darkcomet | 2702fe34d53dde360af4c114c0ad0d458b2c9ae9500c42c8354d8e57edce74a2

General

Target

2702fe34d53dde360af4c114c0ad0d458b2c9ae9500c42c8354d8e57edce74a2.exe
Size

452KB
MD5

7de9787876d0ecb71648f25bd1e5fc51
SHA1

2bc2b1a2977b64eb22d069941a45abfe04d44622
SHA256

2702fe34d53dde360af4c114c0ad0d458b2c9ae9500c42c8354d8e57edce74a2
SHA512

347a214a9cfbbd799e1a0f11568959884909d9dbd9bafd8302859af9ab7c5a2bb5328a1f28260b1839f1dd6952197e02bd75cd5a09dec4026181857d8b2b4bc9
SSDEEP

12288:6M5tnmfeuL8U3yoWwYLtfCgaNiAY8lIkd+:6M5p2nL8A8wYLgFNfj

Score

10^/10

darkcomet suretey persistence rat trojan upx

Malware Config

Extracted

Family

darkcomet

Botnet

suretey

C2

kaspanet.jed-group.com:1660

Mutex

DC_MUTEX-DW9F7R5

Attributes

gencode
gagSQD1wwynQ
install
false
offline_keylogger
true
persistence
false

Signatures

Darkcomet
DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
trojan rat darkcomet

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1004

Modify Registry

T1112

Processes:

reg.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "explorer.exe,C:\\Users\\Admin\\AppData\\Roaming\\SunJava\\JavaUpdata.exe"	reg.exe

UPX packed file 8 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral1/memory/948-59-0x0000000000400000-0x00000000004B7000-memory.dmp	upx
behavioral1/memory/948-61-0x0000000000400000-0x00000000004B7000-memory.dmp	upx
behavioral1/memory/948-62-0x0000000000400000-0x00000000004B7000-memory.dmp	upx
behavioral1/memory/948-64-0x0000000000400000-0x00000000004B7000-memory.dmp	upx
behavioral1/memory/948-66-0x0000000000400000-0x00000000004B7000-memory.dmp	upx
behavioral1/memory/948-67-0x0000000000400000-0x00000000004B7000-memory.dmp	upx
behavioral1/memory/948-74-0x0000000000400000-0x00000000004B7000-memory.dmp	upx
behavioral1/memory/948-75-0x0000000000400000-0x00000000004B7000-memory.dmp	upx

Suspicious use of SetThreadContext 1 IoCs

Processes:

2702fe34d53dde360af4c114c0ad0d458b2c9ae9500c42c8354d8e57edce74a2.exe

description	pid	process	target process
PID 1988 set thread context of 948	1988	2702fe34d53dde360af4c114c0ad0d458b2c9ae9500c42c8354d8e57edce74a2.exe	2702fe34d53dde360af4c114c0ad0d458b2c9ae9500c42c8354d8e57edce74a2.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 23 IoCs

Processes:

2702fe34d53dde360af4c114c0ad0d458b2c9ae9500c42c8354d8e57edce74a2.exe

description	pid	process
Token: SeIncreaseQuotaPrivilege	948	2702fe34d53dde360af4c114c0ad0d458b2c9ae9500c42c8354d8e57edce74a2.exe
Token: SeSecurityPrivilege	948	2702fe34d53dde360af4c114c0ad0d458b2c9ae9500c42c8354d8e57edce74a2.exe
Token: SeTakeOwnershipPrivilege	948	2702fe34d53dde360af4c114c0ad0d458b2c9ae9500c42c8354d8e57edce74a2.exe
Token: SeLoadDriverPrivilege	948	2702fe34d53dde360af4c114c0ad0d458b2c9ae9500c42c8354d8e57edce74a2.exe
Token: SeSystemProfilePrivilege	948	2702fe34d53dde360af4c114c0ad0d458b2c9ae9500c42c8354d8e57edce74a2.exe
Token: SeSystemtimePrivilege	948	2702fe34d53dde360af4c114c0ad0d458b2c9ae9500c42c8354d8e57edce74a2.exe
Token: SeProfSingleProcessPrivilege	948	2702fe34d53dde360af4c114c0ad0d458b2c9ae9500c42c8354d8e57edce74a2.exe
Token: SeIncBasePriorityPrivilege	948	2702fe34d53dde360af4c114c0ad0d458b2c9ae9500c42c8354d8e57edce74a2.exe
Token: SeCreatePagefilePrivilege	948	2702fe34d53dde360af4c114c0ad0d458b2c9ae9500c42c8354d8e57edce74a2.exe
Token: SeBackupPrivilege	948	2702fe34d53dde360af4c114c0ad0d458b2c9ae9500c42c8354d8e57edce74a2.exe
Token: SeRestorePrivilege	948	2702fe34d53dde360af4c114c0ad0d458b2c9ae9500c42c8354d8e57edce74a2.exe
Token: SeShutdownPrivilege	948	2702fe34d53dde360af4c114c0ad0d458b2c9ae9500c42c8354d8e57edce74a2.exe
Token: SeDebugPrivilege	948	2702fe34d53dde360af4c114c0ad0d458b2c9ae9500c42c8354d8e57edce74a2.exe
Token: SeSystemEnvironmentPrivilege	948	2702fe34d53dde360af4c114c0ad0d458b2c9ae9500c42c8354d8e57edce74a2.exe
Token: SeChangeNotifyPrivilege	948	2702fe34d53dde360af4c114c0ad0d458b2c9ae9500c42c8354d8e57edce74a2.exe
Token: SeRemoteShutdownPrivilege	948	2702fe34d53dde360af4c114c0ad0d458b2c9ae9500c42c8354d8e57edce74a2.exe
Token: SeUndockPrivilege	948	2702fe34d53dde360af4c114c0ad0d458b2c9ae9500c42c8354d8e57edce74a2.exe
Token: SeManageVolumePrivilege	948	2702fe34d53dde360af4c114c0ad0d458b2c9ae9500c42c8354d8e57edce74a2.exe
Token: SeImpersonatePrivilege	948	2702fe34d53dde360af4c114c0ad0d458b2c9ae9500c42c8354d8e57edce74a2.exe
Token: SeCreateGlobalPrivilege	948	2702fe34d53dde360af4c114c0ad0d458b2c9ae9500c42c8354d8e57edce74a2.exe
Token: 33	948	2702fe34d53dde360af4c114c0ad0d458b2c9ae9500c42c8354d8e57edce74a2.exe
Token: 34	948	2702fe34d53dde360af4c114c0ad0d458b2c9ae9500c42c8354d8e57edce74a2.exe
Token: 35	948	2702fe34d53dde360af4c114c0ad0d458b2c9ae9500c42c8354d8e57edce74a2.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

2702fe34d53dde360af4c114c0ad0d458b2c9ae9500c42c8354d8e57edce74a2.exe

pid process

948 2702fe34d53dde360af4c114c0ad0d458b2c9ae9500c42c8354d8e57edce74a2.exe

pid	process
948	2702fe34d53dde360af4c114c0ad0d458b2c9ae9500c42c8354d8e57edce74a2.exe

Suspicious use of WriteProcessMemory 42 IoCs

Processes:

2702fe34d53dde360af4c114c0ad0d458b2c9ae9500c42c8354d8e57edce74a2.exe2702fe34d53dde360af4c114c0ad0d458b2c9ae9500c42c8354d8e57edce74a2.execmd.exe

description	pid	process	target process
PID 1988 wrote to memory of 948	1988	2702fe34d53dde360af4c114c0ad0d458b2c9ae9500c42c8354d8e57edce74a2.exe	2702fe34d53dde360af4c114c0ad0d458b2c9ae9500c42c8354d8e57edce74a2.exe
PID 1988 wrote to memory of 948	1988	2702fe34d53dde360af4c114c0ad0d458b2c9ae9500c42c8354d8e57edce74a2.exe	2702fe34d53dde360af4c114c0ad0d458b2c9ae9500c42c8354d8e57edce74a2.exe
PID 1988 wrote to memory of 948	1988	2702fe34d53dde360af4c114c0ad0d458b2c9ae9500c42c8354d8e57edce74a2.exe	2702fe34d53dde360af4c114c0ad0d458b2c9ae9500c42c8354d8e57edce74a2.exe
PID 1988 wrote to memory of 948	1988	2702fe34d53dde360af4c114c0ad0d458b2c9ae9500c42c8354d8e57edce74a2.exe	2702fe34d53dde360af4c114c0ad0d458b2c9ae9500c42c8354d8e57edce74a2.exe
PID 1988 wrote to memory of 948	1988	2702fe34d53dde360af4c114c0ad0d458b2c9ae9500c42c8354d8e57edce74a2.exe	2702fe34d53dde360af4c114c0ad0d458b2c9ae9500c42c8354d8e57edce74a2.exe
PID 1988 wrote to memory of 948	1988	2702fe34d53dde360af4c114c0ad0d458b2c9ae9500c42c8354d8e57edce74a2.exe	2702fe34d53dde360af4c114c0ad0d458b2c9ae9500c42c8354d8e57edce74a2.exe
PID 1988 wrote to memory of 948	1988	2702fe34d53dde360af4c114c0ad0d458b2c9ae9500c42c8354d8e57edce74a2.exe	2702fe34d53dde360af4c114c0ad0d458b2c9ae9500c42c8354d8e57edce74a2.exe
PID 1988 wrote to memory of 948	1988	2702fe34d53dde360af4c114c0ad0d458b2c9ae9500c42c8354d8e57edce74a2.exe	2702fe34d53dde360af4c114c0ad0d458b2c9ae9500c42c8354d8e57edce74a2.exe
PID 1988 wrote to memory of 948	1988	2702fe34d53dde360af4c114c0ad0d458b2c9ae9500c42c8354d8e57edce74a2.exe	2702fe34d53dde360af4c114c0ad0d458b2c9ae9500c42c8354d8e57edce74a2.exe
PID 1988 wrote to memory of 948	1988	2702fe34d53dde360af4c114c0ad0d458b2c9ae9500c42c8354d8e57edce74a2.exe	2702fe34d53dde360af4c114c0ad0d458b2c9ae9500c42c8354d8e57edce74a2.exe
PID 1988 wrote to memory of 948	1988	2702fe34d53dde360af4c114c0ad0d458b2c9ae9500c42c8354d8e57edce74a2.exe	2702fe34d53dde360af4c114c0ad0d458b2c9ae9500c42c8354d8e57edce74a2.exe
PID 948 wrote to memory of 1204	948	2702fe34d53dde360af4c114c0ad0d458b2c9ae9500c42c8354d8e57edce74a2.exe	notepad.exe
PID 948 wrote to memory of 1204	948	2702fe34d53dde360af4c114c0ad0d458b2c9ae9500c42c8354d8e57edce74a2.exe	notepad.exe
PID 948 wrote to memory of 1204	948	2702fe34d53dde360af4c114c0ad0d458b2c9ae9500c42c8354d8e57edce74a2.exe	notepad.exe
PID 948 wrote to memory of 1204	948	2702fe34d53dde360af4c114c0ad0d458b2c9ae9500c42c8354d8e57edce74a2.exe	notepad.exe
PID 948 wrote to memory of 1204	948	2702fe34d53dde360af4c114c0ad0d458b2c9ae9500c42c8354d8e57edce74a2.exe	notepad.exe
PID 948 wrote to memory of 1204	948	2702fe34d53dde360af4c114c0ad0d458b2c9ae9500c42c8354d8e57edce74a2.exe	notepad.exe
PID 948 wrote to memory of 1204	948	2702fe34d53dde360af4c114c0ad0d458b2c9ae9500c42c8354d8e57edce74a2.exe	notepad.exe
PID 948 wrote to memory of 1204	948	2702fe34d53dde360af4c114c0ad0d458b2c9ae9500c42c8354d8e57edce74a2.exe	notepad.exe
PID 948 wrote to memory of 1204	948	2702fe34d53dde360af4c114c0ad0d458b2c9ae9500c42c8354d8e57edce74a2.exe	notepad.exe
PID 948 wrote to memory of 1204	948	2702fe34d53dde360af4c114c0ad0d458b2c9ae9500c42c8354d8e57edce74a2.exe	notepad.exe
PID 948 wrote to memory of 1204	948	2702fe34d53dde360af4c114c0ad0d458b2c9ae9500c42c8354d8e57edce74a2.exe	notepad.exe
PID 948 wrote to memory of 1204	948	2702fe34d53dde360af4c114c0ad0d458b2c9ae9500c42c8354d8e57edce74a2.exe	notepad.exe
PID 948 wrote to memory of 1204	948	2702fe34d53dde360af4c114c0ad0d458b2c9ae9500c42c8354d8e57edce74a2.exe	notepad.exe
PID 948 wrote to memory of 1204	948	2702fe34d53dde360af4c114c0ad0d458b2c9ae9500c42c8354d8e57edce74a2.exe	notepad.exe
PID 948 wrote to memory of 1204	948	2702fe34d53dde360af4c114c0ad0d458b2c9ae9500c42c8354d8e57edce74a2.exe	notepad.exe
PID 948 wrote to memory of 1204	948	2702fe34d53dde360af4c114c0ad0d458b2c9ae9500c42c8354d8e57edce74a2.exe	notepad.exe
PID 948 wrote to memory of 1204	948	2702fe34d53dde360af4c114c0ad0d458b2c9ae9500c42c8354d8e57edce74a2.exe	notepad.exe
PID 948 wrote to memory of 1204	948	2702fe34d53dde360af4c114c0ad0d458b2c9ae9500c42c8354d8e57edce74a2.exe	notepad.exe
PID 948 wrote to memory of 1204	948	2702fe34d53dde360af4c114c0ad0d458b2c9ae9500c42c8354d8e57edce74a2.exe	notepad.exe
PID 948 wrote to memory of 1204	948	2702fe34d53dde360af4c114c0ad0d458b2c9ae9500c42c8354d8e57edce74a2.exe	notepad.exe
PID 948 wrote to memory of 1204	948	2702fe34d53dde360af4c114c0ad0d458b2c9ae9500c42c8354d8e57edce74a2.exe	notepad.exe
PID 948 wrote to memory of 1204	948	2702fe34d53dde360af4c114c0ad0d458b2c9ae9500c42c8354d8e57edce74a2.exe	notepad.exe
PID 948 wrote to memory of 1204	948	2702fe34d53dde360af4c114c0ad0d458b2c9ae9500c42c8354d8e57edce74a2.exe	notepad.exe
PID 1988 wrote to memory of 2032	1988	2702fe34d53dde360af4c114c0ad0d458b2c9ae9500c42c8354d8e57edce74a2.exe	cmd.exe
PID 1988 wrote to memory of 2032	1988	2702fe34d53dde360af4c114c0ad0d458b2c9ae9500c42c8354d8e57edce74a2.exe	cmd.exe
PID 1988 wrote to memory of 2032	1988	2702fe34d53dde360af4c114c0ad0d458b2c9ae9500c42c8354d8e57edce74a2.exe	cmd.exe
PID 1988 wrote to memory of 2032	1988	2702fe34d53dde360af4c114c0ad0d458b2c9ae9500c42c8354d8e57edce74a2.exe	cmd.exe
PID 2032 wrote to memory of 1156	2032	cmd.exe	reg.exe
PID 2032 wrote to memory of 1156	2032	cmd.exe	reg.exe
PID 2032 wrote to memory of 1156	2032	cmd.exe	reg.exe
PID 2032 wrote to memory of 1156	2032	cmd.exe	reg.exe

C:\Users\Admin\AppData\Local\Temp\2702fe34d53dde360af4c114c0ad0d458b2c9ae9500c42c8354d8e57edce74a2.exe
"C:\Users\Admin\AppData\Local\Temp\2702fe34d53dde360af4c114c0ad0d458b2c9ae9500c42c8354d8e57edce74a2.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1988

C:\Users\Admin\AppData\Local\Temp\2702fe34d53dde360af4c114c0ad0d458b2c9ae9500c42c8354d8e57edce74a2.exe
"C:\Users\Admin\AppData\Local\Temp\2702fe34d53dde360af4c114c0ad0d458b2c9ae9500c42c8354d8e57edce74a2.exe"
2⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:948

C:\Windows\SysWOW64\notepad.exe
notepad
3⤵
PID:1204

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c reg add "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v shell /t REG_SZ /d explorer.exe,"C:\Users\Admin\AppData\Roaming\SunJava\JavaUpdata.exe"
2⤵
- Suspicious use of WriteProcessMemory
PID:2032

C:\Windows\SysWOW64\reg.exe
reg add "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v shell /t REG_SZ /d explorer.exe,"C:\Users\Admin\AppData\Roaming\SunJava\JavaUpdata.exe"
3⤵
- Modifies WinLogon for persistence
PID:1156

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Winlogon Helper DLL

1

T1004

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/948-63-0x00000000004B5670-mapping.dmp

Download
memory/948-75-0x0000000000400000-0x00000000004B7000-memory.dmp

Filesize
732KB

Download
memory/948-64-0x0000000000400000-0x00000000004B7000-memory.dmp

Filesize
732KB

Download
memory/948-74-0x0000000000400000-0x00000000004B7000-memory.dmp

Filesize
732KB

Download
memory/948-58-0x0000000000400000-0x00000000004B7000-memory.dmp

Filesize
732KB

Download
memory/948-59-0x0000000000400000-0x00000000004B7000-memory.dmp

Filesize
732KB

Download
memory/948-61-0x0000000000400000-0x00000000004B7000-memory.dmp

Filesize
732KB

Download
memory/948-62-0x0000000000400000-0x00000000004B7000-memory.dmp

Filesize
732KB

Download
memory/948-66-0x0000000000400000-0x00000000004B7000-memory.dmp

Filesize
732KB

Download
memory/948-67-0x0000000000400000-0x00000000004B7000-memory.dmp

Filesize
732KB

Download
memory/1156-71-0x0000000000000000-mapping.dmp

Download
memory/1204-68-0x0000000000000000-mapping.dmp

Download
memory/1988-55-0x0000000074270000-0x000000007481B000-memory.dmp

Filesize
5.7MB

Download
memory/1988-56-0x00000000001B5000-0x00000000001C6000-memory.dmp

Filesize
68KB

Download
memory/1988-72-0x0000000074270000-0x000000007481B000-memory.dmp

Filesize
5.7MB

Download
memory/1988-73-0x00000000001B5000-0x00000000001C6000-memory.dmp

Filesize
68KB

Download
memory/1988-57-0x0000000074270000-0x000000007481B000-memory.dmp

Filesize
5.7MB

Download
memory/1988-54-0x0000000075281000-0x0000000075283000-memory.dmp

Filesize
8KB

Download
memory/2032-70-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads