darkcomet | 401be40f6a6a90ac8a53b5dd0d56eb0f4bfa6cebfb21eef5a41516c467c5fdbe

General

Target

401be40f6a6a90ac8a53b5dd0d56eb0f4bfa6cebfb21eef5a41516c467c5fdbe.exe
Size

2.2MB
MD5

4d347fdcc43fef796cc7fd847f398604
SHA1

84ed2a2847b90cb3839621e5e8f1304a9e8bf44a
SHA256

401be40f6a6a90ac8a53b5dd0d56eb0f4bfa6cebfb21eef5a41516c467c5fdbe
SHA512

c49e9bc3b7f42cc6e1cd12f571c01d2b9e43328ef58a2954019cd4bc54e659ad276e7b94320ab98029463d6d428843571efff8b71bfc888fbc67d1ce23ad97f1
SSDEEP

49152:8jtez5KlYsCjIeKrGk5x7lg0J9/doQcAWNk7Q1SnKLPUL2FAc/Zg+L:3clCjOXW0J9loQii7Q1eKLPUyX

Score

10^/10

darkcomet rat trojan

Malware Config

Signatures

Darkcomet
DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
trojan rat darkcomet

Checks BIOS information in registry 2 TTPs 1 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

401be40f6a6a90ac8a53b5dd0d56eb0f4bfa6cebfb21eef5a41516c467c5fdbe.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate	401be40f6a6a90ac8a53b5dd0d56eb0f4bfa6cebfb21eef5a41516c467c5fdbe.exe

Suspicious use of SetThreadContext 2 IoCs

Processes:

401be40f6a6a90ac8a53b5dd0d56eb0f4bfa6cebfb21eef5a41516c467c5fdbe.exe

description	pid	process	target process
PID 1688 set thread context of 1388	1688	401be40f6a6a90ac8a53b5dd0d56eb0f4bfa6cebfb21eef5a41516c467c5fdbe.exe	401be40f6a6a90ac8a53b5dd0d56eb0f4bfa6cebfb21eef5a41516c467c5fdbe.exe
PID 1688 set thread context of 2020	1688	401be40f6a6a90ac8a53b5dd0d56eb0f4bfa6cebfb21eef5a41516c467c5fdbe.exe	401be40f6a6a90ac8a53b5dd0d56eb0f4bfa6cebfb21eef5a41516c467c5fdbe.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

401be40f6a6a90ac8a53b5dd0d56eb0f4bfa6cebfb21eef5a41516c467c5fdbe.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	401be40f6a6a90ac8a53b5dd0d56eb0f4bfa6cebfb21eef5a41516c467c5fdbe.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	401be40f6a6a90ac8a53b5dd0d56eb0f4bfa6cebfb21eef5a41516c467c5fdbe.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	401be40f6a6a90ac8a53b5dd0d56eb0f4bfa6cebfb21eef5a41516c467c5fdbe.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	401be40f6a6a90ac8a53b5dd0d56eb0f4bfa6cebfb21eef5a41516c467c5fdbe.exe

Enumerates system info in registry 2 TTPs 1 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

401be40f6a6a90ac8a53b5dd0d56eb0f4bfa6cebfb21eef5a41516c467c5fdbe.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	401be40f6a6a90ac8a53b5dd0d56eb0f4bfa6cebfb21eef5a41516c467c5fdbe.exe

Suspicious use of AdjustPrivilegeToken 23 IoCs

Processes:

401be40f6a6a90ac8a53b5dd0d56eb0f4bfa6cebfb21eef5a41516c467c5fdbe.exe

description	pid	process
Token: SeIncreaseQuotaPrivilege	1388	401be40f6a6a90ac8a53b5dd0d56eb0f4bfa6cebfb21eef5a41516c467c5fdbe.exe
Token: SeSecurityPrivilege	1388	401be40f6a6a90ac8a53b5dd0d56eb0f4bfa6cebfb21eef5a41516c467c5fdbe.exe
Token: SeTakeOwnershipPrivilege	1388	401be40f6a6a90ac8a53b5dd0d56eb0f4bfa6cebfb21eef5a41516c467c5fdbe.exe
Token: SeLoadDriverPrivilege	1388	401be40f6a6a90ac8a53b5dd0d56eb0f4bfa6cebfb21eef5a41516c467c5fdbe.exe
Token: SeSystemProfilePrivilege	1388	401be40f6a6a90ac8a53b5dd0d56eb0f4bfa6cebfb21eef5a41516c467c5fdbe.exe
Token: SeSystemtimePrivilege	1388	401be40f6a6a90ac8a53b5dd0d56eb0f4bfa6cebfb21eef5a41516c467c5fdbe.exe
Token: SeProfSingleProcessPrivilege	1388	401be40f6a6a90ac8a53b5dd0d56eb0f4bfa6cebfb21eef5a41516c467c5fdbe.exe
Token: SeIncBasePriorityPrivilege	1388	401be40f6a6a90ac8a53b5dd0d56eb0f4bfa6cebfb21eef5a41516c467c5fdbe.exe
Token: SeCreatePagefilePrivilege	1388	401be40f6a6a90ac8a53b5dd0d56eb0f4bfa6cebfb21eef5a41516c467c5fdbe.exe
Token: SeBackupPrivilege	1388	401be40f6a6a90ac8a53b5dd0d56eb0f4bfa6cebfb21eef5a41516c467c5fdbe.exe
Token: SeRestorePrivilege	1388	401be40f6a6a90ac8a53b5dd0d56eb0f4bfa6cebfb21eef5a41516c467c5fdbe.exe
Token: SeShutdownPrivilege	1388	401be40f6a6a90ac8a53b5dd0d56eb0f4bfa6cebfb21eef5a41516c467c5fdbe.exe
Token: SeDebugPrivilege	1388	401be40f6a6a90ac8a53b5dd0d56eb0f4bfa6cebfb21eef5a41516c467c5fdbe.exe
Token: SeSystemEnvironmentPrivilege	1388	401be40f6a6a90ac8a53b5dd0d56eb0f4bfa6cebfb21eef5a41516c467c5fdbe.exe
Token: SeChangeNotifyPrivilege	1388	401be40f6a6a90ac8a53b5dd0d56eb0f4bfa6cebfb21eef5a41516c467c5fdbe.exe
Token: SeRemoteShutdownPrivilege	1388	401be40f6a6a90ac8a53b5dd0d56eb0f4bfa6cebfb21eef5a41516c467c5fdbe.exe
Token: SeUndockPrivilege	1388	401be40f6a6a90ac8a53b5dd0d56eb0f4bfa6cebfb21eef5a41516c467c5fdbe.exe
Token: SeManageVolumePrivilege	1388	401be40f6a6a90ac8a53b5dd0d56eb0f4bfa6cebfb21eef5a41516c467c5fdbe.exe
Token: SeImpersonatePrivilege	1388	401be40f6a6a90ac8a53b5dd0d56eb0f4bfa6cebfb21eef5a41516c467c5fdbe.exe
Token: SeCreateGlobalPrivilege	1388	401be40f6a6a90ac8a53b5dd0d56eb0f4bfa6cebfb21eef5a41516c467c5fdbe.exe
Token: 33	1388	401be40f6a6a90ac8a53b5dd0d56eb0f4bfa6cebfb21eef5a41516c467c5fdbe.exe
Token: 34	1388	401be40f6a6a90ac8a53b5dd0d56eb0f4bfa6cebfb21eef5a41516c467c5fdbe.exe
Token: 35	1388	401be40f6a6a90ac8a53b5dd0d56eb0f4bfa6cebfb21eef5a41516c467c5fdbe.exe

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

401be40f6a6a90ac8a53b5dd0d56eb0f4bfa6cebfb21eef5a41516c467c5fdbe.exe401be40f6a6a90ac8a53b5dd0d56eb0f4bfa6cebfb21eef5a41516c467c5fdbe.exe

pid	process
1688	401be40f6a6a90ac8a53b5dd0d56eb0f4bfa6cebfb21eef5a41516c467c5fdbe.exe
1388	401be40f6a6a90ac8a53b5dd0d56eb0f4bfa6cebfb21eef5a41516c467c5fdbe.exe

Suspicious use of WriteProcessMemory 29 IoCs

Processes:

401be40f6a6a90ac8a53b5dd0d56eb0f4bfa6cebfb21eef5a41516c467c5fdbe.exe

C:\Users\Admin\AppData\Local\Temp\401be40f6a6a90ac8a53b5dd0d56eb0f4bfa6cebfb21eef5a41516c467c5fdbe.exe
"C:\Users\Admin\AppData\Local\Temp\401be40f6a6a90ac8a53b5dd0d56eb0f4bfa6cebfb21eef5a41516c467c5fdbe.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1688

C:\Users\Admin\AppData\Local\Temp\401be40f6a6a90ac8a53b5dd0d56eb0f4bfa6cebfb21eef5a41516c467c5fdbe.exe
"C:\Users\Admin\AppData\Local\Temp\401be40f6a6a90ac8a53b5dd0d56eb0f4bfa6cebfb21eef5a41516c467c5fdbe.exe"
2⤵
- Checks BIOS information in registry
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1388

C:\Users\Admin\AppData\Local\Temp\401be40f6a6a90ac8a53b5dd0d56eb0f4bfa6cebfb21eef5a41516c467c5fdbe.exe
"C:\Users\Admin\AppData\Local\Temp\401be40f6a6a90ac8a53b5dd0d56eb0f4bfa6cebfb21eef5a41516c467c5fdbe.exe"
2⤵
PID:2020

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

3

T1012

System Information Discovery

3

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1388-62-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/1388-56-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/1388-59-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/1388-58-0x000000000048E85C-mapping.dmp

Download
memory/1388-60-0x00000000763F1000-0x00000000763F3000-memory.dmp

Filesize
8KB

Download
memory/1388-61-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/1388-57-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/1388-71-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/2020-67-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/2020-65-0x00000000004097F0-mapping.dmp

Download
memory/2020-64-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/2020-69-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/2020-70-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/2020-63-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download

description	pid	process	target process
PID 1688 wrote to memory of 1388	1688	401be40f6a6a90ac8a53b5dd0d56eb0f4bfa6cebfb21eef5a41516c467c5fdbe.exe	401be40f6a6a90ac8a53b5dd0d56eb0f4bfa6cebfb21eef5a41516c467c5fdbe.exe
PID 1688 wrote to memory of 1388	1688	401be40f6a6a90ac8a53b5dd0d56eb0f4bfa6cebfb21eef5a41516c467c5fdbe.exe	401be40f6a6a90ac8a53b5dd0d56eb0f4bfa6cebfb21eef5a41516c467c5fdbe.exe
PID 1688 wrote to memory of 1388	1688	401be40f6a6a90ac8a53b5dd0d56eb0f4bfa6cebfb21eef5a41516c467c5fdbe.exe	401be40f6a6a90ac8a53b5dd0d56eb0f4bfa6cebfb21eef5a41516c467c5fdbe.exe
PID 1688 wrote to memory of 1388	1688	401be40f6a6a90ac8a53b5dd0d56eb0f4bfa6cebfb21eef5a41516c467c5fdbe.exe	401be40f6a6a90ac8a53b5dd0d56eb0f4bfa6cebfb21eef5a41516c467c5fdbe.exe
PID 1688 wrote to memory of 1388	1688	401be40f6a6a90ac8a53b5dd0d56eb0f4bfa6cebfb21eef5a41516c467c5fdbe.exe	401be40f6a6a90ac8a53b5dd0d56eb0f4bfa6cebfb21eef5a41516c467c5fdbe.exe
PID 1688 wrote to memory of 1388	1688	401be40f6a6a90ac8a53b5dd0d56eb0f4bfa6cebfb21eef5a41516c467c5fdbe.exe	401be40f6a6a90ac8a53b5dd0d56eb0f4bfa6cebfb21eef5a41516c467c5fdbe.exe
PID 1688 wrote to memory of 1388	1688	401be40f6a6a90ac8a53b5dd0d56eb0f4bfa6cebfb21eef5a41516c467c5fdbe.exe	401be40f6a6a90ac8a53b5dd0d56eb0f4bfa6cebfb21eef5a41516c467c5fdbe.exe
PID 1688 wrote to memory of 1388	1688	401be40f6a6a90ac8a53b5dd0d56eb0f4bfa6cebfb21eef5a41516c467c5fdbe.exe	401be40f6a6a90ac8a53b5dd0d56eb0f4bfa6cebfb21eef5a41516c467c5fdbe.exe
PID 1688 wrote to memory of 1388	1688	401be40f6a6a90ac8a53b5dd0d56eb0f4bfa6cebfb21eef5a41516c467c5fdbe.exe	401be40f6a6a90ac8a53b5dd0d56eb0f4bfa6cebfb21eef5a41516c467c5fdbe.exe
PID 1688 wrote to memory of 1388	1688	401be40f6a6a90ac8a53b5dd0d56eb0f4bfa6cebfb21eef5a41516c467c5fdbe.exe	401be40f6a6a90ac8a53b5dd0d56eb0f4bfa6cebfb21eef5a41516c467c5fdbe.exe
PID 1688 wrote to memory of 1388	1688	401be40f6a6a90ac8a53b5dd0d56eb0f4bfa6cebfb21eef5a41516c467c5fdbe.exe	401be40f6a6a90ac8a53b5dd0d56eb0f4bfa6cebfb21eef5a41516c467c5fdbe.exe
PID 1688 wrote to memory of 1388	1688	401be40f6a6a90ac8a53b5dd0d56eb0f4bfa6cebfb21eef5a41516c467c5fdbe.exe	401be40f6a6a90ac8a53b5dd0d56eb0f4bfa6cebfb21eef5a41516c467c5fdbe.exe
PID 1688 wrote to memory of 1388	1688	401be40f6a6a90ac8a53b5dd0d56eb0f4bfa6cebfb21eef5a41516c467c5fdbe.exe	401be40f6a6a90ac8a53b5dd0d56eb0f4bfa6cebfb21eef5a41516c467c5fdbe.exe
PID 1688 wrote to memory of 1388	1688	401be40f6a6a90ac8a53b5dd0d56eb0f4bfa6cebfb21eef5a41516c467c5fdbe.exe	401be40f6a6a90ac8a53b5dd0d56eb0f4bfa6cebfb21eef5a41516c467c5fdbe.exe
PID 1688 wrote to memory of 1388	1688	401be40f6a6a90ac8a53b5dd0d56eb0f4bfa6cebfb21eef5a41516c467c5fdbe.exe	401be40f6a6a90ac8a53b5dd0d56eb0f4bfa6cebfb21eef5a41516c467c5fdbe.exe
PID 1688 wrote to memory of 2020	1688	401be40f6a6a90ac8a53b5dd0d56eb0f4bfa6cebfb21eef5a41516c467c5fdbe.exe	401be40f6a6a90ac8a53b5dd0d56eb0f4bfa6cebfb21eef5a41516c467c5fdbe.exe
PID 1688 wrote to memory of 2020	1688	401be40f6a6a90ac8a53b5dd0d56eb0f4bfa6cebfb21eef5a41516c467c5fdbe.exe	401be40f6a6a90ac8a53b5dd0d56eb0f4bfa6cebfb21eef5a41516c467c5fdbe.exe
PID 1688 wrote to memory of 2020	1688	401be40f6a6a90ac8a53b5dd0d56eb0f4bfa6cebfb21eef5a41516c467c5fdbe.exe	401be40f6a6a90ac8a53b5dd0d56eb0f4bfa6cebfb21eef5a41516c467c5fdbe.exe
PID 1688 wrote to memory of 2020	1688	401be40f6a6a90ac8a53b5dd0d56eb0f4bfa6cebfb21eef5a41516c467c5fdbe.exe	401be40f6a6a90ac8a53b5dd0d56eb0f4bfa6cebfb21eef5a41516c467c5fdbe.exe
PID 1688 wrote to memory of 2020	1688	401be40f6a6a90ac8a53b5dd0d56eb0f4bfa6cebfb21eef5a41516c467c5fdbe.exe	401be40f6a6a90ac8a53b5dd0d56eb0f4bfa6cebfb21eef5a41516c467c5fdbe.exe
PID 1688 wrote to memory of 2020	1688	401be40f6a6a90ac8a53b5dd0d56eb0f4bfa6cebfb21eef5a41516c467c5fdbe.exe	401be40f6a6a90ac8a53b5dd0d56eb0f4bfa6cebfb21eef5a41516c467c5fdbe.exe
PID 1688 wrote to memory of 2020	1688	401be40f6a6a90ac8a53b5dd0d56eb0f4bfa6cebfb21eef5a41516c467c5fdbe.exe	401be40f6a6a90ac8a53b5dd0d56eb0f4bfa6cebfb21eef5a41516c467c5fdbe.exe
PID 1688 wrote to memory of 2020	1688	401be40f6a6a90ac8a53b5dd0d56eb0f4bfa6cebfb21eef5a41516c467c5fdbe.exe	401be40f6a6a90ac8a53b5dd0d56eb0f4bfa6cebfb21eef5a41516c467c5fdbe.exe
PID 1688 wrote to memory of 2020	1688	401be40f6a6a90ac8a53b5dd0d56eb0f4bfa6cebfb21eef5a41516c467c5fdbe.exe	401be40f6a6a90ac8a53b5dd0d56eb0f4bfa6cebfb21eef5a41516c467c5fdbe.exe
PID 1688 wrote to memory of 2020	1688	401be40f6a6a90ac8a53b5dd0d56eb0f4bfa6cebfb21eef5a41516c467c5fdbe.exe	401be40f6a6a90ac8a53b5dd0d56eb0f4bfa6cebfb21eef5a41516c467c5fdbe.exe
PID 1688 wrote to memory of 2020	1688	401be40f6a6a90ac8a53b5dd0d56eb0f4bfa6cebfb21eef5a41516c467c5fdbe.exe	401be40f6a6a90ac8a53b5dd0d56eb0f4bfa6cebfb21eef5a41516c467c5fdbe.exe
PID 1688 wrote to memory of 2020	1688	401be40f6a6a90ac8a53b5dd0d56eb0f4bfa6cebfb21eef5a41516c467c5fdbe.exe	401be40f6a6a90ac8a53b5dd0d56eb0f4bfa6cebfb21eef5a41516c467c5fdbe.exe
PID 1688 wrote to memory of 2020	1688	401be40f6a6a90ac8a53b5dd0d56eb0f4bfa6cebfb21eef5a41516c467c5fdbe.exe	401be40f6a6a90ac8a53b5dd0d56eb0f4bfa6cebfb21eef5a41516c467c5fdbe.exe
PID 1688 wrote to memory of 2020	1688	401be40f6a6a90ac8a53b5dd0d56eb0f4bfa6cebfb21eef5a41516c467c5fdbe.exe	401be40f6a6a90ac8a53b5dd0d56eb0f4bfa6cebfb21eef5a41516c467c5fdbe.exe

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads