darkcomet | e849e9c54d0af4b566e025cea441b849ae8ef17600f0b00d4c573dd21da311af

General

Target

e849e9c54d0af4b566e025cea441b849ae8ef17600f0b00d4c573dd21da311af.exe
Size

1.4MB
MD5

5767048bea30e525e28042ec49c0bf1a
SHA1

18b156569e9a91cb5a6e484e3ee018539704fa2c
SHA256

e849e9c54d0af4b566e025cea441b849ae8ef17600f0b00d4c573dd21da311af
SHA512

47bb86022569d8a36500693baefee77dcdfd086585d7a8c29141294a254ca1a4ef0513a163cafc3ac7b63853d123d1289d50a02033be836ff902493fcf209172
SSDEEP

24576:b/iGnOdLr1TyV6WVuL0XHLR06fk0pDCt5KGiX:HncZTyV6WVuAtPfDGfKZX

Score

10^/10

darkcomet wrdex persistence rat trojan

Malware Config

Extracted

Family

darkcomet

Botnet

Wrdex

C2

127.0.0.1:1454

larryking.no-ip.biz:1454

Mutex

DC_MUTEX-7MQCAT1

Attributes

gencode
ujzd2CCjR7AN
install
false
offline_keylogger
true
persistence
false

Signatures

Darkcomet
DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
trojan rat darkcomet

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1004

Modify Registry

T1112

Processes:

e849e9c54d0af4b566e025cea441b849ae8ef17600f0b00d4c573dd21da311af.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "C:\\Users\\Admin\\AppData\\Local\\Temp\\tase.exe"	e849e9c54d0af4b566e025cea441b849ae8ef17600f0b00d4c573dd21da311af.exe

Executes dropped EXE 1 IoCs

Processes:

utini .exe

pid process

2296 utini .exe
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.

Query Registry
T1012

System Information Discovery
T1082

Processes:

wscript.exe

description ioc process

Key value queried \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation wscript.exe

pid	process
2296	utini .exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation	wscript.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

e849e9c54d0af4b566e025cea441b849ae8ef17600f0b00d4c573dd21da311af.exe

description	pid	process	target process
PID 4772 set thread context of 2296	4772	e849e9c54d0af4b566e025cea441b849ae8ef17600f0b00d4c573dd21da311af.exe	utini .exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

e849e9c54d0af4b566e025cea441b849ae8ef17600f0b00d4c573dd21da311af.exe

pid	process
4772	e849e9c54d0af4b566e025cea441b849ae8ef17600f0b00d4c573dd21da311af.exe
4772	e849e9c54d0af4b566e025cea441b849ae8ef17600f0b00d4c573dd21da311af.exe

Suspicious use of AdjustPrivilegeToken 25 IoCs

Processes:

e849e9c54d0af4b566e025cea441b849ae8ef17600f0b00d4c573dd21da311af.exeutini .exe

description	pid	process
Token: SeDebugPrivilege	4772	e849e9c54d0af4b566e025cea441b849ae8ef17600f0b00d4c573dd21da311af.exe
Token: SeIncreaseQuotaPrivilege	2296	utini .exe
Token: SeSecurityPrivilege	2296	utini .exe
Token: SeTakeOwnershipPrivilege	2296	utini .exe
Token: SeLoadDriverPrivilege	2296	utini .exe
Token: SeSystemProfilePrivilege	2296	utini .exe
Token: SeSystemtimePrivilege	2296	utini .exe
Token: SeProfSingleProcessPrivilege	2296	utini .exe
Token: SeIncBasePriorityPrivilege	2296	utini .exe
Token: SeCreatePagefilePrivilege	2296	utini .exe
Token: SeBackupPrivilege	2296	utini .exe
Token: SeRestorePrivilege	2296	utini .exe
Token: SeShutdownPrivilege	2296	utini .exe
Token: SeDebugPrivilege	2296	utini .exe
Token: SeSystemEnvironmentPrivilege	2296	utini .exe
Token: SeChangeNotifyPrivilege	2296	utini .exe
Token: SeRemoteShutdownPrivilege	2296	utini .exe
Token: SeUndockPrivilege	2296	utini .exe
Token: SeManageVolumePrivilege	2296	utini .exe
Token: SeImpersonatePrivilege	2296	utini .exe
Token: SeCreateGlobalPrivilege	2296	utini .exe
Token: 33	2296	utini .exe
Token: 34	2296	utini .exe
Token: 35	2296	utini .exe
Token: 36	2296	utini .exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

utini .exe

pid process

2296 utini .exe

pid	process
2296	utini .exe

Suspicious use of WriteProcessMemory 23 IoCs

Processes:

e849e9c54d0af4b566e025cea441b849ae8ef17600f0b00d4c573dd21da311af.execmd.exewscript.exe

description	pid	process	target process
PID 4772 wrote to memory of 2528	4772	e849e9c54d0af4b566e025cea441b849ae8ef17600f0b00d4c573dd21da311af.exe	cmd.exe
PID 4772 wrote to memory of 2528	4772	e849e9c54d0af4b566e025cea441b849ae8ef17600f0b00d4c573dd21da311af.exe	cmd.exe
PID 4772 wrote to memory of 2528	4772	e849e9c54d0af4b566e025cea441b849ae8ef17600f0b00d4c573dd21da311af.exe	cmd.exe
PID 4772 wrote to memory of 2296	4772	e849e9c54d0af4b566e025cea441b849ae8ef17600f0b00d4c573dd21da311af.exe	utini .exe
PID 4772 wrote to memory of 2296	4772	e849e9c54d0af4b566e025cea441b849ae8ef17600f0b00d4c573dd21da311af.exe	utini .exe
PID 4772 wrote to memory of 2296	4772	e849e9c54d0af4b566e025cea441b849ae8ef17600f0b00d4c573dd21da311af.exe	utini .exe
PID 2528 wrote to memory of 3372	2528	cmd.exe	wscript.exe
PID 2528 wrote to memory of 3372	2528	cmd.exe	wscript.exe
PID 2528 wrote to memory of 3372	2528	cmd.exe	wscript.exe
PID 4772 wrote to memory of 2296	4772	e849e9c54d0af4b566e025cea441b849ae8ef17600f0b00d4c573dd21da311af.exe	utini .exe
PID 4772 wrote to memory of 2296	4772	e849e9c54d0af4b566e025cea441b849ae8ef17600f0b00d4c573dd21da311af.exe	utini .exe
PID 4772 wrote to memory of 2296	4772	e849e9c54d0af4b566e025cea441b849ae8ef17600f0b00d4c573dd21da311af.exe	utini .exe
PID 4772 wrote to memory of 2296	4772	e849e9c54d0af4b566e025cea441b849ae8ef17600f0b00d4c573dd21da311af.exe	utini .exe
PID 4772 wrote to memory of 2296	4772	e849e9c54d0af4b566e025cea441b849ae8ef17600f0b00d4c573dd21da311af.exe	utini .exe
PID 4772 wrote to memory of 2296	4772	e849e9c54d0af4b566e025cea441b849ae8ef17600f0b00d4c573dd21da311af.exe	utini .exe
PID 4772 wrote to memory of 2296	4772	e849e9c54d0af4b566e025cea441b849ae8ef17600f0b00d4c573dd21da311af.exe	utini .exe
PID 4772 wrote to memory of 2296	4772	e849e9c54d0af4b566e025cea441b849ae8ef17600f0b00d4c573dd21da311af.exe	utini .exe
PID 4772 wrote to memory of 2296	4772	e849e9c54d0af4b566e025cea441b849ae8ef17600f0b00d4c573dd21da311af.exe	utini .exe
PID 4772 wrote to memory of 2296	4772	e849e9c54d0af4b566e025cea441b849ae8ef17600f0b00d4c573dd21da311af.exe	utini .exe
PID 4772 wrote to memory of 2296	4772	e849e9c54d0af4b566e025cea441b849ae8ef17600f0b00d4c573dd21da311af.exe	utini .exe
PID 3372 wrote to memory of 5048	3372	wscript.exe	cmd.exe
PID 3372 wrote to memory of 5048	3372	wscript.exe	cmd.exe
PID 3372 wrote to memory of 5048	3372	wscript.exe	cmd.exe

C:\Users\Admin\AppData\Local\Temp\e849e9c54d0af4b566e025cea441b849ae8ef17600f0b00d4c573dd21da311af.exe
"C:\Users\Admin\AppData\Local\Temp\e849e9c54d0af4b566e025cea441b849ae8ef17600f0b00d4c573dd21da311af.exe"
1⤵
- Modifies WinLogon for persistence
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4772
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\\mata.bat
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2528
- - C:\Windows\SysWOW64\wscript.exe
    wscript.exe "C:\Users\Admin\AppData\Local\Temp\invs.vbs" "C:\Users\Admin\AppData\Local\Temp\mata2.bat
    3⤵
    - Checks computer location settings
    - Suspicious use of WriteProcessMemory
    PID:3372
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\mata2.bat" "
      4⤵
      PID:5048
- C:\Users\Admin\AppData\Local\Temp\utini .exe
  "C:\Users\Admin\AppData\Local\Temp\utini .exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:2296

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Winlogon Helper DLL

1

T1004

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\invs.vbs

Filesize
78B

MD5
c578d9653b22800c3eb6b6a51219bbb8

SHA1
a97aa251901bbe179a48dbc7a0c1872e163b1f2d

SHA256
20a98a7e6e137bb1b9bd5ef6911a479cb8eac925b80d6db4e70b19f62a40cce2

SHA512
3ae6dc8f02d1a78e1235a0782b632972da5a74ab32287cc41aa672d4fa4a9d34bb5fc50eba07b6915f2e61c402927cd5f6feeb7f7602afa2f64e91efb3b7fc4d

Download Submit
C:\Users\Admin\AppData\Local\Temp\mata.bat

Filesize
47B

MD5
58c538a6ae20a3c6031217903cdf8e5d

SHA1
399fd50eadf4945b665877facfc4f53d16e18b1e

SHA256
6bcc0e04d9bc32209d90a65c320dc6363e523dd94b38b17bcdc5b980b6405f53

SHA512
c01828a5390fec3443e19d317137ae873de77c7737db7802650430e6a0a1edbd3aabe362903243b372536418fbd8482c2a6efd122d853744a41ade567956c359

Download Submit
C:\Users\Admin\AppData\Local\Temp\mata2.bat

Filesize
47B

MD5
211c543ddac4ea9273c99031f9dadd22

SHA1
1cb862349c3deca0af4bdda9a838ddb99f3ce49b

SHA256
c1f0f30deccf7edc8760d22c94875248d6662358893f13e1f1a3780b0872e46d

SHA512
9b347a926b243813083a29bb62c54a359424312542bfe5acf43c1e3629213f93c0d95988b0427c3c8d66231429498e09984b8b104276cee0bed43e635d9b9429

Download Submit
C:\Users\Admin\AppData\Local\Temp\rundll11-.txt

Filesize
1.4MB

MD5
5767048bea30e525e28042ec49c0bf1a

SHA1
18b156569e9a91cb5a6e484e3ee018539704fa2c

SHA256
e849e9c54d0af4b566e025cea441b849ae8ef17600f0b00d4c573dd21da311af

SHA512
47bb86022569d8a36500693baefee77dcdfd086585d7a8c29141294a254ca1a4ef0513a163cafc3ac7b63853d123d1289d50a02033be836ff902493fcf209172

Download Submit
C:\Users\Admin\AppData\Local\Temp\tase.exe

Filesize
1.4MB

MD5
5767048bea30e525e28042ec49c0bf1a

SHA1
18b156569e9a91cb5a6e484e3ee018539704fa2c

SHA256
e849e9c54d0af4b566e025cea441b849ae8ef17600f0b00d4c573dd21da311af

SHA512
47bb86022569d8a36500693baefee77dcdfd086585d7a8c29141294a254ca1a4ef0513a163cafc3ac7b63853d123d1289d50a02033be836ff902493fcf209172

Download Submit
C:\Users\Admin\AppData\Local\Temp\utini .exe

Filesize
57KB

MD5
454501a66ad6e85175a6757573d79f8b

SHA1
8ca96c61f26a640a5b1b1152d055260b9d43e308

SHA256
7fd4f35aff4a0d4bfaae3a5dfb14b94934276df0e96d1a417a8f3693915e72c8

SHA512
9dc3b9a9b7e661acc3ac9a0ff4fd764097fc41ccbc2e7969cae9805cc693a87e8255e459ea5f315271825e7e517a46649acc8d42122a8018264cc3f2efa34fb7

Download Submit
C:\Users\Admin\AppData\Local\Temp\utini .exe

Filesize
57KB

MD5
454501a66ad6e85175a6757573d79f8b

SHA1
8ca96c61f26a640a5b1b1152d055260b9d43e308

SHA256
7fd4f35aff4a0d4bfaae3a5dfb14b94934276df0e96d1a417a8f3693915e72c8

SHA512
9dc3b9a9b7e661acc3ac9a0ff4fd764097fc41ccbc2e7969cae9805cc693a87e8255e459ea5f315271825e7e517a46649acc8d42122a8018264cc3f2efa34fb7

Download Submit
memory/2296-136-0x0000000000000000-mapping.dmp

Download
memory/2296-142-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/2296-145-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/2296-146-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/2296-148-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/2528-133-0x0000000000000000-mapping.dmp

Download
memory/3372-135-0x0000000000000000-mapping.dmp

Download
memory/4772-141-0x0000000074EC0000-0x0000000075471000-memory.dmp

Filesize
5.7MB

Download
memory/4772-132-0x0000000074EC0000-0x0000000075471000-memory.dmp

Filesize
5.7MB

Download
memory/4772-150-0x0000000074EC0000-0x0000000075471000-memory.dmp

Filesize
5.7MB

Download
memory/5048-139-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads