeb97c71e51f4541d6

General

Target

1899946bc8a0c6236273c13301749aace2c90889f38653aeb97c71e51f4541d6.exe
Size

843KB
MD5

0dd84b2f7d18d4be8ae0e9ec4b9c8b58
SHA1

2a5f7d1565462354ae6c4bedf3e1268acfe266af
SHA256

1899946bc8a0c6236273c13301749aace2c90889f38653aeb97c71e51f4541d6
SHA512

8232ca3edcc0ce45136503e0b6636fba0d0537679f40df58d7300e061a89cd801d67c784afc3cb0b5f27ebe23e505bdac2e6323b2f825d2d5e41cd43f21c4753
SSDEEP

12288:MGfkwc4ybTNaaaqvE9mJ3LZ3n/mNSQrn+pIWl2p2GuQe+A6yWI7Ua2PtcS+9:rMwVWleN+p3Up2GugA6rd

Score

10^/10

darkcomet guest16 persistence rat trojan

Malware Config

Extracted

Family

darkcomet

Botnet

Guest16

C2

slurpkonijn.no-ip.org:1604

Mutex

DC_MUTEX-88G5EA6

Attributes

gencode
E9BbjS0avFXR
install
false
offline_keylogger
true
persistence
false

Signatures

Darkcomet
DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
trojan rat darkcomet

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\help = "C:\\Users\\Admin\\AppData\\Roaming\\InstallDir\\help.exe"	1899946bc8a0c6236273c13301749aace2c90889f38653aeb97c71e51f4541d6.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\help = "C:\\Users\\Admin\\AppData\\Roaming\\InstallDir\\help.exe"	1899946bc8a0c6236273c13301749aace2c90889f38653aeb97c71e51f4541d6.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 900 set thread context of 1892	900	1899946bc8a0c6236273c13301749aace2c90889f38653aeb97c71e51f4541d6.exe	27

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 23 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	1892	1899946bc8a0c6236273c13301749aace2c90889f38653aeb97c71e51f4541d6.exe
Token: SeSecurityPrivilege	1892	1899946bc8a0c6236273c13301749aace2c90889f38653aeb97c71e51f4541d6.exe
Token: SeTakeOwnershipPrivilege	1892	1899946bc8a0c6236273c13301749aace2c90889f38653aeb97c71e51f4541d6.exe
Token: SeLoadDriverPrivilege	1892	1899946bc8a0c6236273c13301749aace2c90889f38653aeb97c71e51f4541d6.exe
Token: SeSystemProfilePrivilege	1892	1899946bc8a0c6236273c13301749aace2c90889f38653aeb97c71e51f4541d6.exe
Token: SeSystemtimePrivilege	1892	1899946bc8a0c6236273c13301749aace2c90889f38653aeb97c71e51f4541d6.exe
Token: SeProfSingleProcessPrivilege	1892	1899946bc8a0c6236273c13301749aace2c90889f38653aeb97c71e51f4541d6.exe
Token: SeIncBasePriorityPrivilege	1892	1899946bc8a0c6236273c13301749aace2c90889f38653aeb97c71e51f4541d6.exe
Token: SeCreatePagefilePrivilege	1892	1899946bc8a0c6236273c13301749aace2c90889f38653aeb97c71e51f4541d6.exe
Token: SeBackupPrivilege	1892	1899946bc8a0c6236273c13301749aace2c90889f38653aeb97c71e51f4541d6.exe
Token: SeRestorePrivilege	1892	1899946bc8a0c6236273c13301749aace2c90889f38653aeb97c71e51f4541d6.exe
Token: SeShutdownPrivilege	1892	1899946bc8a0c6236273c13301749aace2c90889f38653aeb97c71e51f4541d6.exe
Token: SeDebugPrivilege	1892	1899946bc8a0c6236273c13301749aace2c90889f38653aeb97c71e51f4541d6.exe
Token: SeSystemEnvironmentPrivilege	1892	1899946bc8a0c6236273c13301749aace2c90889f38653aeb97c71e51f4541d6.exe
Token: SeChangeNotifyPrivilege	1892	1899946bc8a0c6236273c13301749aace2c90889f38653aeb97c71e51f4541d6.exe
Token: SeRemoteShutdownPrivilege	1892	1899946bc8a0c6236273c13301749aace2c90889f38653aeb97c71e51f4541d6.exe
Token: SeUndockPrivilege	1892	1899946bc8a0c6236273c13301749aace2c90889f38653aeb97c71e51f4541d6.exe
Token: SeManageVolumePrivilege	1892	1899946bc8a0c6236273c13301749aace2c90889f38653aeb97c71e51f4541d6.exe
Token: SeImpersonatePrivilege	1892	1899946bc8a0c6236273c13301749aace2c90889f38653aeb97c71e51f4541d6.exe
Token: SeCreateGlobalPrivilege	1892	1899946bc8a0c6236273c13301749aace2c90889f38653aeb97c71e51f4541d6.exe
Token: 33	1892	1899946bc8a0c6236273c13301749aace2c90889f38653aeb97c71e51f4541d6.exe
Token: 34	1892	1899946bc8a0c6236273c13301749aace2c90889f38653aeb97c71e51f4541d6.exe
Token: 35	1892	1899946bc8a0c6236273c13301749aace2c90889f38653aeb97c71e51f4541d6.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1892	1899946bc8a0c6236273c13301749aace2c90889f38653aeb97c71e51f4541d6.exe

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 900 wrote to memory of 1892	900	1899946bc8a0c6236273c13301749aace2c90889f38653aeb97c71e51f4541d6.exe	27
PID 900 wrote to memory of 1892	900	1899946bc8a0c6236273c13301749aace2c90889f38653aeb97c71e51f4541d6.exe	27
PID 900 wrote to memory of 1892	900	1899946bc8a0c6236273c13301749aace2c90889f38653aeb97c71e51f4541d6.exe	27
PID 900 wrote to memory of 1892	900	1899946bc8a0c6236273c13301749aace2c90889f38653aeb97c71e51f4541d6.exe	27
PID 900 wrote to memory of 1892	900	1899946bc8a0c6236273c13301749aace2c90889f38653aeb97c71e51f4541d6.exe	27
PID 900 wrote to memory of 1892	900	1899946bc8a0c6236273c13301749aace2c90889f38653aeb97c71e51f4541d6.exe	27
PID 900 wrote to memory of 1892	900	1899946bc8a0c6236273c13301749aace2c90889f38653aeb97c71e51f4541d6.exe	27
PID 900 wrote to memory of 1892	900	1899946bc8a0c6236273c13301749aace2c90889f38653aeb97c71e51f4541d6.exe	27
PID 900 wrote to memory of 1892	900	1899946bc8a0c6236273c13301749aace2c90889f38653aeb97c71e51f4541d6.exe	27
PID 900 wrote to memory of 1892	900	1899946bc8a0c6236273c13301749aace2c90889f38653aeb97c71e51f4541d6.exe	27
PID 900 wrote to memory of 1892	900	1899946bc8a0c6236273c13301749aace2c90889f38653aeb97c71e51f4541d6.exe	27
PID 900 wrote to memory of 1892	900	1899946bc8a0c6236273c13301749aace2c90889f38653aeb97c71e51f4541d6.exe	27
PID 900 wrote to memory of 1892	900	1899946bc8a0c6236273c13301749aace2c90889f38653aeb97c71e51f4541d6.exe	27

C:\Users\Admin\AppData\Local\Temp\1899946bc8a0c6236273c13301749aace2c90889f38653aeb97c71e51f4541d6.exe
"C:\Users\Admin\AppData\Local\Temp\1899946bc8a0c6236273c13301749aace2c90889f38653aeb97c71e51f4541d6.exe"
1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:900
- C:\Users\Admin\AppData\Local\Temp\1899946bc8a0c6236273c13301749aace2c90889f38653aeb97c71e51f4541d6.exe
  C:\Users\Admin\AppData\Local\Temp\1899946bc8a0c6236273c13301749aace2c90889f38653aeb97c71e51f4541d6.exe
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:1892

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/900-54-0x0000000075C61000-0x0000000075C63000-memory.dmp

Filesize
8KB

Download
memory/900-71-0x0000000000230000-0x0000000000234000-memory.dmp

Filesize
16KB

Download
memory/1892-60-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/1892-69-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/1892-58-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/1892-62-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/1892-64-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/1892-65-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/1892-67-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/1892-56-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/1892-70-0x000000000048F888-mapping.dmp

Download
memory/1892-72-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/1892-55-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/1892-74-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/1892-75-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/1892-76-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download

Analysis

Sharing