darkcomet | e2d8e1808e5ee515d30b8a88a8141f422505f4a8f4adfe9fd546fddf0de893db

General

Target

e2d8e1808e5ee515d30b8a88a8141f422505f4a8f4adfe9fd546fddf0de893db.exe
Size

503KB
MD5

0d2092c561a5d13999a1eb567e9f55f4
SHA1

0fc352cb69b361aa9bd0e21f79835bbea6acb611
SHA256

e2d8e1808e5ee515d30b8a88a8141f422505f4a8f4adfe9fd546fddf0de893db
SHA512

36c7d49ec7ab85561385ef7b360c4e971aa1335c545ce557254963485373a146023ec06d75003cfb50bf5c54aed81728a48a313860edbafe301d3cd41cd63647
SSDEEP

12288:DrrulTXRTvTeQpVR48PYyfumA5nCuSWQotT48uHZGsF:/r6TBTvNrRsWWnCuyoDu5GsF

Score

10^/10

darkcomet 19/7 persistence rat trojan

Malware Config

Extracted

Family

darkcomet

Botnet

19/7

C2

spotcrabs.twilightparadox.com:1500

Mutex

DC_MUTEX-HEZHVLE

Attributes

gencode
deGNxbQZUbYS
install
false
offline_keylogger
true
persistence
false

Signatures

Darkcomet
DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
trojan rat darkcomet

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1004

Modify Registry

T1112

Processes:

reg.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Users\\Admin\\AppData\\Roaming\\WinApp\\GoogleUpdate.exe,explorer.exe"	reg.exe

Executes dropped EXE 1 IoCs

Processes:

e2d8e1808e5ee515d30b8a88a8141f422505f4a8f4adfe9fd546fddf0de893db.exe

pid process

1084 e2d8e1808e5ee515d30b8a88a8141f422505f4a8f4adfe9fd546fddf0de893db.exe

pid	process
1084	e2d8e1808e5ee515d30b8a88a8141f422505f4a8f4adfe9fd546fddf0de893db.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

e2d8e1808e5ee515d30b8a88a8141f422505f4a8f4adfe9fd546fddf0de893db.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Control Panel\International\Geo\Nation	e2d8e1808e5ee515d30b8a88a8141f422505f4a8f4adfe9fd546fddf0de893db.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

e2d8e1808e5ee515d30b8a88a8141f422505f4a8f4adfe9fd546fddf0de893db.exe

description	pid	process	target process
PID 2504 set thread context of 1084	2504	e2d8e1808e5ee515d30b8a88a8141f422505f4a8f4adfe9fd546fddf0de893db.exe	e2d8e1808e5ee515d30b8a88a8141f422505f4a8f4adfe9fd546fddf0de893db.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

e2d8e1808e5ee515d30b8a88a8141f422505f4a8f4adfe9fd546fddf0de893db.exe

pid	process
2504	e2d8e1808e5ee515d30b8a88a8141f422505f4a8f4adfe9fd546fddf0de893db.exe
2504	e2d8e1808e5ee515d30b8a88a8141f422505f4a8f4adfe9fd546fddf0de893db.exe

Suspicious use of AdjustPrivilegeToken 25 IoCs

Processes:

e2d8e1808e5ee515d30b8a88a8141f422505f4a8f4adfe9fd546fddf0de893db.exee2d8e1808e5ee515d30b8a88a8141f422505f4a8f4adfe9fd546fddf0de893db.exe

description	pid	process
Token: SeDebugPrivilege	2504	e2d8e1808e5ee515d30b8a88a8141f422505f4a8f4adfe9fd546fddf0de893db.exe
Token: SeIncreaseQuotaPrivilege	1084	e2d8e1808e5ee515d30b8a88a8141f422505f4a8f4adfe9fd546fddf0de893db.exe
Token: SeSecurityPrivilege	1084	e2d8e1808e5ee515d30b8a88a8141f422505f4a8f4adfe9fd546fddf0de893db.exe
Token: SeTakeOwnershipPrivilege	1084	e2d8e1808e5ee515d30b8a88a8141f422505f4a8f4adfe9fd546fddf0de893db.exe
Token: SeLoadDriverPrivilege	1084	e2d8e1808e5ee515d30b8a88a8141f422505f4a8f4adfe9fd546fddf0de893db.exe
Token: SeSystemProfilePrivilege	1084	e2d8e1808e5ee515d30b8a88a8141f422505f4a8f4adfe9fd546fddf0de893db.exe
Token: SeSystemtimePrivilege	1084	e2d8e1808e5ee515d30b8a88a8141f422505f4a8f4adfe9fd546fddf0de893db.exe
Token: SeProfSingleProcessPrivilege	1084	e2d8e1808e5ee515d30b8a88a8141f422505f4a8f4adfe9fd546fddf0de893db.exe
Token: SeIncBasePriorityPrivilege	1084	e2d8e1808e5ee515d30b8a88a8141f422505f4a8f4adfe9fd546fddf0de893db.exe
Token: SeCreatePagefilePrivilege	1084	e2d8e1808e5ee515d30b8a88a8141f422505f4a8f4adfe9fd546fddf0de893db.exe
Token: SeBackupPrivilege	1084	e2d8e1808e5ee515d30b8a88a8141f422505f4a8f4adfe9fd546fddf0de893db.exe
Token: SeRestorePrivilege	1084	e2d8e1808e5ee515d30b8a88a8141f422505f4a8f4adfe9fd546fddf0de893db.exe
Token: SeShutdownPrivilege	1084	e2d8e1808e5ee515d30b8a88a8141f422505f4a8f4adfe9fd546fddf0de893db.exe
Token: SeDebugPrivilege	1084	e2d8e1808e5ee515d30b8a88a8141f422505f4a8f4adfe9fd546fddf0de893db.exe
Token: SeSystemEnvironmentPrivilege	1084	e2d8e1808e5ee515d30b8a88a8141f422505f4a8f4adfe9fd546fddf0de893db.exe
Token: SeChangeNotifyPrivilege	1084	e2d8e1808e5ee515d30b8a88a8141f422505f4a8f4adfe9fd546fddf0de893db.exe
Token: SeRemoteShutdownPrivilege	1084	e2d8e1808e5ee515d30b8a88a8141f422505f4a8f4adfe9fd546fddf0de893db.exe
Token: SeUndockPrivilege	1084	e2d8e1808e5ee515d30b8a88a8141f422505f4a8f4adfe9fd546fddf0de893db.exe
Token: SeManageVolumePrivilege	1084	e2d8e1808e5ee515d30b8a88a8141f422505f4a8f4adfe9fd546fddf0de893db.exe
Token: SeImpersonatePrivilege	1084	e2d8e1808e5ee515d30b8a88a8141f422505f4a8f4adfe9fd546fddf0de893db.exe
Token: SeCreateGlobalPrivilege	1084	e2d8e1808e5ee515d30b8a88a8141f422505f4a8f4adfe9fd546fddf0de893db.exe
Token: 33	1084	e2d8e1808e5ee515d30b8a88a8141f422505f4a8f4adfe9fd546fddf0de893db.exe
Token: 34	1084	e2d8e1808e5ee515d30b8a88a8141f422505f4a8f4adfe9fd546fddf0de893db.exe
Token: 35	1084	e2d8e1808e5ee515d30b8a88a8141f422505f4a8f4adfe9fd546fddf0de893db.exe
Token: 36	1084	e2d8e1808e5ee515d30b8a88a8141f422505f4a8f4adfe9fd546fddf0de893db.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

e2d8e1808e5ee515d30b8a88a8141f422505f4a8f4adfe9fd546fddf0de893db.exe

pid process

1084 e2d8e1808e5ee515d30b8a88a8141f422505f4a8f4adfe9fd546fddf0de893db.exe

pid	process
1084	e2d8e1808e5ee515d30b8a88a8141f422505f4a8f4adfe9fd546fddf0de893db.exe

Suspicious use of WriteProcessMemory 18 IoCs

Processes:

e2d8e1808e5ee515d30b8a88a8141f422505f4a8f4adfe9fd546fddf0de893db.execmd.exe

C:\Users\Admin\AppData\Local\Temp\e2d8e1808e5ee515d30b8a88a8141f422505f4a8f4adfe9fd546fddf0de893db.exe
"C:\Users\Admin\AppData\Local\Temp\e2d8e1808e5ee515d30b8a88a8141f422505f4a8f4adfe9fd546fddf0de893db.exe"
1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2504

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" /c reg add "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v shell /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\WinApp\GoogleUpdate.exe,explorer.exe"
2⤵
- Suspicious use of WriteProcessMemory
PID:1740

C:\Windows\SysWOW64\reg.exe
reg add "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v shell /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\WinApp\GoogleUpdate.exe,explorer.exe"
3⤵
- Modifies WinLogon for persistence
PID:4460

C:\Users\Admin\AppData\Local\Temp\e2d8e1808e5ee515d30b8a88a8141f422505f4a8f4adfe9fd546fddf0de893db.exe
"C:\Users\Admin\AppData\Local\Temp\e2d8e1808e5ee515d30b8a88a8141f422505f4a8f4adfe9fd546fddf0de893db.exe"
2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1084

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Winlogon Helper DLL

1

T1004

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\e2d8e1808e5ee515d30b8a88a8141f422505f4a8f4adfe9fd546fddf0de893db.exe

Filesize
503KB

MD5
0d2092c561a5d13999a1eb567e9f55f4

SHA1
0fc352cb69b361aa9bd0e21f79835bbea6acb611

SHA256
e2d8e1808e5ee515d30b8a88a8141f422505f4a8f4adfe9fd546fddf0de893db

SHA512
36c7d49ec7ab85561385ef7b360c4e971aa1335c545ce557254963485373a146023ec06d75003cfb50bf5c54aed81728a48a313860edbafe301d3cd41cd63647

Download Submit
memory/1084-135-0x0000000000000000-mapping.dmp

Download
memory/1084-138-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/1084-136-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/1084-141-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/1084-142-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/1084-143-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/1740-134-0x0000000000000000-mapping.dmp

Download
memory/2504-132-0x00000000749E0000-0x0000000074F91000-memory.dmp

Filesize
5.7MB

Download
memory/2504-133-0x00000000749E0000-0x0000000074F91000-memory.dmp

Filesize
5.7MB

Download
memory/2504-140-0x00000000749E0000-0x0000000074F91000-memory.dmp

Filesize
5.7MB

Download
memory/4460-139-0x0000000000000000-mapping.dmp

Download

description	pid	process	target process
PID 2504 wrote to memory of 1740	2504	e2d8e1808e5ee515d30b8a88a8141f422505f4a8f4adfe9fd546fddf0de893db.exe	cmd.exe
PID 2504 wrote to memory of 1740	2504	e2d8e1808e5ee515d30b8a88a8141f422505f4a8f4adfe9fd546fddf0de893db.exe	cmd.exe
PID 2504 wrote to memory of 1740	2504	e2d8e1808e5ee515d30b8a88a8141f422505f4a8f4adfe9fd546fddf0de893db.exe	cmd.exe
PID 2504 wrote to memory of 1084	2504	e2d8e1808e5ee515d30b8a88a8141f422505f4a8f4adfe9fd546fddf0de893db.exe	e2d8e1808e5ee515d30b8a88a8141f422505f4a8f4adfe9fd546fddf0de893db.exe
PID 2504 wrote to memory of 1084	2504	e2d8e1808e5ee515d30b8a88a8141f422505f4a8f4adfe9fd546fddf0de893db.exe	e2d8e1808e5ee515d30b8a88a8141f422505f4a8f4adfe9fd546fddf0de893db.exe
PID 2504 wrote to memory of 1084	2504	e2d8e1808e5ee515d30b8a88a8141f422505f4a8f4adfe9fd546fddf0de893db.exe	e2d8e1808e5ee515d30b8a88a8141f422505f4a8f4adfe9fd546fddf0de893db.exe
PID 2504 wrote to memory of 1084	2504	e2d8e1808e5ee515d30b8a88a8141f422505f4a8f4adfe9fd546fddf0de893db.exe	e2d8e1808e5ee515d30b8a88a8141f422505f4a8f4adfe9fd546fddf0de893db.exe
PID 2504 wrote to memory of 1084	2504	e2d8e1808e5ee515d30b8a88a8141f422505f4a8f4adfe9fd546fddf0de893db.exe	e2d8e1808e5ee515d30b8a88a8141f422505f4a8f4adfe9fd546fddf0de893db.exe
PID 2504 wrote to memory of 1084	2504	e2d8e1808e5ee515d30b8a88a8141f422505f4a8f4adfe9fd546fddf0de893db.exe	e2d8e1808e5ee515d30b8a88a8141f422505f4a8f4adfe9fd546fddf0de893db.exe
PID 2504 wrote to memory of 1084	2504	e2d8e1808e5ee515d30b8a88a8141f422505f4a8f4adfe9fd546fddf0de893db.exe	e2d8e1808e5ee515d30b8a88a8141f422505f4a8f4adfe9fd546fddf0de893db.exe
PID 2504 wrote to memory of 1084	2504	e2d8e1808e5ee515d30b8a88a8141f422505f4a8f4adfe9fd546fddf0de893db.exe	e2d8e1808e5ee515d30b8a88a8141f422505f4a8f4adfe9fd546fddf0de893db.exe
PID 2504 wrote to memory of 1084	2504	e2d8e1808e5ee515d30b8a88a8141f422505f4a8f4adfe9fd546fddf0de893db.exe	e2d8e1808e5ee515d30b8a88a8141f422505f4a8f4adfe9fd546fddf0de893db.exe
PID 2504 wrote to memory of 1084	2504	e2d8e1808e5ee515d30b8a88a8141f422505f4a8f4adfe9fd546fddf0de893db.exe	e2d8e1808e5ee515d30b8a88a8141f422505f4a8f4adfe9fd546fddf0de893db.exe
PID 2504 wrote to memory of 1084	2504	e2d8e1808e5ee515d30b8a88a8141f422505f4a8f4adfe9fd546fddf0de893db.exe	e2d8e1808e5ee515d30b8a88a8141f422505f4a8f4adfe9fd546fddf0de893db.exe
PID 2504 wrote to memory of 1084	2504	e2d8e1808e5ee515d30b8a88a8141f422505f4a8f4adfe9fd546fddf0de893db.exe	e2d8e1808e5ee515d30b8a88a8141f422505f4a8f4adfe9fd546fddf0de893db.exe
PID 1740 wrote to memory of 4460	1740	cmd.exe	reg.exe
PID 1740 wrote to memory of 4460	1740	cmd.exe	reg.exe
PID 1740 wrote to memory of 4460	1740	cmd.exe	reg.exe

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads