darkcomet | 471ab55fae979dc3661c700ec701af0346159f97aa6de8dc541670623201b106

General

Target

471ab55fae979dc3661c700ec701af0346159f97aa6de8dc541670623201b106.exe
Size

608KB
MD5

42a5fff8d81320870df6af95fb02b68d
SHA1

f0a96ed22ea452a0c9af853015bf20bdb513e648
SHA256

471ab55fae979dc3661c700ec701af0346159f97aa6de8dc541670623201b106
SHA512

41ef0d5b94cba6c03550f0b0a50f49f21230338376e9cae21a6da26ff36db375034fb605cee5ae67f73417848186cb3a2ce71a5e14c24796437731b006c2cfee
SSDEEP

12288:IRBWobw7roJCq49/iUEZnp99R4VTTvznxZ+q6vGC4Dy8US:WGWC/pEJbXmTTxZ+1GCr8US

Score

10^/10

darkcomet guest16_min persistence rat trojan

Malware Config

Extracted

Family

darkcomet

Botnet

Guest16_min

C2

dcratted.duckdns.org:3080

Mutex

DCMIN_MUTEX-G22C7RQ

Attributes

gencode
FFUwUJHhLVPu
install
false
offline_keylogger
true
persistence
false

Signatures

Darkcomet
DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
trojan rat darkcomet
Uses the VBS compiler for execution 1 TTPs

Scripting
T1064

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

471ab55fae979dc3661c700ec701af0346159f97aa6de8dc541670623201b106.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\iTunes = "C:\\Users\\Admin\\AppData\\Local\\Temp\\471ab55fae979dc3661c700ec701af0346159f97aa6de8dc541670623201b106.exe"	471ab55fae979dc3661c700ec701af0346159f97aa6de8dc541670623201b106.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

471ab55fae979dc3661c700ec701af0346159f97aa6de8dc541670623201b106.exe

description	pid	process	target process
PID 1380 set thread context of 2348	1380	471ab55fae979dc3661c700ec701af0346159f97aa6de8dc541670623201b106.exe	vbc.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

471ab55fae979dc3661c700ec701af0346159f97aa6de8dc541670623201b106.exe

pid	process
1380	471ab55fae979dc3661c700ec701af0346159f97aa6de8dc541670623201b106.exe
1380	471ab55fae979dc3661c700ec701af0346159f97aa6de8dc541670623201b106.exe
1380	471ab55fae979dc3661c700ec701af0346159f97aa6de8dc541670623201b106.exe
1380	471ab55fae979dc3661c700ec701af0346159f97aa6de8dc541670623201b106.exe
1380	471ab55fae979dc3661c700ec701af0346159f97aa6de8dc541670623201b106.exe
1380	471ab55fae979dc3661c700ec701af0346159f97aa6de8dc541670623201b106.exe
1380	471ab55fae979dc3661c700ec701af0346159f97aa6de8dc541670623201b106.exe
1380	471ab55fae979dc3661c700ec701af0346159f97aa6de8dc541670623201b106.exe
1380	471ab55fae979dc3661c700ec701af0346159f97aa6de8dc541670623201b106.exe
1380	471ab55fae979dc3661c700ec701af0346159f97aa6de8dc541670623201b106.exe
1380	471ab55fae979dc3661c700ec701af0346159f97aa6de8dc541670623201b106.exe
1380	471ab55fae979dc3661c700ec701af0346159f97aa6de8dc541670623201b106.exe
1380	471ab55fae979dc3661c700ec701af0346159f97aa6de8dc541670623201b106.exe
1380	471ab55fae979dc3661c700ec701af0346159f97aa6de8dc541670623201b106.exe
1380	471ab55fae979dc3661c700ec701af0346159f97aa6de8dc541670623201b106.exe
1380	471ab55fae979dc3661c700ec701af0346159f97aa6de8dc541670623201b106.exe
1380	471ab55fae979dc3661c700ec701af0346159f97aa6de8dc541670623201b106.exe
1380	471ab55fae979dc3661c700ec701af0346159f97aa6de8dc541670623201b106.exe
1380	471ab55fae979dc3661c700ec701af0346159f97aa6de8dc541670623201b106.exe
1380	471ab55fae979dc3661c700ec701af0346159f97aa6de8dc541670623201b106.exe
1380	471ab55fae979dc3661c700ec701af0346159f97aa6de8dc541670623201b106.exe
1380	471ab55fae979dc3661c700ec701af0346159f97aa6de8dc541670623201b106.exe
1380	471ab55fae979dc3661c700ec701af0346159f97aa6de8dc541670623201b106.exe
1380	471ab55fae979dc3661c700ec701af0346159f97aa6de8dc541670623201b106.exe
1380	471ab55fae979dc3661c700ec701af0346159f97aa6de8dc541670623201b106.exe
1380	471ab55fae979dc3661c700ec701af0346159f97aa6de8dc541670623201b106.exe
1380	471ab55fae979dc3661c700ec701af0346159f97aa6de8dc541670623201b106.exe
1380	471ab55fae979dc3661c700ec701af0346159f97aa6de8dc541670623201b106.exe
1380	471ab55fae979dc3661c700ec701af0346159f97aa6de8dc541670623201b106.exe
1380	471ab55fae979dc3661c700ec701af0346159f97aa6de8dc541670623201b106.exe
1380	471ab55fae979dc3661c700ec701af0346159f97aa6de8dc541670623201b106.exe
1380	471ab55fae979dc3661c700ec701af0346159f97aa6de8dc541670623201b106.exe
1380	471ab55fae979dc3661c700ec701af0346159f97aa6de8dc541670623201b106.exe
1380	471ab55fae979dc3661c700ec701af0346159f97aa6de8dc541670623201b106.exe
1380	471ab55fae979dc3661c700ec701af0346159f97aa6de8dc541670623201b106.exe
1380	471ab55fae979dc3661c700ec701af0346159f97aa6de8dc541670623201b106.exe
1380	471ab55fae979dc3661c700ec701af0346159f97aa6de8dc541670623201b106.exe
1380	471ab55fae979dc3661c700ec701af0346159f97aa6de8dc541670623201b106.exe
1380	471ab55fae979dc3661c700ec701af0346159f97aa6de8dc541670623201b106.exe
1380	471ab55fae979dc3661c700ec701af0346159f97aa6de8dc541670623201b106.exe
1380	471ab55fae979dc3661c700ec701af0346159f97aa6de8dc541670623201b106.exe
1380	471ab55fae979dc3661c700ec701af0346159f97aa6de8dc541670623201b106.exe
1380	471ab55fae979dc3661c700ec701af0346159f97aa6de8dc541670623201b106.exe
1380	471ab55fae979dc3661c700ec701af0346159f97aa6de8dc541670623201b106.exe
1380	471ab55fae979dc3661c700ec701af0346159f97aa6de8dc541670623201b106.exe
1380	471ab55fae979dc3661c700ec701af0346159f97aa6de8dc541670623201b106.exe
1380	471ab55fae979dc3661c700ec701af0346159f97aa6de8dc541670623201b106.exe
1380	471ab55fae979dc3661c700ec701af0346159f97aa6de8dc541670623201b106.exe
1380	471ab55fae979dc3661c700ec701af0346159f97aa6de8dc541670623201b106.exe
1380	471ab55fae979dc3661c700ec701af0346159f97aa6de8dc541670623201b106.exe
1380	471ab55fae979dc3661c700ec701af0346159f97aa6de8dc541670623201b106.exe
1380	471ab55fae979dc3661c700ec701af0346159f97aa6de8dc541670623201b106.exe
1380	471ab55fae979dc3661c700ec701af0346159f97aa6de8dc541670623201b106.exe
1380	471ab55fae979dc3661c700ec701af0346159f97aa6de8dc541670623201b106.exe
1380	471ab55fae979dc3661c700ec701af0346159f97aa6de8dc541670623201b106.exe
1380	471ab55fae979dc3661c700ec701af0346159f97aa6de8dc541670623201b106.exe
1380	471ab55fae979dc3661c700ec701af0346159f97aa6de8dc541670623201b106.exe
1380	471ab55fae979dc3661c700ec701af0346159f97aa6de8dc541670623201b106.exe
1380	471ab55fae979dc3661c700ec701af0346159f97aa6de8dc541670623201b106.exe
1380	471ab55fae979dc3661c700ec701af0346159f97aa6de8dc541670623201b106.exe
1380	471ab55fae979dc3661c700ec701af0346159f97aa6de8dc541670623201b106.exe
1380	471ab55fae979dc3661c700ec701af0346159f97aa6de8dc541670623201b106.exe
1380	471ab55fae979dc3661c700ec701af0346159f97aa6de8dc541670623201b106.exe
1380	471ab55fae979dc3661c700ec701af0346159f97aa6de8dc541670623201b106.exe

Suspicious use of AdjustPrivilegeToken 25 IoCs

Processes:

471ab55fae979dc3661c700ec701af0346159f97aa6de8dc541670623201b106.exevbc.exe

description	pid	process
Token: SeDebugPrivilege	1380	471ab55fae979dc3661c700ec701af0346159f97aa6de8dc541670623201b106.exe
Token: SeIncreaseQuotaPrivilege	2348	vbc.exe
Token: SeSecurityPrivilege	2348	vbc.exe
Token: SeTakeOwnershipPrivilege	2348	vbc.exe
Token: SeLoadDriverPrivilege	2348	vbc.exe
Token: SeSystemProfilePrivilege	2348	vbc.exe
Token: SeSystemtimePrivilege	2348	vbc.exe
Token: SeProfSingleProcessPrivilege	2348	vbc.exe
Token: SeIncBasePriorityPrivilege	2348	vbc.exe
Token: SeCreatePagefilePrivilege	2348	vbc.exe
Token: SeBackupPrivilege	2348	vbc.exe
Token: SeRestorePrivilege	2348	vbc.exe
Token: SeShutdownPrivilege	2348	vbc.exe
Token: SeDebugPrivilege	2348	vbc.exe
Token: SeSystemEnvironmentPrivilege	2348	vbc.exe
Token: SeChangeNotifyPrivilege	2348	vbc.exe
Token: SeRemoteShutdownPrivilege	2348	vbc.exe
Token: SeUndockPrivilege	2348	vbc.exe
Token: SeManageVolumePrivilege	2348	vbc.exe
Token: SeImpersonatePrivilege	2348	vbc.exe
Token: SeCreateGlobalPrivilege	2348	vbc.exe
Token: 33	2348	vbc.exe
Token: 34	2348	vbc.exe
Token: 35	2348	vbc.exe
Token: 36	2348	vbc.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

vbc.exe

pid process

2348 vbc.exe

pid	process
2348	vbc.exe

Suspicious use of WriteProcessMemory 14 IoCs

Processes:

471ab55fae979dc3661c700ec701af0346159f97aa6de8dc541670623201b106.exe

description	pid	process	target process
PID 1380 wrote to memory of 2348	1380	471ab55fae979dc3661c700ec701af0346159f97aa6de8dc541670623201b106.exe	vbc.exe
PID 1380 wrote to memory of 2348	1380	471ab55fae979dc3661c700ec701af0346159f97aa6de8dc541670623201b106.exe	vbc.exe
PID 1380 wrote to memory of 2348	1380	471ab55fae979dc3661c700ec701af0346159f97aa6de8dc541670623201b106.exe	vbc.exe
PID 1380 wrote to memory of 2348	1380	471ab55fae979dc3661c700ec701af0346159f97aa6de8dc541670623201b106.exe	vbc.exe
PID 1380 wrote to memory of 2348	1380	471ab55fae979dc3661c700ec701af0346159f97aa6de8dc541670623201b106.exe	vbc.exe
PID 1380 wrote to memory of 2348	1380	471ab55fae979dc3661c700ec701af0346159f97aa6de8dc541670623201b106.exe	vbc.exe
PID 1380 wrote to memory of 2348	1380	471ab55fae979dc3661c700ec701af0346159f97aa6de8dc541670623201b106.exe	vbc.exe
PID 1380 wrote to memory of 2348	1380	471ab55fae979dc3661c700ec701af0346159f97aa6de8dc541670623201b106.exe	vbc.exe
PID 1380 wrote to memory of 2348	1380	471ab55fae979dc3661c700ec701af0346159f97aa6de8dc541670623201b106.exe	vbc.exe
PID 1380 wrote to memory of 2348	1380	471ab55fae979dc3661c700ec701af0346159f97aa6de8dc541670623201b106.exe	vbc.exe
PID 1380 wrote to memory of 2348	1380	471ab55fae979dc3661c700ec701af0346159f97aa6de8dc541670623201b106.exe	vbc.exe
PID 1380 wrote to memory of 2348	1380	471ab55fae979dc3661c700ec701af0346159f97aa6de8dc541670623201b106.exe	vbc.exe
PID 1380 wrote to memory of 2348	1380	471ab55fae979dc3661c700ec701af0346159f97aa6de8dc541670623201b106.exe	vbc.exe
PID 1380 wrote to memory of 2348	1380	471ab55fae979dc3661c700ec701af0346159f97aa6de8dc541670623201b106.exe	vbc.exe

C:\Users\Admin\AppData\Local\Temp\471ab55fae979dc3661c700ec701af0346159f97aa6de8dc541670623201b106.exe
"C:\Users\Admin\AppData\Local\Temp\471ab55fae979dc3661c700ec701af0346159f97aa6de8dc541670623201b106.exe"
1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1380
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
  C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:2348

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scripting

1

T1064

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

Scripting

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1380-132-0x0000000074DF0000-0x00000000753A1000-memory.dmp

Filesize
5.7MB

Download
memory/1380-138-0x0000000074DF0000-0x00000000753A1000-memory.dmp

Filesize
5.7MB

Download
memory/2348-133-0x0000000000000000-mapping.dmp

Download
memory/2348-134-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/2348-135-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/2348-136-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/2348-137-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads