darkcomet | e849e9c54d0af4b566e025cea441b849ae8ef17600f0b00d4c573dd21da311af

General

Target

e849e9c54d0af4b566e025cea441b849ae8ef17600f0b00d4c573dd21da311af.exe
Size

1.4MB
MD5

5767048bea30e525e28042ec49c0bf1a
SHA1

18b156569e9a91cb5a6e484e3ee018539704fa2c
SHA256

e849e9c54d0af4b566e025cea441b849ae8ef17600f0b00d4c573dd21da311af
SHA512

47bb86022569d8a36500693baefee77dcdfd086585d7a8c29141294a254ca1a4ef0513a163cafc3ac7b63853d123d1289d50a02033be836ff902493fcf209172
SSDEEP

24576:b/iGnOdLr1TyV6WVuL0XHLR06fk0pDCt5KGiX:HncZTyV6WVuAtPfDGfKZX

Score

10^/10

darkcomet wrdex persistence rat trojan

Malware Config

Extracted

Family

darkcomet

Botnet

Wrdex

C2

127.0.0.1:1454

larryking.no-ip.biz:1454

Mutex

DC_MUTEX-7MQCAT1

Attributes

gencode
ujzd2CCjR7AN
install
false
offline_keylogger
true
persistence
false

Signatures

Darkcomet
DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
trojan rat darkcomet

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1004

Modify Registry

T1112

Processes:

e849e9c54d0af4b566e025cea441b849ae8ef17600f0b00d4c573dd21da311af.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "C:\\Users\\Admin\\AppData\\Local\\Temp\\tase.exe"	e849e9c54d0af4b566e025cea441b849ae8ef17600f0b00d4c573dd21da311af.exe

Executes dropped EXE 1 IoCs

Processes:

utini .exe

pid process

1944 utini .exe
Loads dropped DLL 1 IoCs

Processes:

e849e9c54d0af4b566e025cea441b849ae8ef17600f0b00d4c573dd21da311af.exe

pid process

1612 e849e9c54d0af4b566e025cea441b849ae8ef17600f0b00d4c573dd21da311af.exe

pid	process
1944	utini .exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

e849e9c54d0af4b566e025cea441b849ae8ef17600f0b00d4c573dd21da311af.exe

description	pid	process	target process
PID 1612 set thread context of 1944	1612	e849e9c54d0af4b566e025cea441b849ae8ef17600f0b00d4c573dd21da311af.exe	utini .exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

e849e9c54d0af4b566e025cea441b849ae8ef17600f0b00d4c573dd21da311af.exe

pid	process
1612	e849e9c54d0af4b566e025cea441b849ae8ef17600f0b00d4c573dd21da311af.exe
1612	e849e9c54d0af4b566e025cea441b849ae8ef17600f0b00d4c573dd21da311af.exe

Suspicious use of AdjustPrivilegeToken 24 IoCs

Processes:

e849e9c54d0af4b566e025cea441b849ae8ef17600f0b00d4c573dd21da311af.exeutini .exe

description	pid	process
Token: SeDebugPrivilege	1612	e849e9c54d0af4b566e025cea441b849ae8ef17600f0b00d4c573dd21da311af.exe
Token: SeIncreaseQuotaPrivilege	1944	utini .exe
Token: SeSecurityPrivilege	1944	utini .exe
Token: SeTakeOwnershipPrivilege	1944	utini .exe
Token: SeLoadDriverPrivilege	1944	utini .exe
Token: SeSystemProfilePrivilege	1944	utini .exe
Token: SeSystemtimePrivilege	1944	utini .exe
Token: SeProfSingleProcessPrivilege	1944	utini .exe
Token: SeIncBasePriorityPrivilege	1944	utini .exe
Token: SeCreatePagefilePrivilege	1944	utini .exe
Token: SeBackupPrivilege	1944	utini .exe
Token: SeRestorePrivilege	1944	utini .exe
Token: SeShutdownPrivilege	1944	utini .exe
Token: SeDebugPrivilege	1944	utini .exe
Token: SeSystemEnvironmentPrivilege	1944	utini .exe
Token: SeChangeNotifyPrivilege	1944	utini .exe
Token: SeRemoteShutdownPrivilege	1944	utini .exe
Token: SeUndockPrivilege	1944	utini .exe
Token: SeManageVolumePrivilege	1944	utini .exe
Token: SeImpersonatePrivilege	1944	utini .exe
Token: SeCreateGlobalPrivilege	1944	utini .exe
Token: 33	1944	utini .exe
Token: 34	1944	utini .exe
Token: 35	1944	utini .exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

utini .exe

pid process

1944 utini .exe

pid	process
1944	utini .exe

Suspicious use of WriteProcessMemory 25 IoCs

Processes:

e849e9c54d0af4b566e025cea441b849ae8ef17600f0b00d4c573dd21da311af.execmd.exewscript.exe

description	pid	process	target process
PID 1612 wrote to memory of 1708	1612	e849e9c54d0af4b566e025cea441b849ae8ef17600f0b00d4c573dd21da311af.exe	cmd.exe
PID 1612 wrote to memory of 1708	1612	e849e9c54d0af4b566e025cea441b849ae8ef17600f0b00d4c573dd21da311af.exe	cmd.exe
PID 1612 wrote to memory of 1708	1612	e849e9c54d0af4b566e025cea441b849ae8ef17600f0b00d4c573dd21da311af.exe	cmd.exe
PID 1612 wrote to memory of 1708	1612	e849e9c54d0af4b566e025cea441b849ae8ef17600f0b00d4c573dd21da311af.exe	cmd.exe
PID 1612 wrote to memory of 1944	1612	e849e9c54d0af4b566e025cea441b849ae8ef17600f0b00d4c573dd21da311af.exe	utini .exe
PID 1612 wrote to memory of 1944	1612	e849e9c54d0af4b566e025cea441b849ae8ef17600f0b00d4c573dd21da311af.exe	utini .exe
PID 1612 wrote to memory of 1944	1612	e849e9c54d0af4b566e025cea441b849ae8ef17600f0b00d4c573dd21da311af.exe	utini .exe
PID 1612 wrote to memory of 1944	1612	e849e9c54d0af4b566e025cea441b849ae8ef17600f0b00d4c573dd21da311af.exe	utini .exe
PID 1612 wrote to memory of 1944	1612	e849e9c54d0af4b566e025cea441b849ae8ef17600f0b00d4c573dd21da311af.exe	utini .exe
PID 1612 wrote to memory of 1944	1612	e849e9c54d0af4b566e025cea441b849ae8ef17600f0b00d4c573dd21da311af.exe	utini .exe
PID 1612 wrote to memory of 1944	1612	e849e9c54d0af4b566e025cea441b849ae8ef17600f0b00d4c573dd21da311af.exe	utini .exe
PID 1612 wrote to memory of 1944	1612	e849e9c54d0af4b566e025cea441b849ae8ef17600f0b00d4c573dd21da311af.exe	utini .exe
PID 1612 wrote to memory of 1944	1612	e849e9c54d0af4b566e025cea441b849ae8ef17600f0b00d4c573dd21da311af.exe	utini .exe
PID 1612 wrote to memory of 1944	1612	e849e9c54d0af4b566e025cea441b849ae8ef17600f0b00d4c573dd21da311af.exe	utini .exe
PID 1612 wrote to memory of 1944	1612	e849e9c54d0af4b566e025cea441b849ae8ef17600f0b00d4c573dd21da311af.exe	utini .exe
PID 1612 wrote to memory of 1944	1612	e849e9c54d0af4b566e025cea441b849ae8ef17600f0b00d4c573dd21da311af.exe	utini .exe
PID 1612 wrote to memory of 1944	1612	e849e9c54d0af4b566e025cea441b849ae8ef17600f0b00d4c573dd21da311af.exe	utini .exe
PID 1708 wrote to memory of 912	1708	cmd.exe	wscript.exe
PID 1708 wrote to memory of 912	1708	cmd.exe	wscript.exe
PID 1708 wrote to memory of 912	1708	cmd.exe	wscript.exe
PID 1708 wrote to memory of 912	1708	cmd.exe	wscript.exe
PID 912 wrote to memory of 1112	912	wscript.exe	cmd.exe
PID 912 wrote to memory of 1112	912	wscript.exe	cmd.exe
PID 912 wrote to memory of 1112	912	wscript.exe	cmd.exe
PID 912 wrote to memory of 1112	912	wscript.exe	cmd.exe

C:\Users\Admin\AppData\Local\Temp\e849e9c54d0af4b566e025cea441b849ae8ef17600f0b00d4c573dd21da311af.exe
"C:\Users\Admin\AppData\Local\Temp\e849e9c54d0af4b566e025cea441b849ae8ef17600f0b00d4c573dd21da311af.exe"
1⤵
- Modifies WinLogon for persistence
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1612
- C:\Windows\SysWOW64\cmd.exe
  cmd /c C:\Users\Admin\AppData\Local\Temp\\mata.bat
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1708
- - C:\Windows\SysWOW64\wscript.exe
    wscript.exe "C:\Users\Admin\AppData\Local\Temp\invs.vbs" "C:\Users\Admin\AppData\Local\Temp\mata2.bat
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:912
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c ""C:\Users\Admin\AppData\Local\Temp\mata2.bat" "
      4⤵
      PID:1112
- C:\Users\Admin\AppData\Local\Temp\utini .exe
  "C:\Users\Admin\AppData\Local\Temp\utini .exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:1944

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Winlogon Helper DLL

1

T1004

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\invs.vbs

Filesize
78B

MD5
c578d9653b22800c3eb6b6a51219bbb8

SHA1
a97aa251901bbe179a48dbc7a0c1872e163b1f2d

SHA256
20a98a7e6e137bb1b9bd5ef6911a479cb8eac925b80d6db4e70b19f62a40cce2

SHA512
3ae6dc8f02d1a78e1235a0782b632972da5a74ab32287cc41aa672d4fa4a9d34bb5fc50eba07b6915f2e61c402927cd5f6feeb7f7602afa2f64e91efb3b7fc4d

Download Submit
C:\Users\Admin\AppData\Local\Temp\mata.bat

Filesize
47B

MD5
58c538a6ae20a3c6031217903cdf8e5d

SHA1
399fd50eadf4945b665877facfc4f53d16e18b1e

SHA256
6bcc0e04d9bc32209d90a65c320dc6363e523dd94b38b17bcdc5b980b6405f53

SHA512
c01828a5390fec3443e19d317137ae873de77c7737db7802650430e6a0a1edbd3aabe362903243b372536418fbd8482c2a6efd122d853744a41ade567956c359

Download Submit
C:\Users\Admin\AppData\Local\Temp\mata2.bat

Filesize
47B

MD5
211c543ddac4ea9273c99031f9dadd22

SHA1
1cb862349c3deca0af4bdda9a838ddb99f3ce49b

SHA256
c1f0f30deccf7edc8760d22c94875248d6662358893f13e1f1a3780b0872e46d

SHA512
9b347a926b243813083a29bb62c54a359424312542bfe5acf43c1e3629213f93c0d95988b0427c3c8d66231429498e09984b8b104276cee0bed43e635d9b9429

Download Submit
C:\Users\Admin\AppData\Local\Temp\rundll11-.txt

Filesize
1.4MB

MD5
5767048bea30e525e28042ec49c0bf1a

SHA1
18b156569e9a91cb5a6e484e3ee018539704fa2c

SHA256
e849e9c54d0af4b566e025cea441b849ae8ef17600f0b00d4c573dd21da311af

SHA512
47bb86022569d8a36500693baefee77dcdfd086585d7a8c29141294a254ca1a4ef0513a163cafc3ac7b63853d123d1289d50a02033be836ff902493fcf209172

Download Submit
C:\Users\Admin\AppData\Local\Temp\tase.exe

Filesize
1.4MB

MD5
5767048bea30e525e28042ec49c0bf1a

SHA1
18b156569e9a91cb5a6e484e3ee018539704fa2c

SHA256
e849e9c54d0af4b566e025cea441b849ae8ef17600f0b00d4c573dd21da311af

SHA512
47bb86022569d8a36500693baefee77dcdfd086585d7a8c29141294a254ca1a4ef0513a163cafc3ac7b63853d123d1289d50a02033be836ff902493fcf209172

Download Submit
C:\Users\Admin\AppData\Local\Temp\utini .exe

Filesize
54KB

MD5
0f01571a3e4c71eb4313175aae86488e

SHA1
2ba648afe2cd52edf5f25e304f77d457abf7ac0e

SHA256
8cc51c4c2efc8c6a401aa83a0aeced0925d5d9d2a43192f35561893cdf704022

SHA512
159dfbb7d385bf92f4fc48ca389b89d69f6c2616e90dfa056e725d7da78a3702694a28f9c5cab7b55adc4d4dbd7bfe5d272c8b1c9931e3ac95f6326d74576794

Download Submit
C:\Users\Admin\AppData\Local\Temp\utini .exe

Filesize
54KB

MD5
0f01571a3e4c71eb4313175aae86488e

SHA1
2ba648afe2cd52edf5f25e304f77d457abf7ac0e

SHA256
8cc51c4c2efc8c6a401aa83a0aeced0925d5d9d2a43192f35561893cdf704022

SHA512
159dfbb7d385bf92f4fc48ca389b89d69f6c2616e90dfa056e725d7da78a3702694a28f9c5cab7b55adc4d4dbd7bfe5d272c8b1c9931e3ac95f6326d74576794

Download Submit
\Users\Admin\AppData\Local\Temp\utini .exe

Filesize
54KB

MD5
0f01571a3e4c71eb4313175aae86488e

SHA1
2ba648afe2cd52edf5f25e304f77d457abf7ac0e

SHA256
8cc51c4c2efc8c6a401aa83a0aeced0925d5d9d2a43192f35561893cdf704022

SHA512
159dfbb7d385bf92f4fc48ca389b89d69f6c2616e90dfa056e725d7da78a3702694a28f9c5cab7b55adc4d4dbd7bfe5d272c8b1c9931e3ac95f6326d74576794

Download Submit
memory/912-73-0x0000000000000000-mapping.dmp

Download
memory/1112-77-0x0000000000000000-mapping.dmp

Download
memory/1612-54-0x0000000076681000-0x0000000076683000-memory.dmp

Filesize
8KB

Download
memory/1612-90-0x00000000748B0000-0x0000000074E5B000-memory.dmp

Filesize
5.7MB

Download
memory/1612-55-0x00000000748B0000-0x0000000074E5B000-memory.dmp

Filesize
5.7MB

Download
memory/1612-79-0x00000000748B0000-0x0000000074E5B000-memory.dmp

Filesize
5.7MB

Download
memory/1708-56-0x0000000000000000-mapping.dmp

Download
memory/1944-80-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/1944-83-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/1944-66-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/1944-59-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/1944-69-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/1944-81-0x000000000048F888-mapping.dmp

Download
memory/1944-60-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/1944-64-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/1944-85-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/1944-62-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/1944-87-0x000000000048F000-0x0000000000491000-memory.dmp

Filesize
8KB

Download
memory/1944-88-0x0000000000401000-0x000000000048F000-memory.dmp

Filesize
568KB

Download
memory/1944-68-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/1944-71-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads