darkcomet | a9706aea613642cf8d0952630dbbe7f069b95fe645f15b8de6a99133a7d44335

General

Target

a9706aea613642cf8d0952630dbbe7f069b95fe645f15b8de6a99133a7d44335.exe
Size

681KB
MD5

1c25c3b85cc106b7a1c039dadda42369
SHA1

8664642f01af351ea20b455b21b34dfdf4f78bdc
SHA256

a9706aea613642cf8d0952630dbbe7f069b95fe645f15b8de6a99133a7d44335
SHA512

69a64c3a6fc72d121428a0142a6219ff500fc00ddf04f557ce786dfd018a182ed5091105fb5a70ddd79c03d8d6977deece4926874f57f925b1f62fe0a8bb8331
SSDEEP

12288:4Od2CUD1rXTtpVdyCThFrvmwbfs/pMD+kioCmlNYwmCV8r/UBDqJru2B+Wgar:4m2CghdyEhBv3ipMD+1oJN5VWJrzT

Score

10^/10

darkcomet guest16_min persistence rat trojan

Malware Config

Extracted

Family

darkcomet

Botnet

Guest16_min

C2

dcratted.duckdns.org:3080

Mutex

DCMIN_MUTEX-G22C7RQ

Attributes

gencode
FFUwUJHhLVPu
install
false
offline_keylogger
true
persistence
false

Signatures

Darkcomet
DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
trojan rat darkcomet
Executes dropped EXE 1 IoCs

Processes:

vbc.exe

pid process

4916 vbc.exe
Uses the VBS compiler for execution 1 TTPs

Scripting
T1064

pid	process
4916	vbc.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

a9706aea613642cf8d0952630dbbe7f069b95fe645f15b8de6a99133a7d44335.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\svchost = "C:\\Users\\Admin\\AppData\\Local\\Temp\\svchost .exe"	a9706aea613642cf8d0952630dbbe7f069b95fe645f15b8de6a99133a7d44335.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

a9706aea613642cf8d0952630dbbe7f069b95fe645f15b8de6a99133a7d44335.exe

description	pid	process	target process
PID 5116 set thread context of 4916	5116	a9706aea613642cf8d0952630dbbe7f069b95fe645f15b8de6a99133a7d44335.exe	vbc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 25 IoCs

Processes:

a9706aea613642cf8d0952630dbbe7f069b95fe645f15b8de6a99133a7d44335.exevbc.exe

description	pid	process
Token: SeDebugPrivilege	5116	a9706aea613642cf8d0952630dbbe7f069b95fe645f15b8de6a99133a7d44335.exe
Token: SeIncreaseQuotaPrivilege	4916	vbc.exe
Token: SeSecurityPrivilege	4916	vbc.exe
Token: SeTakeOwnershipPrivilege	4916	vbc.exe
Token: SeLoadDriverPrivilege	4916	vbc.exe
Token: SeSystemProfilePrivilege	4916	vbc.exe
Token: SeSystemtimePrivilege	4916	vbc.exe
Token: SeProfSingleProcessPrivilege	4916	vbc.exe
Token: SeIncBasePriorityPrivilege	4916	vbc.exe
Token: SeCreatePagefilePrivilege	4916	vbc.exe
Token: SeBackupPrivilege	4916	vbc.exe
Token: SeRestorePrivilege	4916	vbc.exe
Token: SeShutdownPrivilege	4916	vbc.exe
Token: SeDebugPrivilege	4916	vbc.exe
Token: SeSystemEnvironmentPrivilege	4916	vbc.exe
Token: SeChangeNotifyPrivilege	4916	vbc.exe
Token: SeRemoteShutdownPrivilege	4916	vbc.exe
Token: SeUndockPrivilege	4916	vbc.exe
Token: SeManageVolumePrivilege	4916	vbc.exe
Token: SeImpersonatePrivilege	4916	vbc.exe
Token: SeCreateGlobalPrivilege	4916	vbc.exe
Token: 33	4916	vbc.exe
Token: 34	4916	vbc.exe
Token: 35	4916	vbc.exe
Token: 36	4916	vbc.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

vbc.exe

pid process

4916 vbc.exe

pid	process
4916	vbc.exe

Suspicious use of WriteProcessMemory 14 IoCs

Processes:

a9706aea613642cf8d0952630dbbe7f069b95fe645f15b8de6a99133a7d44335.exe

description	pid	process	target process
PID 5116 wrote to memory of 4916	5116	a9706aea613642cf8d0952630dbbe7f069b95fe645f15b8de6a99133a7d44335.exe	vbc.exe
PID 5116 wrote to memory of 4916	5116	a9706aea613642cf8d0952630dbbe7f069b95fe645f15b8de6a99133a7d44335.exe	vbc.exe
PID 5116 wrote to memory of 4916	5116	a9706aea613642cf8d0952630dbbe7f069b95fe645f15b8de6a99133a7d44335.exe	vbc.exe
PID 5116 wrote to memory of 4916	5116	a9706aea613642cf8d0952630dbbe7f069b95fe645f15b8de6a99133a7d44335.exe	vbc.exe
PID 5116 wrote to memory of 4916	5116	a9706aea613642cf8d0952630dbbe7f069b95fe645f15b8de6a99133a7d44335.exe	vbc.exe
PID 5116 wrote to memory of 4916	5116	a9706aea613642cf8d0952630dbbe7f069b95fe645f15b8de6a99133a7d44335.exe	vbc.exe
PID 5116 wrote to memory of 4916	5116	a9706aea613642cf8d0952630dbbe7f069b95fe645f15b8de6a99133a7d44335.exe	vbc.exe
PID 5116 wrote to memory of 4916	5116	a9706aea613642cf8d0952630dbbe7f069b95fe645f15b8de6a99133a7d44335.exe	vbc.exe
PID 5116 wrote to memory of 4916	5116	a9706aea613642cf8d0952630dbbe7f069b95fe645f15b8de6a99133a7d44335.exe	vbc.exe
PID 5116 wrote to memory of 4916	5116	a9706aea613642cf8d0952630dbbe7f069b95fe645f15b8de6a99133a7d44335.exe	vbc.exe
PID 5116 wrote to memory of 4916	5116	a9706aea613642cf8d0952630dbbe7f069b95fe645f15b8de6a99133a7d44335.exe	vbc.exe
PID 5116 wrote to memory of 4916	5116	a9706aea613642cf8d0952630dbbe7f069b95fe645f15b8de6a99133a7d44335.exe	vbc.exe
PID 5116 wrote to memory of 4916	5116	a9706aea613642cf8d0952630dbbe7f069b95fe645f15b8de6a99133a7d44335.exe	vbc.exe
PID 5116 wrote to memory of 4916	5116	a9706aea613642cf8d0952630dbbe7f069b95fe645f15b8de6a99133a7d44335.exe	vbc.exe

C:\Users\Admin\AppData\Local\Temp\a9706aea613642cf8d0952630dbbe7f069b95fe645f15b8de6a99133a7d44335.exe
"C:\Users\Admin\AppData\Local\Temp\a9706aea613642cf8d0952630dbbe7f069b95fe645f15b8de6a99133a7d44335.exe"
1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5116
- C:\Users\Admin\AppData\Local\Temp\vbc.exe
  C:\Users\Admin\AppData\Local\Temp\vbc.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:4916

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scripting

1

T1064

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

Scripting

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\vbc.exe

Filesize
1.1MB

MD5
d881de17aa8f2e2c08cbb7b265f928f9

SHA1
08936aebc87decf0af6e8eada191062b5e65ac2a

SHA256
b3a37093609f9a20ad60b85a9fa9de2ba674cba9b5bd687729440c70ba619ca0

SHA512
5f23bfb1b8740247b36ed0ab741738c7d4c949736129e767213e321607d1ccd3e3a8428e4ba44bd28a275b5e3f6206285b1a522514b7ef7ea5e698d90a713d34

Download Submit
C:\Users\Admin\AppData\Local\Temp\vbc.exe

Filesize
1.1MB

MD5
d881de17aa8f2e2c08cbb7b265f928f9

SHA1
08936aebc87decf0af6e8eada191062b5e65ac2a

SHA256
b3a37093609f9a20ad60b85a9fa9de2ba674cba9b5bd687729440c70ba619ca0

SHA512
5f23bfb1b8740247b36ed0ab741738c7d4c949736129e767213e321607d1ccd3e3a8428e4ba44bd28a275b5e3f6206285b1a522514b7ef7ea5e698d90a713d34

Download Submit
memory/4916-138-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/4916-137-0x0000000000000000-mapping.dmp

Download
memory/4916-141-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/4916-142-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/4916-144-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/4916-145-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/5116-135-0x0000000005060000-0x000000000506A000-memory.dmp

Filesize
40KB

Download
memory/5116-136-0x0000000007BD0000-0x0000000007C6C000-memory.dmp

Filesize
624KB

Download
memory/5116-132-0x0000000000470000-0x0000000000520000-memory.dmp

Filesize
704KB

Download
memory/5116-134-0x0000000004EA0000-0x0000000004F32000-memory.dmp

Filesize
584KB

Download
memory/5116-133-0x0000000005500000-0x0000000005AA4000-memory.dmp

Filesize
5.6MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads