darkcomet | 564390eb14d5fb93e012db3ef3933c32e9fe4eeec170d036e1d34345d65594fa

General

Target

564390eb14d5fb93e012db3ef3933c32e9fe4eeec170d036e1d34345d65594fa.exe
Size

1.7MB
MD5

a0e4381250de28e795b8b0c3148e5620
SHA1

0bc879670e1d9c0400405d1c3dd1f933689e781b
SHA256

564390eb14d5fb93e012db3ef3933c32e9fe4eeec170d036e1d34345d65594fa
SHA512

eba0fe53b053674ecd4b4e57aecb52b2d1d973bcb71c6d5e3f4207e7b8730b2a4fc23323e1559c696bdce06c0c365c4110e14c7ac41807fb8b82ec15515e9056
SSDEEP

49152:skwkn9IMHeaS7hi0TdX+PouMOskjALaPCS:HdnVCtdCouwkjA2PC

Score

10^/10

darkcomet guest16 persistence rat trojan

Malware Config

Extracted

Family

darkcomet

Botnet

Guest16

C2

tragicdux.chickenkiller.com:3175

Mutex

DC_MUTEX-L9H93A3

Attributes

gencode
1L4pelzQX7xS
install
false
offline_keylogger
true
persistence
false

Signatures

Darkcomet
DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
trojan rat darkcomet
Executes dropped EXE 1 IoCs

Processes:

sample.exe

pid process

1356 sample.exe
Uses the VBS compiler for execution 1 TTPs

Scripting
T1064

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

sample.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run	sample.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ = "C:\\Users\\Admin\\AppData\\Roaming\\sample.exe"	sample.exe

AutoIT Executable 3 IoCs

AutoIT scripts compiled to PE executables.

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Roaming\sample.exe	autoit_exe
C:\Users\Admin\AppData\Roaming\sample.exe	autoit_exe
C:\Users\Admin\AppData\Local\Temp\564390eb14d5fb93e012db3ef3933c32e9fe4eeec170d036e1d34345d65594fa.exe	autoit_exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

sample.exe

description pid process target process

PID 1356 set thread context of 1360 1356 sample.exe vbc.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

description	pid	process	target process
PID 1356 set thread context of 1360	1356	sample.exe	vbc.exe

NTFS ADS 3 IoCs

Processes:

564390eb14d5fb93e012db3ef3933c32e9fe4eeec170d036e1d34345d65594fa.exesample.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Local\Temp\564390eb14d5fb93e012db3ef3933c32e9fe4eeec170d036e1d34345d65594fa.exe:Zone.Identifier:$DATA	564390eb14d5fb93e012db3ef3933c32e9fe4eeec170d036e1d34345d65594fa.exe
File created	C:\Users\Admin\AppData\Roaming\sample.exe\:Zone.Identifier:$DATA	564390eb14d5fb93e012db3ef3933c32e9fe4eeec170d036e1d34345d65594fa.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\sample.exe:Zone.Identifier:$DATA	sample.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery
T1018

Processes:

PING.EXE

pid process

520 PING.EXE

pid	process
520	PING.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

sample.exe

pid	process
1356	sample.exe
1356	sample.exe
1356	sample.exe
1356	sample.exe
1356	sample.exe
1356	sample.exe
1356	sample.exe
1356	sample.exe
1356	sample.exe
1356	sample.exe
1356	sample.exe
1356	sample.exe
1356	sample.exe
1356	sample.exe
1356	sample.exe
1356	sample.exe
1356	sample.exe
1356	sample.exe
1356	sample.exe
1356	sample.exe
1356	sample.exe
1356	sample.exe
1356	sample.exe
1356	sample.exe
1356	sample.exe
1356	sample.exe
1356	sample.exe
1356	sample.exe
1356	sample.exe
1356	sample.exe
1356	sample.exe
1356	sample.exe
1356	sample.exe
1356	sample.exe
1356	sample.exe
1356	sample.exe
1356	sample.exe
1356	sample.exe
1356	sample.exe
1356	sample.exe
1356	sample.exe
1356	sample.exe
1356	sample.exe
1356	sample.exe
1356	sample.exe
1356	sample.exe
1356	sample.exe
1356	sample.exe
1356	sample.exe
1356	sample.exe
1356	sample.exe
1356	sample.exe
1356	sample.exe
1356	sample.exe
1356	sample.exe
1356	sample.exe
1356	sample.exe
1356	sample.exe
1356	sample.exe
1356	sample.exe
1356	sample.exe
1356	sample.exe
1356	sample.exe
1356	sample.exe

Suspicious use of AdjustPrivilegeToken 24 IoCs

Processes:

vbc.exe

description	pid	process
Token: SeIncreaseQuotaPrivilege	1360	vbc.exe
Token: SeSecurityPrivilege	1360	vbc.exe
Token: SeTakeOwnershipPrivilege	1360	vbc.exe
Token: SeLoadDriverPrivilege	1360	vbc.exe
Token: SeSystemProfilePrivilege	1360	vbc.exe
Token: SeSystemtimePrivilege	1360	vbc.exe
Token: SeProfSingleProcessPrivilege	1360	vbc.exe
Token: SeIncBasePriorityPrivilege	1360	vbc.exe
Token: SeCreatePagefilePrivilege	1360	vbc.exe
Token: SeBackupPrivilege	1360	vbc.exe
Token: SeRestorePrivilege	1360	vbc.exe
Token: SeShutdownPrivilege	1360	vbc.exe
Token: SeDebugPrivilege	1360	vbc.exe
Token: SeSystemEnvironmentPrivilege	1360	vbc.exe
Token: SeChangeNotifyPrivilege	1360	vbc.exe
Token: SeRemoteShutdownPrivilege	1360	vbc.exe
Token: SeUndockPrivilege	1360	vbc.exe
Token: SeManageVolumePrivilege	1360	vbc.exe
Token: SeImpersonatePrivilege	1360	vbc.exe
Token: SeCreateGlobalPrivilege	1360	vbc.exe
Token: 33	1360	vbc.exe
Token: 34	1360	vbc.exe
Token: 35	1360	vbc.exe
Token: 36	1360	vbc.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

vbc.exe

pid process

1360 vbc.exe

pid	process
1360	vbc.exe

Suspicious use of WriteProcessMemory 14 IoCs

Processes:

564390eb14d5fb93e012db3ef3933c32e9fe4eeec170d036e1d34345d65594fa.execmd.exesample.exe

description	pid	process	target process
PID 900 wrote to memory of 1356	900	564390eb14d5fb93e012db3ef3933c32e9fe4eeec170d036e1d34345d65594fa.exe	sample.exe
PID 900 wrote to memory of 1356	900	564390eb14d5fb93e012db3ef3933c32e9fe4eeec170d036e1d34345d65594fa.exe	sample.exe
PID 900 wrote to memory of 1356	900	564390eb14d5fb93e012db3ef3933c32e9fe4eeec170d036e1d34345d65594fa.exe	sample.exe
PID 900 wrote to memory of 3020	900	564390eb14d5fb93e012db3ef3933c32e9fe4eeec170d036e1d34345d65594fa.exe	cmd.exe
PID 900 wrote to memory of 3020	900	564390eb14d5fb93e012db3ef3933c32e9fe4eeec170d036e1d34345d65594fa.exe	cmd.exe
PID 900 wrote to memory of 3020	900	564390eb14d5fb93e012db3ef3933c32e9fe4eeec170d036e1d34345d65594fa.exe	cmd.exe
PID 3020 wrote to memory of 520	3020	cmd.exe	PING.EXE
PID 3020 wrote to memory of 520	3020	cmd.exe	PING.EXE
PID 3020 wrote to memory of 520	3020	cmd.exe	PING.EXE
PID 1356 wrote to memory of 1360	1356	sample.exe	vbc.exe
PID 1356 wrote to memory of 1360	1356	sample.exe	vbc.exe
PID 1356 wrote to memory of 1360	1356	sample.exe	vbc.exe
PID 1356 wrote to memory of 1360	1356	sample.exe	vbc.exe
PID 1356 wrote to memory of 1360	1356	sample.exe	vbc.exe

C:\Users\Admin\AppData\Local\Temp\564390eb14d5fb93e012db3ef3933c32e9fe4eeec170d036e1d34345d65594fa.exe
"C:\Users\Admin\AppData\Local\Temp\564390eb14d5fb93e012db3ef3933c32e9fe4eeec170d036e1d34345d65594fa.exe"
1⤵
- NTFS ADS
- Suspicious use of WriteProcessMemory
PID:900

C:\Users\Admin\AppData\Roaming\sample.exe
C:\Users\Admin\AppData\Roaming\sample.exe
2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1356

C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
3⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1360

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Tempscratch.bat
2⤵
- Suspicious use of WriteProcessMemory
PID:3020

C:\Windows\SysWOW64\PING.EXE
ping -n 0127.0.0.1
3⤵
- Runs ping.exe
PID:520

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scripting

1

T1064

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Scripting

1

T1064

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Remote System Discovery

1

T1018

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp00fd02bc4fd7d9cd545e70322937394d.jpeg
Filesize
240KB

MD5
b4d6bdbf0fd59f87c616df22e3842ad1

SHA1
47cf210d47658baada3a51a9a71c140a7f8d9114

SHA256
077e07e739046ac21c1bf3285ae5df5e33da04b54a732f031a7e9451f5289dcd

SHA512
4a9a69bc7bdb04f0f1e762b9661f42ff0170e3770520c3e723092da336142b854d86a14c398d53417ba33fddd58abf8739061e309d514853384ff42eeb3c2538

Download Submit
C:\Users\Admin\AppData\Local\Temp\564390eb14d5fb93e012db3ef3933c32e9fe4eeec170d036e1d34345d65594fa.exe
Filesize
1.7MB

MD5
a0e4381250de28e795b8b0c3148e5620

SHA1
0bc879670e1d9c0400405d1c3dd1f933689e781b

SHA256
564390eb14d5fb93e012db3ef3933c32e9fe4eeec170d036e1d34345d65594fa

SHA512
eba0fe53b053674ecd4b4e57aecb52b2d1d973bcb71c6d5e3f4207e7b8730b2a4fc23323e1559c696bdce06c0c365c4110e14c7ac41807fb8b82ec15515e9056

Download Submit
C:\Users\Admin\AppData\Local\Temp\im4VcwVwISiRReUMO1Z7x5F3l
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
C:\Users\Admin\AppData\Local\Tempscratch.bat
Filesize
322B

MD5
af53e4e73732c940bf4fa9a7bacff726

SHA1
506d360c41333cfc5d2731d1ebaf6c529fcf1958

SHA256
b2ab8d923e6fb330260fbf4c05c918bc3eb7b14cc0b569f202eaea790f8a8be3

SHA512
e652256e3192a7c34da758ac8d5c2853b80085225a3fba3c16814d7446efcd78b618d532ee334411c5d25138597759b51feafc43177eae97618e8d8d9dd522c4

Download Submit
C:\Users\Admin\AppData\Roaming\sample.exe
Filesize
1.7MB

MD5
a0e4381250de28e795b8b0c3148e5620

SHA1
0bc879670e1d9c0400405d1c3dd1f933689e781b

SHA256
564390eb14d5fb93e012db3ef3933c32e9fe4eeec170d036e1d34345d65594fa

SHA512
eba0fe53b053674ecd4b4e57aecb52b2d1d973bcb71c6d5e3f4207e7b8730b2a4fc23323e1559c696bdce06c0c365c4110e14c7ac41807fb8b82ec15515e9056

Download Submit
C:\Users\Admin\AppData\Roaming\sample.exe
Filesize
1.7MB

MD5
a0e4381250de28e795b8b0c3148e5620

SHA1
0bc879670e1d9c0400405d1c3dd1f933689e781b

SHA256
564390eb14d5fb93e012db3ef3933c32e9fe4eeec170d036e1d34345d65594fa

SHA512
eba0fe53b053674ecd4b4e57aecb52b2d1d973bcb71c6d5e3f4207e7b8730b2a4fc23323e1559c696bdce06c0c365c4110e14c7ac41807fb8b82ec15515e9056

Download Submit
memory/520-139-0x0000000000000000-mapping.dmp

Download
memory/1356-132-0x0000000000000000-mapping.dmp

Download
memory/1360-140-0x0000000000000000-mapping.dmp

Download
memory/1360-142-0x0000000000DD0000-0x0000000000E82000-memory.dmp

Filesize
712KB

Download
memory/1360-143-0x0000000000DD0000-0x0000000000E82000-memory.dmp

Filesize
712KB

Download
memory/1360-144-0x0000000000DD0000-0x0000000000E82000-memory.dmp

Filesize
712KB

Download
memory/1360-145-0x0000000000DD0000-0x0000000000E82000-memory.dmp

Filesize
712KB

Download
memory/1360-146-0x0000000000DD0000-0x0000000000E82000-memory.dmp

Filesize
712KB

Download
memory/3020-135-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads