darkcomet | 4a4bb89fd12d4eb18de605f44978b6bcf057420bd51af088d6ee3463f8147a6a

Analysis

max time kernel
240s
max time network
249s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
19/11/2022, 16:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
4a4bb89fd12d4eb18de605f44978b6bcf057420bd51af088d6ee3463f8147a6a.exe
Size 762KB
Sample221119-tgp4vsdf4s
SHA256 4a4bb89fd12d4eb18de605f44978b6bcf057420bd51af088d6ee3463f8147a6a
MD5 505429425483a8001d318e2941aed2c4
SHA1 02b8c3dc3f2057d33f237e28b0b21c363413081a
SHA512 6e8e5afdcb9a9a3c5c43e4cc36ff8a98bd252f65fef1a240186d3fe629ceb888afb6561c30a0d1b436b15abd77ff895f5d504d0e55de977182e74cf55c24517d
SSDEEP 12288:30jpc+Bl7sGIE196M/txC14ZLBsQJaBSY0bHqm2a0YkJJx+w2HOa90lHhQyZfnYT:4pJBNsEjlz84VBs8+X0bqyN6x+w2Hl9B
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

darkcomet persistence rat trojan

Malware Config

Signatures

Darkcomet
DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
trojan rat darkcomet

Executes dropped EXE 2 IoCs

pid	Process
3308	Windowswinlogon.exe
4884	Windowswinlogon.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\winlogon = "C:\\Windowswinlogon.exe"	Windowswinlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\winlogon = "C:\\Windowswinlogon.exe"	Windowswinlogon.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3308 set thread context of 4884	3308	Windowswinlogon.exe	84

Runs net.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
3392	4a4bb89fd12d4eb18de605f44978b6bcf057420bd51af088d6ee3463f8147a6a.exe
3392	4a4bb89fd12d4eb18de605f44978b6bcf057420bd51af088d6ee3463f8147a6a.exe
3308	Windowswinlogon.exe
3308	Windowswinlogon.exe

Suspicious use of AdjustPrivilegeToken 24 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	4884	Windowswinlogon.exe
Token: SeSecurityPrivilege	4884	Windowswinlogon.exe
Token: SeTakeOwnershipPrivilege	4884	Windowswinlogon.exe
Token: SeLoadDriverPrivilege	4884	Windowswinlogon.exe
Token: SeSystemProfilePrivilege	4884	Windowswinlogon.exe
Token: SeSystemtimePrivilege	4884	Windowswinlogon.exe
Token: SeProfSingleProcessPrivilege	4884	Windowswinlogon.exe
Token: SeIncBasePriorityPrivilege	4884	Windowswinlogon.exe
Token: SeCreatePagefilePrivilege	4884	Windowswinlogon.exe
Token: SeBackupPrivilege	4884	Windowswinlogon.exe
Token: SeRestorePrivilege	4884	Windowswinlogon.exe
Token: SeShutdownPrivilege	4884	Windowswinlogon.exe
Token: SeDebugPrivilege	4884	Windowswinlogon.exe
Token: SeSystemEnvironmentPrivilege	4884	Windowswinlogon.exe
Token: SeChangeNotifyPrivilege	4884	Windowswinlogon.exe
Token: SeRemoteShutdownPrivilege	4884	Windowswinlogon.exe
Token: SeUndockPrivilege	4884	Windowswinlogon.exe
Token: SeManageVolumePrivilege	4884	Windowswinlogon.exe
Token: SeImpersonatePrivilege	4884	Windowswinlogon.exe
Token: SeCreateGlobalPrivilege	4884	Windowswinlogon.exe
Token: 33	4884	Windowswinlogon.exe
Token: 34	4884	Windowswinlogon.exe
Token: 35	4884	Windowswinlogon.exe
Token: 36	4884	Windowswinlogon.exe

Suspicious use of WriteProcessMemory 26 IoCs

description	pid	Process	procid_target
PID 3392 wrote to memory of 3308	3392	4a4bb89fd12d4eb18de605f44978b6bcf057420bd51af088d6ee3463f8147a6a.exe	82
PID 3392 wrote to memory of 3308	3392	4a4bb89fd12d4eb18de605f44978b6bcf057420bd51af088d6ee3463f8147a6a.exe	82
PID 3392 wrote to memory of 3308	3392	4a4bb89fd12d4eb18de605f44978b6bcf057420bd51af088d6ee3463f8147a6a.exe	82
PID 3308 wrote to memory of 1372	3308	Windowswinlogon.exe	83
PID 3308 wrote to memory of 1372	3308	Windowswinlogon.exe	83
PID 3308 wrote to memory of 1372	3308	Windowswinlogon.exe	83
PID 3308 wrote to memory of 4884	3308	Windowswinlogon.exe	84
PID 3308 wrote to memory of 4884	3308	Windowswinlogon.exe	84
PID 3308 wrote to memory of 4884	3308	Windowswinlogon.exe	84
PID 3308 wrote to memory of 4884	3308	Windowswinlogon.exe	84
PID 3308 wrote to memory of 4884	3308	Windowswinlogon.exe	84
PID 3308 wrote to memory of 4884	3308	Windowswinlogon.exe	84
PID 3308 wrote to memory of 4884	3308	Windowswinlogon.exe	84
PID 3308 wrote to memory of 4884	3308	Windowswinlogon.exe	84
PID 3308 wrote to memory of 4884	3308	Windowswinlogon.exe	84
PID 3308 wrote to memory of 4884	3308	Windowswinlogon.exe	84
PID 3308 wrote to memory of 4884	3308	Windowswinlogon.exe	84
PID 3308 wrote to memory of 4884	3308	Windowswinlogon.exe	84
PID 3308 wrote to memory of 4884	3308	Windowswinlogon.exe	84
PID 3308 wrote to memory of 4884	3308	Windowswinlogon.exe	84
PID 1372 wrote to memory of 4836	1372	cmd.exe	86
PID 1372 wrote to memory of 4836	1372	cmd.exe	86
PID 1372 wrote to memory of 4836	1372	cmd.exe	86
PID 4836 wrote to memory of 2848	4836	net.exe	87
PID 4836 wrote to memory of 2848	4836	net.exe	87
PID 4836 wrote to memory of 2848	4836	net.exe	87

C:\Users\Admin\AppData\Local\Temp\4a4bb89fd12d4eb18de605f44978b6bcf057420bd51af088d6ee3463f8147a6a.exe
"C:\Users\Admin\AppData\Local\Temp\4a4bb89fd12d4eb18de605f44978b6bcf057420bd51af088d6ee3463f8147a6a.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3392
- C:\Windowswinlogon.exe
  C:\Windowswinlogon.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:3308
- - C:\Windows\SysWOW64\cmd.exe
    /c net stop MpsSvc
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1372
  - - C:\Windows\SysWOW64\net.exe
      net stop MpsSvc
      4⤵
      Suspicious use of WriteProcessMemory
      PID:4836
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop MpsSvc
        5⤵
        
        PID:2848
- - C:\Windowswinlogon.exe
    C:\Windowswinlogon.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    PID:4884

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Windowswinlogon.exe

Path C:\Windowswinlogon.exe
Size 762KB
SHA256 4a4bb89fd12d4eb18de605f44978b6bcf057420bd51af088d6ee3463f8147a6a
MD5 505429425483a8001d318e2941aed2c4
SHA1 02b8c3dc3f2057d33f237e28b0b21c363413081a
SHA512 6e8e5afdcb9a9a3c5c43e4cc36ff8a98bd252f65fef1a240186d3fe629ceb888afb6561c30a0d1b436b15abd77ff895f5d504d0e55de977182e74cf55c24517d
SSDEEP 12288:30jpc+Bl7sGIE196M/txC14ZLBsQJaBSY0bHqm2a0YkJJx+w2HOa90lHhQyZfnYT:4pJBNsEjlz84VBs8+X0bqyN6x+w2Hl9B
MD5 SHA1 SHA512 SSDEEP

Submit Download

Windowswinlogon.exe

Path C:\Windowswinlogon.exe
Size 762KB
SHA256 4a4bb89fd12d4eb18de605f44978b6bcf057420bd51af088d6ee3463f8147a6a
MD5 505429425483a8001d318e2941aed2c4
SHA1 02b8c3dc3f2057d33f237e28b0b21c363413081a
SHA512 6e8e5afdcb9a9a3c5c43e4cc36ff8a98bd252f65fef1a240186d3fe629ceb888afb6561c30a0d1b436b15abd77ff895f5d504d0e55de977182e74cf55c24517d
SSDEEP 12288:30jpc+Bl7sGIE196M/txC14ZLBsQJaBSY0bHqm2a0YkJJx+w2HOa90lHhQyZfnYT:4pJBNsEjlz84VBs8+X0bqyN6x+w2Hl9B
MD5 SHA1 SHA512 SSDEEP

Submit Download

Windowswinlogon.exe

Path C:\Windowswinlogon.exe
Size 762KB
SHA256 4a4bb89fd12d4eb18de605f44978b6bcf057420bd51af088d6ee3463f8147a6a
MD5 505429425483a8001d318e2941aed2c4
SHA1 02b8c3dc3f2057d33f237e28b0b21c363413081a
SHA512 6e8e5afdcb9a9a3c5c43e4cc36ff8a98bd252f65fef1a240186d3fe629ceb888afb6561c30a0d1b436b15abd77ff895f5d504d0e55de977182e74cf55c24517d
SSDEEP 12288:30jpc+Bl7sGIE196M/txC14ZLBsQJaBSY0bHqm2a0YkJJx+w2HOa90lHhQyZfnYT:4pJBNsEjlz84VBs8+X0bqyN6x+w2Hl9B
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/3392-132-0x00000000005A0000-0x00000000005A6000-memory.dmp

Download

memory/4884-138-0x0000000000400000-0x00000000004B1000-memory.dmp

Download

memory/4884-141-0x0000000000400000-0x00000000004B1000-memory.dmp

Download

memory/4884-142-0x0000000000400000-0x00000000004B1000-memory.dmp

Download

memory/4884-140-0x0000000000400000-0x00000000004B1000-memory.dmp

Download

memory/4884-145-0x0000000000400000-0x00000000004B1000-memory.dmp

Download