darkcomet | 471ab55fae979dc3661c700ec701af0346159f97aa6de8dc541670623201b106

General

Target

471ab55fae979dc3661c700ec701af0346159f97aa6de8dc541670623201b106.exe
Size

608KB
MD5

42a5fff8d81320870df6af95fb02b68d
SHA1

f0a96ed22ea452a0c9af853015bf20bdb513e648
SHA256

471ab55fae979dc3661c700ec701af0346159f97aa6de8dc541670623201b106
SHA512

41ef0d5b94cba6c03550f0b0a50f49f21230338376e9cae21a6da26ff36db375034fb605cee5ae67f73417848186cb3a2ce71a5e14c24796437731b006c2cfee
SSDEEP

12288:IRBWobw7roJCq49/iUEZnp99R4VTTvznxZ+q6vGC4Dy8US:WGWC/pEJbXmTTxZ+1GCr8US

Score

10^/10

darkcomet guest16_min persistence rat trojan

Malware Config

Extracted

Family

darkcomet

Botnet

Guest16_min

C2

dcratted.duckdns.org:3080

Mutex

DCMIN_MUTEX-G22C7RQ

Attributes

gencode
FFUwUJHhLVPu
install
false
offline_keylogger
true
persistence
false

Signatures

Darkcomet
DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
trojan rat darkcomet
Uses the VBS compiler for execution 1 TTPs

Scripting
T1064

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

471ab55fae979dc3661c700ec701af0346159f97aa6de8dc541670623201b106.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Run\iTunes = "C:\\Users\\Admin\\AppData\\Local\\Temp\\471ab55fae979dc3661c700ec701af0346159f97aa6de8dc541670623201b106.exe"	471ab55fae979dc3661c700ec701af0346159f97aa6de8dc541670623201b106.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

471ab55fae979dc3661c700ec701af0346159f97aa6de8dc541670623201b106.exe

description pid process target process

PID 1764 set thread context of 960 1764 471ab55fae979dc3661c700ec701af0346159f97aa6de8dc541670623201b106.exe vbc.exe

description	pid	process	target process
PID 1764 set thread context of 960	1764	471ab55fae979dc3661c700ec701af0346159f97aa6de8dc541670623201b106.exe	vbc.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

471ab55fae979dc3661c700ec701af0346159f97aa6de8dc541670623201b106.exe

pid	process
1764	471ab55fae979dc3661c700ec701af0346159f97aa6de8dc541670623201b106.exe
1764	471ab55fae979dc3661c700ec701af0346159f97aa6de8dc541670623201b106.exe
1764	471ab55fae979dc3661c700ec701af0346159f97aa6de8dc541670623201b106.exe
1764	471ab55fae979dc3661c700ec701af0346159f97aa6de8dc541670623201b106.exe
1764	471ab55fae979dc3661c700ec701af0346159f97aa6de8dc541670623201b106.exe
1764	471ab55fae979dc3661c700ec701af0346159f97aa6de8dc541670623201b106.exe
1764	471ab55fae979dc3661c700ec701af0346159f97aa6de8dc541670623201b106.exe
1764	471ab55fae979dc3661c700ec701af0346159f97aa6de8dc541670623201b106.exe
1764	471ab55fae979dc3661c700ec701af0346159f97aa6de8dc541670623201b106.exe
1764	471ab55fae979dc3661c700ec701af0346159f97aa6de8dc541670623201b106.exe
1764	471ab55fae979dc3661c700ec701af0346159f97aa6de8dc541670623201b106.exe
1764	471ab55fae979dc3661c700ec701af0346159f97aa6de8dc541670623201b106.exe
1764	471ab55fae979dc3661c700ec701af0346159f97aa6de8dc541670623201b106.exe
1764	471ab55fae979dc3661c700ec701af0346159f97aa6de8dc541670623201b106.exe
1764	471ab55fae979dc3661c700ec701af0346159f97aa6de8dc541670623201b106.exe
1764	471ab55fae979dc3661c700ec701af0346159f97aa6de8dc541670623201b106.exe
1764	471ab55fae979dc3661c700ec701af0346159f97aa6de8dc541670623201b106.exe
1764	471ab55fae979dc3661c700ec701af0346159f97aa6de8dc541670623201b106.exe
1764	471ab55fae979dc3661c700ec701af0346159f97aa6de8dc541670623201b106.exe
1764	471ab55fae979dc3661c700ec701af0346159f97aa6de8dc541670623201b106.exe
1764	471ab55fae979dc3661c700ec701af0346159f97aa6de8dc541670623201b106.exe
1764	471ab55fae979dc3661c700ec701af0346159f97aa6de8dc541670623201b106.exe
1764	471ab55fae979dc3661c700ec701af0346159f97aa6de8dc541670623201b106.exe
1764	471ab55fae979dc3661c700ec701af0346159f97aa6de8dc541670623201b106.exe
1764	471ab55fae979dc3661c700ec701af0346159f97aa6de8dc541670623201b106.exe
1764	471ab55fae979dc3661c700ec701af0346159f97aa6de8dc541670623201b106.exe
1764	471ab55fae979dc3661c700ec701af0346159f97aa6de8dc541670623201b106.exe
1764	471ab55fae979dc3661c700ec701af0346159f97aa6de8dc541670623201b106.exe
1764	471ab55fae979dc3661c700ec701af0346159f97aa6de8dc541670623201b106.exe
1764	471ab55fae979dc3661c700ec701af0346159f97aa6de8dc541670623201b106.exe
1764	471ab55fae979dc3661c700ec701af0346159f97aa6de8dc541670623201b106.exe
1764	471ab55fae979dc3661c700ec701af0346159f97aa6de8dc541670623201b106.exe
1764	471ab55fae979dc3661c700ec701af0346159f97aa6de8dc541670623201b106.exe
1764	471ab55fae979dc3661c700ec701af0346159f97aa6de8dc541670623201b106.exe
1764	471ab55fae979dc3661c700ec701af0346159f97aa6de8dc541670623201b106.exe
1764	471ab55fae979dc3661c700ec701af0346159f97aa6de8dc541670623201b106.exe
1764	471ab55fae979dc3661c700ec701af0346159f97aa6de8dc541670623201b106.exe
1764	471ab55fae979dc3661c700ec701af0346159f97aa6de8dc541670623201b106.exe
1764	471ab55fae979dc3661c700ec701af0346159f97aa6de8dc541670623201b106.exe
1764	471ab55fae979dc3661c700ec701af0346159f97aa6de8dc541670623201b106.exe
1764	471ab55fae979dc3661c700ec701af0346159f97aa6de8dc541670623201b106.exe
1764	471ab55fae979dc3661c700ec701af0346159f97aa6de8dc541670623201b106.exe
1764	471ab55fae979dc3661c700ec701af0346159f97aa6de8dc541670623201b106.exe
1764	471ab55fae979dc3661c700ec701af0346159f97aa6de8dc541670623201b106.exe
1764	471ab55fae979dc3661c700ec701af0346159f97aa6de8dc541670623201b106.exe
1764	471ab55fae979dc3661c700ec701af0346159f97aa6de8dc541670623201b106.exe
1764	471ab55fae979dc3661c700ec701af0346159f97aa6de8dc541670623201b106.exe
1764	471ab55fae979dc3661c700ec701af0346159f97aa6de8dc541670623201b106.exe
1764	471ab55fae979dc3661c700ec701af0346159f97aa6de8dc541670623201b106.exe
1764	471ab55fae979dc3661c700ec701af0346159f97aa6de8dc541670623201b106.exe
1764	471ab55fae979dc3661c700ec701af0346159f97aa6de8dc541670623201b106.exe
1764	471ab55fae979dc3661c700ec701af0346159f97aa6de8dc541670623201b106.exe
1764	471ab55fae979dc3661c700ec701af0346159f97aa6de8dc541670623201b106.exe
1764	471ab55fae979dc3661c700ec701af0346159f97aa6de8dc541670623201b106.exe
1764	471ab55fae979dc3661c700ec701af0346159f97aa6de8dc541670623201b106.exe
1764	471ab55fae979dc3661c700ec701af0346159f97aa6de8dc541670623201b106.exe
1764	471ab55fae979dc3661c700ec701af0346159f97aa6de8dc541670623201b106.exe
1764	471ab55fae979dc3661c700ec701af0346159f97aa6de8dc541670623201b106.exe
1764	471ab55fae979dc3661c700ec701af0346159f97aa6de8dc541670623201b106.exe
1764	471ab55fae979dc3661c700ec701af0346159f97aa6de8dc541670623201b106.exe
1764	471ab55fae979dc3661c700ec701af0346159f97aa6de8dc541670623201b106.exe
1764	471ab55fae979dc3661c700ec701af0346159f97aa6de8dc541670623201b106.exe
1764	471ab55fae979dc3661c700ec701af0346159f97aa6de8dc541670623201b106.exe
1764	471ab55fae979dc3661c700ec701af0346159f97aa6de8dc541670623201b106.exe

Suspicious use of AdjustPrivilegeToken 24 IoCs

Processes:

471ab55fae979dc3661c700ec701af0346159f97aa6de8dc541670623201b106.exevbc.exe

description	pid	process
Token: SeDebugPrivilege	1764	471ab55fae979dc3661c700ec701af0346159f97aa6de8dc541670623201b106.exe
Token: SeIncreaseQuotaPrivilege	960	vbc.exe
Token: SeSecurityPrivilege	960	vbc.exe
Token: SeTakeOwnershipPrivilege	960	vbc.exe
Token: SeLoadDriverPrivilege	960	vbc.exe
Token: SeSystemProfilePrivilege	960	vbc.exe
Token: SeSystemtimePrivilege	960	vbc.exe
Token: SeProfSingleProcessPrivilege	960	vbc.exe
Token: SeIncBasePriorityPrivilege	960	vbc.exe
Token: SeCreatePagefilePrivilege	960	vbc.exe
Token: SeBackupPrivilege	960	vbc.exe
Token: SeRestorePrivilege	960	vbc.exe
Token: SeShutdownPrivilege	960	vbc.exe
Token: SeDebugPrivilege	960	vbc.exe
Token: SeSystemEnvironmentPrivilege	960	vbc.exe
Token: SeChangeNotifyPrivilege	960	vbc.exe
Token: SeRemoteShutdownPrivilege	960	vbc.exe
Token: SeUndockPrivilege	960	vbc.exe
Token: SeManageVolumePrivilege	960	vbc.exe
Token: SeImpersonatePrivilege	960	vbc.exe
Token: SeCreateGlobalPrivilege	960	vbc.exe
Token: 33	960	vbc.exe
Token: 34	960	vbc.exe
Token: 35	960	vbc.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

vbc.exe

pid process

960 vbc.exe

pid	process
960	vbc.exe

Suspicious use of WriteProcessMemory 13 IoCs

Processes:

471ab55fae979dc3661c700ec701af0346159f97aa6de8dc541670623201b106.exe

description	pid	process	target process
PID 1764 wrote to memory of 960	1764	471ab55fae979dc3661c700ec701af0346159f97aa6de8dc541670623201b106.exe	vbc.exe
PID 1764 wrote to memory of 960	1764	471ab55fae979dc3661c700ec701af0346159f97aa6de8dc541670623201b106.exe	vbc.exe
PID 1764 wrote to memory of 960	1764	471ab55fae979dc3661c700ec701af0346159f97aa6de8dc541670623201b106.exe	vbc.exe
PID 1764 wrote to memory of 960	1764	471ab55fae979dc3661c700ec701af0346159f97aa6de8dc541670623201b106.exe	vbc.exe
PID 1764 wrote to memory of 960	1764	471ab55fae979dc3661c700ec701af0346159f97aa6de8dc541670623201b106.exe	vbc.exe
PID 1764 wrote to memory of 960	1764	471ab55fae979dc3661c700ec701af0346159f97aa6de8dc541670623201b106.exe	vbc.exe
PID 1764 wrote to memory of 960	1764	471ab55fae979dc3661c700ec701af0346159f97aa6de8dc541670623201b106.exe	vbc.exe
PID 1764 wrote to memory of 960	1764	471ab55fae979dc3661c700ec701af0346159f97aa6de8dc541670623201b106.exe	vbc.exe
PID 1764 wrote to memory of 960	1764	471ab55fae979dc3661c700ec701af0346159f97aa6de8dc541670623201b106.exe	vbc.exe
PID 1764 wrote to memory of 960	1764	471ab55fae979dc3661c700ec701af0346159f97aa6de8dc541670623201b106.exe	vbc.exe
PID 1764 wrote to memory of 960	1764	471ab55fae979dc3661c700ec701af0346159f97aa6de8dc541670623201b106.exe	vbc.exe
PID 1764 wrote to memory of 960	1764	471ab55fae979dc3661c700ec701af0346159f97aa6de8dc541670623201b106.exe	vbc.exe
PID 1764 wrote to memory of 960	1764	471ab55fae979dc3661c700ec701af0346159f97aa6de8dc541670623201b106.exe	vbc.exe

C:\Users\Admin\AppData\Local\Temp\471ab55fae979dc3661c700ec701af0346159f97aa6de8dc541670623201b106.exe
"C:\Users\Admin\AppData\Local\Temp\471ab55fae979dc3661c700ec701af0346159f97aa6de8dc541670623201b106.exe"
1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1764
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
  C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:960

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scripting

1

T1064

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

Scripting

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/960-66-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/960-59-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/960-77-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/960-75-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/960-68-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/960-61-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/960-63-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/960-70-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/960-56-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/960-55-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/960-65-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/960-72-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/960-71-0x000000000048F888-mapping.dmp

Download
memory/960-74-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/1764-58-0x0000000074060000-0x000000007460B000-memory.dmp

Filesize
5.7MB

Download
memory/1764-76-0x0000000074060000-0x000000007460B000-memory.dmp

Filesize
5.7MB

Download
memory/1764-54-0x0000000075001000-0x0000000075003000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads