darkcomet | d99ab47b01fa85450d30e877392cd304e2073d304d52431d5a86a186c1e78690

General

Target
d99ab47b01fa85450d30e877392cd304e2073d304d52431d5a86a186c1e78690.exe
Size 862KB
Sample221119-sp819scd2t
SHA256 d99ab47b01fa85450d30e877392cd304e2073d304d52431d5a86a186c1e78690
MD5 4ab72fa3ca81da7c6d0883156187c8b0
SHA1 1ba3e0ea652bdb030ccabf077562993e9f4b47dd
SHA512 8441ebebf5afcce3dd25af00ec32ddde1e7826bb0a234a30477169fec0f0ce74c3c88312142fdf9fdc00798b293250969769d1f7418d368cbf021ba7575e2ba6
SSDEEP 12288:uDGRoSsxtm3oHBuR0ujx5soNGLfRMnrR1yrr7Fe+ZDzfNt2ixJmgDKCwmLHl6yrY:uSRsxtmyBI0ExhEMreMozmerTHlzY
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

darkcomet guest16 rat trojan

Malware Config

Extracted

Family

darkcomet

Botnet

Guest16

C2

skyundmirco.zapto.org:2244

Mutex

DC_MUTEX-74XVSX0

Attributes

gencode
NhDvmnpFvK4d
install
false
offline_keylogger
true
persistence
false

Signatures

Darkcomet
DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
trojan rat darkcomet

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1684 set thread context of 4100	1684	d99ab47b01fa85450d30e877392cd304e2073d304d52431d5a86a186c1e78690.exe	79

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 24 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	4100	d99ab47b01fa85450d30e877392cd304e2073d304d52431d5a86a186c1e78690.exe
Token: SeSecurityPrivilege	4100	d99ab47b01fa85450d30e877392cd304e2073d304d52431d5a86a186c1e78690.exe
Token: SeTakeOwnershipPrivilege	4100	d99ab47b01fa85450d30e877392cd304e2073d304d52431d5a86a186c1e78690.exe
Token: SeLoadDriverPrivilege	4100	d99ab47b01fa85450d30e877392cd304e2073d304d52431d5a86a186c1e78690.exe
Token: SeSystemProfilePrivilege	4100	d99ab47b01fa85450d30e877392cd304e2073d304d52431d5a86a186c1e78690.exe
Token: SeSystemtimePrivilege	4100	d99ab47b01fa85450d30e877392cd304e2073d304d52431d5a86a186c1e78690.exe
Token: SeProfSingleProcessPrivilege	4100	d99ab47b01fa85450d30e877392cd304e2073d304d52431d5a86a186c1e78690.exe
Token: SeIncBasePriorityPrivilege	4100	d99ab47b01fa85450d30e877392cd304e2073d304d52431d5a86a186c1e78690.exe
Token: SeCreatePagefilePrivilege	4100	d99ab47b01fa85450d30e877392cd304e2073d304d52431d5a86a186c1e78690.exe
Token: SeBackupPrivilege	4100	d99ab47b01fa85450d30e877392cd304e2073d304d52431d5a86a186c1e78690.exe
Token: SeRestorePrivilege	4100	d99ab47b01fa85450d30e877392cd304e2073d304d52431d5a86a186c1e78690.exe
Token: SeShutdownPrivilege	4100	d99ab47b01fa85450d30e877392cd304e2073d304d52431d5a86a186c1e78690.exe
Token: SeDebugPrivilege	4100	d99ab47b01fa85450d30e877392cd304e2073d304d52431d5a86a186c1e78690.exe
Token: SeSystemEnvironmentPrivilege	4100	d99ab47b01fa85450d30e877392cd304e2073d304d52431d5a86a186c1e78690.exe
Token: SeChangeNotifyPrivilege	4100	d99ab47b01fa85450d30e877392cd304e2073d304d52431d5a86a186c1e78690.exe
Token: SeRemoteShutdownPrivilege	4100	d99ab47b01fa85450d30e877392cd304e2073d304d52431d5a86a186c1e78690.exe
Token: SeUndockPrivilege	4100	d99ab47b01fa85450d30e877392cd304e2073d304d52431d5a86a186c1e78690.exe
Token: SeManageVolumePrivilege	4100	d99ab47b01fa85450d30e877392cd304e2073d304d52431d5a86a186c1e78690.exe
Token: SeImpersonatePrivilege	4100	d99ab47b01fa85450d30e877392cd304e2073d304d52431d5a86a186c1e78690.exe
Token: SeCreateGlobalPrivilege	4100	d99ab47b01fa85450d30e877392cd304e2073d304d52431d5a86a186c1e78690.exe
Token: 33	4100	d99ab47b01fa85450d30e877392cd304e2073d304d52431d5a86a186c1e78690.exe
Token: 34	4100	d99ab47b01fa85450d30e877392cd304e2073d304d52431d5a86a186c1e78690.exe
Token: 35	4100	d99ab47b01fa85450d30e877392cd304e2073d304d52431d5a86a186c1e78690.exe
Token: 36	4100	d99ab47b01fa85450d30e877392cd304e2073d304d52431d5a86a186c1e78690.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4100	d99ab47b01fa85450d30e877392cd304e2073d304d52431d5a86a186c1e78690.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 1684 wrote to memory of 4100	1684	d99ab47b01fa85450d30e877392cd304e2073d304d52431d5a86a186c1e78690.exe	79
PID 1684 wrote to memory of 4100	1684	d99ab47b01fa85450d30e877392cd304e2073d304d52431d5a86a186c1e78690.exe	79
PID 1684 wrote to memory of 4100	1684	d99ab47b01fa85450d30e877392cd304e2073d304d52431d5a86a186c1e78690.exe	79
PID 1684 wrote to memory of 4100	1684	d99ab47b01fa85450d30e877392cd304e2073d304d52431d5a86a186c1e78690.exe	79
PID 1684 wrote to memory of 4100	1684	d99ab47b01fa85450d30e877392cd304e2073d304d52431d5a86a186c1e78690.exe	79
PID 1684 wrote to memory of 4100	1684	d99ab47b01fa85450d30e877392cd304e2073d304d52431d5a86a186c1e78690.exe	79
PID 1684 wrote to memory of 4100	1684	d99ab47b01fa85450d30e877392cd304e2073d304d52431d5a86a186c1e78690.exe	79
PID 1684 wrote to memory of 4100	1684	d99ab47b01fa85450d30e877392cd304e2073d304d52431d5a86a186c1e78690.exe	79
PID 1684 wrote to memory of 4100	1684	d99ab47b01fa85450d30e877392cd304e2073d304d52431d5a86a186c1e78690.exe	79
PID 1684 wrote to memory of 4100	1684	d99ab47b01fa85450d30e877392cd304e2073d304d52431d5a86a186c1e78690.exe	79
PID 1684 wrote to memory of 4100	1684	d99ab47b01fa85450d30e877392cd304e2073d304d52431d5a86a186c1e78690.exe	79
PID 1684 wrote to memory of 4100	1684	d99ab47b01fa85450d30e877392cd304e2073d304d52431d5a86a186c1e78690.exe	79
PID 1684 wrote to memory of 4100	1684	d99ab47b01fa85450d30e877392cd304e2073d304d52431d5a86a186c1e78690.exe	79
PID 1684 wrote to memory of 4100	1684	d99ab47b01fa85450d30e877392cd304e2073d304d52431d5a86a186c1e78690.exe	79

C:\Users\Admin\AppData\Local\Temp\d99ab47b01fa85450d30e877392cd304e2073d304d52431d5a86a186c1e78690.exe
"C:\Users\Admin\AppData\Local\Temp\d99ab47b01fa85450d30e877392cd304e2073d304d52431d5a86a186c1e78690.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1684
- C:\Users\Admin\AppData\Local\Temp\d99ab47b01fa85450d30e877392cd304e2073d304d52431d5a86a186c1e78690.exe
  C:\Users\Admin\AppData\Local\Temp\d99ab47b01fa85450d30e877392cd304e2073d304d52431d5a86a186c1e78690.exe
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:4100

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1684-134-0x0000000000790000-0x0000000000794000-memory.dmp

Download

memory/4100-133-0x0000000000400000-0x00000000004B2000-memory.dmp

Download

memory/4100-135-0x0000000000400000-0x00000000004B2000-memory.dmp

Download

memory/4100-136-0x0000000000400000-0x00000000004B2000-memory.dmp

Download

memory/4100-137-0x0000000000400000-0x00000000004B2000-memory.dmp

Download

memory/4100-138-0x0000000000400000-0x00000000004B2000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads