darkcomet | 8b06f2e6daad66479102faa65ba46b40d5cd6e3335cf3902971dcd753b37d347

Analysis

max time kernel
93s
max time network
147s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
23-11-2022 17:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8b06f2e6daad66479102faa65ba46b40d5cd6e3335cf3902971dcd753b37d347.exe
Size

5.0MB
MD5

9580c6ee0ec3d08c29020c0dbff23cfa
SHA1

4f8ee5461fe1300e42bfb62747597ed6e339ff29
SHA256

8b06f2e6daad66479102faa65ba46b40d5cd6e3335cf3902971dcd753b37d347
SHA512

491aef0102cbd7d9816b79dac6673607119bc7778c0e1564dc5e60dea6ca265530771fe7855843126fe9322871d50e52aab210984951571468a90805f0bf2f79
SSDEEP

24576:57xgtwBETvT1r+gjhgMp6RZ+XI7vkb4u+yEZEWkc5wiOCjIlwfo915SQEtxZiQWT:36wwv5nh4RWIhltp67CMwfe1+tKSM5

Score

10^/10

darkcomet crypto bot persistence rat trojan

Malware Config

Extracted

Family

darkcomet

Botnet

Crypto Bot

estherr.no-ip.biz:5604

Mutex

DC_MUTEX-4P0JZTL

Attributes

gencode
x1lNFj9h0ysn
install
false
offline_keylogger
true
persistence
false

Signatures

Darkcomet
DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
trojan rat darkcomet

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1004

Modify Registry

T1112

Processes:

8b06f2e6daad66479102faa65ba46b40d5cd6e3335cf3902971dcd753b37d347.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Windows\\Windows.exe"	8b06f2e6daad66479102faa65ba46b40d5cd6e3335cf3902971dcd753b37d347.exe

Executes dropped EXE 2 IoCs

Processes:

notepad .exeap.exe

pid process

336 notepad .exe
756 ap.exe
Loads dropped DLL 2 IoCs

Processes:

8b06f2e6daad66479102faa65ba46b40d5cd6e3335cf3902971dcd753b37d347.execmd.exe

pid process

1172 8b06f2e6daad66479102faa65ba46b40d5cd6e3335cf3902971dcd753b37d347.exe
1636 cmd.exe

pid	process
336	notepad .exe
756	ap.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

8b06f2e6daad66479102faa65ba46b40d5cd6e3335cf3902971dcd753b37d347.exe

description	pid	process	target process
PID 1172 set thread context of 336	1172	8b06f2e6daad66479102faa65ba46b40d5cd6e3335cf3902971dcd753b37d347.exe	notepad .exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Delays execution with timeout.exe 1 IoCs
evasion

Processes:

timeout.exe

pid process

240 timeout.exe
Enumerates processes with tasklist 1 TTPs 1 IoCs

Process Discovery
T1057

Processes:

tasklist.exe

pid process

1244 tasklist.exe

pid	process
240	timeout.exe

pid	process
1244	tasklist.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

Processes:

8b06f2e6daad66479102faa65ba46b40d5cd6e3335cf3902971dcd753b37d347.exe

pid	process
1172	8b06f2e6daad66479102faa65ba46b40d5cd6e3335cf3902971dcd753b37d347.exe
1172	8b06f2e6daad66479102faa65ba46b40d5cd6e3335cf3902971dcd753b37d347.exe
1172	8b06f2e6daad66479102faa65ba46b40d5cd6e3335cf3902971dcd753b37d347.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

8b06f2e6daad66479102faa65ba46b40d5cd6e3335cf3902971dcd753b37d347.exetasklist.exeap.exe

description	pid	process
Token: SeDebugPrivilege	1172	8b06f2e6daad66479102faa65ba46b40d5cd6e3335cf3902971dcd753b37d347.exe
Token: SeDebugPrivilege	1244	tasklist.exe
Token: SeDebugPrivilege	756	ap.exe

Suspicious use of WriteProcessMemory 49 IoCs

Processes:

8b06f2e6daad66479102faa65ba46b40d5cd6e3335cf3902971dcd753b37d347.execmd.exewscript.execmd.exe

description	pid	process	target process
PID 1172 wrote to memory of 776	1172	8b06f2e6daad66479102faa65ba46b40d5cd6e3335cf3902971dcd753b37d347.exe	cmd.exe
PID 1172 wrote to memory of 776	1172	8b06f2e6daad66479102faa65ba46b40d5cd6e3335cf3902971dcd753b37d347.exe	cmd.exe
PID 1172 wrote to memory of 776	1172	8b06f2e6daad66479102faa65ba46b40d5cd6e3335cf3902971dcd753b37d347.exe	cmd.exe
PID 1172 wrote to memory of 776	1172	8b06f2e6daad66479102faa65ba46b40d5cd6e3335cf3902971dcd753b37d347.exe	cmd.exe
PID 1172 wrote to memory of 336	1172	8b06f2e6daad66479102faa65ba46b40d5cd6e3335cf3902971dcd753b37d347.exe	notepad .exe
PID 1172 wrote to memory of 336	1172	8b06f2e6daad66479102faa65ba46b40d5cd6e3335cf3902971dcd753b37d347.exe	notepad .exe
PID 1172 wrote to memory of 336	1172	8b06f2e6daad66479102faa65ba46b40d5cd6e3335cf3902971dcd753b37d347.exe	notepad .exe
PID 1172 wrote to memory of 336	1172	8b06f2e6daad66479102faa65ba46b40d5cd6e3335cf3902971dcd753b37d347.exe	notepad .exe
PID 1172 wrote to memory of 336	1172	8b06f2e6daad66479102faa65ba46b40d5cd6e3335cf3902971dcd753b37d347.exe	notepad .exe
PID 1172 wrote to memory of 336	1172	8b06f2e6daad66479102faa65ba46b40d5cd6e3335cf3902971dcd753b37d347.exe	notepad .exe
PID 1172 wrote to memory of 336	1172	8b06f2e6daad66479102faa65ba46b40d5cd6e3335cf3902971dcd753b37d347.exe	notepad .exe
PID 1172 wrote to memory of 336	1172	8b06f2e6daad66479102faa65ba46b40d5cd6e3335cf3902971dcd753b37d347.exe	notepad .exe
PID 1172 wrote to memory of 336	1172	8b06f2e6daad66479102faa65ba46b40d5cd6e3335cf3902971dcd753b37d347.exe	notepad .exe
PID 1172 wrote to memory of 336	1172	8b06f2e6daad66479102faa65ba46b40d5cd6e3335cf3902971dcd753b37d347.exe	notepad .exe
PID 1172 wrote to memory of 336	1172	8b06f2e6daad66479102faa65ba46b40d5cd6e3335cf3902971dcd753b37d347.exe	notepad .exe
PID 1172 wrote to memory of 336	1172	8b06f2e6daad66479102faa65ba46b40d5cd6e3335cf3902971dcd753b37d347.exe	notepad .exe
PID 1172 wrote to memory of 336	1172	8b06f2e6daad66479102faa65ba46b40d5cd6e3335cf3902971dcd753b37d347.exe	notepad .exe
PID 776 wrote to memory of 672	776	cmd.exe	wscript.exe
PID 776 wrote to memory of 672	776	cmd.exe	wscript.exe
PID 776 wrote to memory of 672	776	cmd.exe	wscript.exe
PID 776 wrote to memory of 672	776	cmd.exe	wscript.exe
PID 672 wrote to memory of 1808	672	wscript.exe	cmd.exe
PID 672 wrote to memory of 1808	672	wscript.exe	cmd.exe
PID 672 wrote to memory of 1808	672	wscript.exe	cmd.exe
PID 672 wrote to memory of 1808	672	wscript.exe	cmd.exe
PID 1172 wrote to memory of 1636	1172	8b06f2e6daad66479102faa65ba46b40d5cd6e3335cf3902971dcd753b37d347.exe	cmd.exe
PID 1172 wrote to memory of 1636	1172	8b06f2e6daad66479102faa65ba46b40d5cd6e3335cf3902971dcd753b37d347.exe	cmd.exe
PID 1172 wrote to memory of 1636	1172	8b06f2e6daad66479102faa65ba46b40d5cd6e3335cf3902971dcd753b37d347.exe	cmd.exe
PID 1172 wrote to memory of 1636	1172	8b06f2e6daad66479102faa65ba46b40d5cd6e3335cf3902971dcd753b37d347.exe	cmd.exe
PID 1172 wrote to memory of 1712	1172	8b06f2e6daad66479102faa65ba46b40d5cd6e3335cf3902971dcd753b37d347.exe	cmd.exe
PID 1172 wrote to memory of 1712	1172	8b06f2e6daad66479102faa65ba46b40d5cd6e3335cf3902971dcd753b37d347.exe	cmd.exe
PID 1172 wrote to memory of 1712	1172	8b06f2e6daad66479102faa65ba46b40d5cd6e3335cf3902971dcd753b37d347.exe	cmd.exe
PID 1172 wrote to memory of 1712	1172	8b06f2e6daad66479102faa65ba46b40d5cd6e3335cf3902971dcd753b37d347.exe	cmd.exe
PID 1636 wrote to memory of 240	1636	cmd.exe	timeout.exe
PID 1636 wrote to memory of 240	1636	cmd.exe	timeout.exe
PID 1636 wrote to memory of 240	1636	cmd.exe	timeout.exe
PID 1636 wrote to memory of 240	1636	cmd.exe	timeout.exe
PID 1636 wrote to memory of 1244	1636	cmd.exe	tasklist.exe
PID 1636 wrote to memory of 1244	1636	cmd.exe	tasklist.exe
PID 1636 wrote to memory of 1244	1636	cmd.exe	tasklist.exe
PID 1636 wrote to memory of 1244	1636	cmd.exe	tasklist.exe
PID 1636 wrote to memory of 396	1636	cmd.exe	find.exe
PID 1636 wrote to memory of 396	1636	cmd.exe	find.exe
PID 1636 wrote to memory of 396	1636	cmd.exe	find.exe
PID 1636 wrote to memory of 396	1636	cmd.exe	find.exe
PID 1636 wrote to memory of 756	1636	cmd.exe	ap.exe
PID 1636 wrote to memory of 756	1636	cmd.exe	ap.exe
PID 1636 wrote to memory of 756	1636	cmd.exe	ap.exe
PID 1636 wrote to memory of 756	1636	cmd.exe	ap.exe

C:\Users\Admin\AppData\Local\Temp\8b06f2e6daad66479102faa65ba46b40d5cd6e3335cf3902971dcd753b37d347.exe
"C:\Users\Admin\AppData\Local\Temp\8b06f2e6daad66479102faa65ba46b40d5cd6e3335cf3902971dcd753b37d347.exe"
1⤵
- Modifies WinLogon for persistence
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1172

C:\Windows\SysWOW64\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\Windows\mata.bat
2⤵
- Suspicious use of WriteProcessMemory
PID:776

C:\Windows\SysWOW64\wscript.exe
wscript.exe "C:\Users\Admin\AppData\Local\Temp\Windows\invs.vbs" "C:\Users\Admin\AppData\Local\Temp\Windows\mata2.bat
3⤵
- Suspicious use of WriteProcessMemory
PID:672

C:\Windows\SysWOW64\cmd.exe
cmd /c ""C:\Users\Admin\AppData\Local\Temp\Windows\mata2.bat" "
4⤵
PID:1808

C:\Users\Admin\AppData\Local\Temp\notepad .exe
"C:\Users\Admin\AppData\Local\Temp\notepad .exe"
2⤵
- Executes dropped EXE
PID:336

C:\Windows\SysWOW64\cmd.exe
cmd /c ""C:\Users\Admin\AppData\Local\Temp\Windows\stres.bat" "
2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1636

C:\Windows\SysWOW64\timeout.exe
timeout /t @@
3⤵
- Delays execution with timeout.exe
PID:240

C:\Windows\SysWOW64\tasklist.exe
tasklist /nh /fi "imagename eq notepad .exe"
3⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
PID:1244

C:\Windows\SysWOW64\find.exe
find /i "notepad .exe"
3⤵
PID:396

C:\Users\Admin\AppData\Local\Temp\ap.exe
"C:\Users\Admin\AppData\Local\Temp\ap.exe"
3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:756

C:\Windows\SysWOW64\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\Windows\melt.bat
2⤵
PID:1712

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Winlogon Helper DLL

T1004

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Process Discovery

T1057

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Windows\Windows.exe

Filesize
5.0MB

MD5
9580c6ee0ec3d08c29020c0dbff23cfa

SHA1
4f8ee5461fe1300e42bfb62747597ed6e339ff29

SHA256
8b06f2e6daad66479102faa65ba46b40d5cd6e3335cf3902971dcd753b37d347

SHA512
491aef0102cbd7d9816b79dac6673607119bc7778c0e1564dc5e60dea6ca265530771fe7855843126fe9322871d50e52aab210984951571468a90805f0bf2f79

Download Submit
C:\Users\Admin\AppData\Local\Temp\Windows\invs.vbs

Filesize
78B

MD5
c578d9653b22800c3eb6b6a51219bbb8

SHA1
a97aa251901bbe179a48dbc7a0c1872e163b1f2d

SHA256
20a98a7e6e137bb1b9bd5ef6911a479cb8eac925b80d6db4e70b19f62a40cce2

SHA512
3ae6dc8f02d1a78e1235a0782b632972da5a74ab32287cc41aa672d4fa4a9d34bb5fc50eba07b6915f2e61c402927cd5f6feeb7f7602afa2f64e91efb3b7fc4d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Windows\mata.bat

Filesize
63B

MD5
260efbd339dd3b0ab091d66df5cd3a16

SHA1
69d4e59b4e8edc557ee9b9a351576ea61f3092cc

SHA256
1d87c3291eda5b1fd8f3ff3fccb7efde33955fea4487369dfa23132f63e3b969

SHA512
cad75d955bb4ca61a8d2a9f5fac0c0ddc8fe97d05ad12850b2734efadb237b5310d4264745972f8a78b3918a90e23fba8d540fd64791eac8c3be9a5e50042812

Download Submit
C:\Users\Admin\AppData\Local\Temp\Windows\mata2.bat

Filesize
68B

MD5
553af02e55667d29f9054e5c101e2681

SHA1
1e4dfaf248d5800a1b61cec13d0f47370550510b

SHA256
0cf596fc133d75e2d007682a3f9caf1ae61137e50d3eb1354edca506434d7bb9

SHA512
4fa45b23be7f6900a50f7e6540017e137b88d770960148a05a8f00f52ce98762f6f2ef4d9cd721c5b2033ae0d6f063ab0ad8a1fd4fa2c94dff30fb0fb0d53e34

Download Submit
C:\Users\Admin\AppData\Local\Temp\Windows\rundll11-.txt

Filesize
5.0MB

MD5
9580c6ee0ec3d08c29020c0dbff23cfa

SHA1
4f8ee5461fe1300e42bfb62747597ed6e339ff29

SHA256
8b06f2e6daad66479102faa65ba46b40d5cd6e3335cf3902971dcd753b37d347

SHA512
491aef0102cbd7d9816b79dac6673607119bc7778c0e1564dc5e60dea6ca265530771fe7855843126fe9322871d50e52aab210984951571468a90805f0bf2f79

Download Submit
C:\Users\Admin\AppData\Local\Temp\Windows\stres.bat

Filesize
197B

MD5
baa5967892307b9bfb407b3af219d530

SHA1
0885a05bfaf364c6558d78ab7dd2d4acadca243f

SHA256
88ab119f42700edf3b3960a0c3737570d66d869a3d81205e415526bf3534bf95

SHA512
1f1caa8923401394c3ddb7c5c3a2683f2ff01e1b20366988dabbb37d3db3cdd35f4f19412f994068eba88dfce9519d6e4a27834835d4c4ea3db2531a72b654f4

Download Submit
C:\Users\Admin\AppData\Local\Temp\ap.exe

Filesize
156KB

MD5
a5b656183ccf21ef700f56406eb21525

SHA1
554aa9e72a3be3dff7e1a069d9c2e1fcf54e6b41

SHA256
aaa68a7b2131ad9ab852a66b8110d08dcc483bcee5afec941f65fe94c3a670b5

SHA512
e98d8370a7cd04586b18694be7d7586f76b2c1b9a642ead759716c6ce4b95be2aad69fa555f2f84cb83e76163c6702d37c3d0199e52162f35d5c5229a81107df

Download Submit
C:\Users\Admin\AppData\Local\Temp\ap.exe

Filesize
156KB

MD5
a5b656183ccf21ef700f56406eb21525

SHA1
554aa9e72a3be3dff7e1a069d9c2e1fcf54e6b41

SHA256
aaa68a7b2131ad9ab852a66b8110d08dcc483bcee5afec941f65fe94c3a670b5

SHA512
e98d8370a7cd04586b18694be7d7586f76b2c1b9a642ead759716c6ce4b95be2aad69fa555f2f84cb83e76163c6702d37c3d0199e52162f35d5c5229a81107df

Download Submit
C:\Users\Admin\AppData\Local\Temp\notepad .exe

Filesize
31KB

MD5
ed797d8dc2c92401985d162e42ffa450

SHA1
0f02fc517c7facc4baefde4fe9467fb6488ebabe

SHA256
b746362010a101cb5931bc066f0f4d3fc740c02a68c1f37fc3c8e6c87fd7cb1e

SHA512
e831a6ff987f3ef29982da16afad06938b68eddd43c234ba88d1c96a1b5547f2284baf35cbb3a5bfd75e7f0445d14daa014e0ba00b4db72c67f83f0a314c80c2

Download Submit
\Users\Admin\AppData\Local\Temp\ap.exe

Filesize
156KB

MD5
a5b656183ccf21ef700f56406eb21525

SHA1
554aa9e72a3be3dff7e1a069d9c2e1fcf54e6b41

SHA256
aaa68a7b2131ad9ab852a66b8110d08dcc483bcee5afec941f65fe94c3a670b5

SHA512
e98d8370a7cd04586b18694be7d7586f76b2c1b9a642ead759716c6ce4b95be2aad69fa555f2f84cb83e76163c6702d37c3d0199e52162f35d5c5229a81107df

Download Submit
\Users\Admin\AppData\Local\Temp\notepad .exe

Filesize
31KB

MD5
ed797d8dc2c92401985d162e42ffa450

SHA1
0f02fc517c7facc4baefde4fe9467fb6488ebabe

SHA256
b746362010a101cb5931bc066f0f4d3fc740c02a68c1f37fc3c8e6c87fd7cb1e

SHA512
e831a6ff987f3ef29982da16afad06938b68eddd43c234ba88d1c96a1b5547f2284baf35cbb3a5bfd75e7f0445d14daa014e0ba00b4db72c67f83f0a314c80c2

Download Submit
memory/240-89-0x0000000000000000-mapping.dmp

Download
memory/336-68-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/336-73-0x0000000000000000-mapping.dmp

Download
memory/336-71-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/336-74-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/336-69-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/336-66-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/336-64-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/336-62-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/336-60-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/336-59-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/396-91-0x0000000000000000-mapping.dmp

Download
memory/672-77-0x0000000000000000-mapping.dmp

Download
memory/756-94-0x0000000000000000-mapping.dmp

Download
memory/756-97-0x0000000074BE0000-0x000000007518B000-memory.dmp

Filesize
5.7MB

Download
memory/776-55-0x0000000000000000-mapping.dmp

Download
memory/1172-88-0x0000000074C30000-0x00000000751DB000-memory.dmp

Filesize
5.7MB

Download
memory/1172-83-0x0000000074C30000-0x00000000751DB000-memory.dmp

Filesize
5.7MB

Download
memory/1172-54-0x00000000754F1000-0x00000000754F3000-memory.dmp

Filesize
8KB

Download
memory/1172-56-0x0000000074C30000-0x00000000751DB000-memory.dmp

Filesize
5.7MB

Download
memory/1244-90-0x0000000000000000-mapping.dmp

Download
memory/1636-84-0x0000000000000000-mapping.dmp

Download
memory/1712-86-0x0000000000000000-mapping.dmp

Download
memory/1808-81-0x0000000000000000-mapping.dmp

Download