darkcomet | 401be40f6a6a90ac8a53b5dd0d56eb0f4bfa6cebfb21eef5a41516c467c5fdbe

General

Target

401be40f6a6a90ac8a53b5dd0d56eb0f4bfa6cebfb21eef5a41516c467c5fdbe.exe
Size

2.2MB
MD5

4d347fdcc43fef796cc7fd847f398604
SHA1

84ed2a2847b90cb3839621e5e8f1304a9e8bf44a
SHA256

401be40f6a6a90ac8a53b5dd0d56eb0f4bfa6cebfb21eef5a41516c467c5fdbe
SHA512

c49e9bc3b7f42cc6e1cd12f571c01d2b9e43328ef58a2954019cd4bc54e659ad276e7b94320ab98029463d6d428843571efff8b71bfc888fbc67d1ce23ad97f1
SSDEEP

49152:8jtez5KlYsCjIeKrGk5x7lg0J9/doQcAWNk7Q1SnKLPUL2FAc/Zg+L:3clCjOXW0J9loQii7Q1eKLPUyX

Score

10^/10

darkcomet rat trojan

Malware Config

Signatures

Darkcomet
DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
trojan rat darkcomet

Checks BIOS information in registry 2 TTPs 1 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

401be40f6a6a90ac8a53b5dd0d56eb0f4bfa6cebfb21eef5a41516c467c5fdbe.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate	401be40f6a6a90ac8a53b5dd0d56eb0f4bfa6cebfb21eef5a41516c467c5fdbe.exe

Suspicious use of SetThreadContext 2 IoCs

Processes:

401be40f6a6a90ac8a53b5dd0d56eb0f4bfa6cebfb21eef5a41516c467c5fdbe.exe

description	pid	process	target process
PID 4768 set thread context of 1132	4768	401be40f6a6a90ac8a53b5dd0d56eb0f4bfa6cebfb21eef5a41516c467c5fdbe.exe	401be40f6a6a90ac8a53b5dd0d56eb0f4bfa6cebfb21eef5a41516c467c5fdbe.exe
PID 4768 set thread context of 3440	4768	401be40f6a6a90ac8a53b5dd0d56eb0f4bfa6cebfb21eef5a41516c467c5fdbe.exe	401be40f6a6a90ac8a53b5dd0d56eb0f4bfa6cebfb21eef5a41516c467c5fdbe.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

401be40f6a6a90ac8a53b5dd0d56eb0f4bfa6cebfb21eef5a41516c467c5fdbe.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	401be40f6a6a90ac8a53b5dd0d56eb0f4bfa6cebfb21eef5a41516c467c5fdbe.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	401be40f6a6a90ac8a53b5dd0d56eb0f4bfa6cebfb21eef5a41516c467c5fdbe.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	401be40f6a6a90ac8a53b5dd0d56eb0f4bfa6cebfb21eef5a41516c467c5fdbe.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	401be40f6a6a90ac8a53b5dd0d56eb0f4bfa6cebfb21eef5a41516c467c5fdbe.exe

Enumerates system info in registry 2 TTPs 1 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

401be40f6a6a90ac8a53b5dd0d56eb0f4bfa6cebfb21eef5a41516c467c5fdbe.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	401be40f6a6a90ac8a53b5dd0d56eb0f4bfa6cebfb21eef5a41516c467c5fdbe.exe

Suspicious use of AdjustPrivilegeToken 24 IoCs

Processes:

401be40f6a6a90ac8a53b5dd0d56eb0f4bfa6cebfb21eef5a41516c467c5fdbe.exe

description	pid	process
Token: SeIncreaseQuotaPrivilege	1132	401be40f6a6a90ac8a53b5dd0d56eb0f4bfa6cebfb21eef5a41516c467c5fdbe.exe
Token: SeSecurityPrivilege	1132	401be40f6a6a90ac8a53b5dd0d56eb0f4bfa6cebfb21eef5a41516c467c5fdbe.exe
Token: SeTakeOwnershipPrivilege	1132	401be40f6a6a90ac8a53b5dd0d56eb0f4bfa6cebfb21eef5a41516c467c5fdbe.exe
Token: SeLoadDriverPrivilege	1132	401be40f6a6a90ac8a53b5dd0d56eb0f4bfa6cebfb21eef5a41516c467c5fdbe.exe
Token: SeSystemProfilePrivilege	1132	401be40f6a6a90ac8a53b5dd0d56eb0f4bfa6cebfb21eef5a41516c467c5fdbe.exe
Token: SeSystemtimePrivilege	1132	401be40f6a6a90ac8a53b5dd0d56eb0f4bfa6cebfb21eef5a41516c467c5fdbe.exe
Token: SeProfSingleProcessPrivilege	1132	401be40f6a6a90ac8a53b5dd0d56eb0f4bfa6cebfb21eef5a41516c467c5fdbe.exe
Token: SeIncBasePriorityPrivilege	1132	401be40f6a6a90ac8a53b5dd0d56eb0f4bfa6cebfb21eef5a41516c467c5fdbe.exe
Token: SeCreatePagefilePrivilege	1132	401be40f6a6a90ac8a53b5dd0d56eb0f4bfa6cebfb21eef5a41516c467c5fdbe.exe
Token: SeBackupPrivilege	1132	401be40f6a6a90ac8a53b5dd0d56eb0f4bfa6cebfb21eef5a41516c467c5fdbe.exe
Token: SeRestorePrivilege	1132	401be40f6a6a90ac8a53b5dd0d56eb0f4bfa6cebfb21eef5a41516c467c5fdbe.exe
Token: SeShutdownPrivilege	1132	401be40f6a6a90ac8a53b5dd0d56eb0f4bfa6cebfb21eef5a41516c467c5fdbe.exe
Token: SeDebugPrivilege	1132	401be40f6a6a90ac8a53b5dd0d56eb0f4bfa6cebfb21eef5a41516c467c5fdbe.exe
Token: SeSystemEnvironmentPrivilege	1132	401be40f6a6a90ac8a53b5dd0d56eb0f4bfa6cebfb21eef5a41516c467c5fdbe.exe
Token: SeChangeNotifyPrivilege	1132	401be40f6a6a90ac8a53b5dd0d56eb0f4bfa6cebfb21eef5a41516c467c5fdbe.exe
Token: SeRemoteShutdownPrivilege	1132	401be40f6a6a90ac8a53b5dd0d56eb0f4bfa6cebfb21eef5a41516c467c5fdbe.exe
Token: SeUndockPrivilege	1132	401be40f6a6a90ac8a53b5dd0d56eb0f4bfa6cebfb21eef5a41516c467c5fdbe.exe
Token: SeManageVolumePrivilege	1132	401be40f6a6a90ac8a53b5dd0d56eb0f4bfa6cebfb21eef5a41516c467c5fdbe.exe
Token: SeImpersonatePrivilege	1132	401be40f6a6a90ac8a53b5dd0d56eb0f4bfa6cebfb21eef5a41516c467c5fdbe.exe
Token: SeCreateGlobalPrivilege	1132	401be40f6a6a90ac8a53b5dd0d56eb0f4bfa6cebfb21eef5a41516c467c5fdbe.exe
Token: 33	1132	401be40f6a6a90ac8a53b5dd0d56eb0f4bfa6cebfb21eef5a41516c467c5fdbe.exe
Token: 34	1132	401be40f6a6a90ac8a53b5dd0d56eb0f4bfa6cebfb21eef5a41516c467c5fdbe.exe
Token: 35	1132	401be40f6a6a90ac8a53b5dd0d56eb0f4bfa6cebfb21eef5a41516c467c5fdbe.exe
Token: 36	1132	401be40f6a6a90ac8a53b5dd0d56eb0f4bfa6cebfb21eef5a41516c467c5fdbe.exe

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

401be40f6a6a90ac8a53b5dd0d56eb0f4bfa6cebfb21eef5a41516c467c5fdbe.exe401be40f6a6a90ac8a53b5dd0d56eb0f4bfa6cebfb21eef5a41516c467c5fdbe.exe

pid	process
4768	401be40f6a6a90ac8a53b5dd0d56eb0f4bfa6cebfb21eef5a41516c467c5fdbe.exe
1132	401be40f6a6a90ac8a53b5dd0d56eb0f4bfa6cebfb21eef5a41516c467c5fdbe.exe

Suspicious use of WriteProcessMemory 27 IoCs

Processes:

401be40f6a6a90ac8a53b5dd0d56eb0f4bfa6cebfb21eef5a41516c467c5fdbe.exe

C:\Users\Admin\AppData\Local\Temp\401be40f6a6a90ac8a53b5dd0d56eb0f4bfa6cebfb21eef5a41516c467c5fdbe.exe
"C:\Users\Admin\AppData\Local\Temp\401be40f6a6a90ac8a53b5dd0d56eb0f4bfa6cebfb21eef5a41516c467c5fdbe.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4768

C:\Users\Admin\AppData\Local\Temp\401be40f6a6a90ac8a53b5dd0d56eb0f4bfa6cebfb21eef5a41516c467c5fdbe.exe
"C:\Users\Admin\AppData\Local\Temp\401be40f6a6a90ac8a53b5dd0d56eb0f4bfa6cebfb21eef5a41516c467c5fdbe.exe"
2⤵
- Checks BIOS information in registry
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1132

C:\Users\Admin\AppData\Local\Temp\401be40f6a6a90ac8a53b5dd0d56eb0f4bfa6cebfb21eef5a41516c467c5fdbe.exe
"C:\Users\Admin\AppData\Local\Temp\401be40f6a6a90ac8a53b5dd0d56eb0f4bfa6cebfb21eef5a41516c467c5fdbe.exe"
2⤵
PID:3440

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

3

T1012

System Information Discovery

3

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1132-134-0x0000000000000000-mapping.dmp

Download
memory/1132-135-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/1132-136-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/1132-137-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/1132-138-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/1132-144-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/3440-139-0x0000000000000000-mapping.dmp

Download
memory/3440-140-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/3440-142-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/3440-143-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download

description	pid	process	target process
PID 4768 wrote to memory of 1132	4768	401be40f6a6a90ac8a53b5dd0d56eb0f4bfa6cebfb21eef5a41516c467c5fdbe.exe	401be40f6a6a90ac8a53b5dd0d56eb0f4bfa6cebfb21eef5a41516c467c5fdbe.exe
PID 4768 wrote to memory of 1132	4768	401be40f6a6a90ac8a53b5dd0d56eb0f4bfa6cebfb21eef5a41516c467c5fdbe.exe	401be40f6a6a90ac8a53b5dd0d56eb0f4bfa6cebfb21eef5a41516c467c5fdbe.exe
PID 4768 wrote to memory of 1132	4768	401be40f6a6a90ac8a53b5dd0d56eb0f4bfa6cebfb21eef5a41516c467c5fdbe.exe	401be40f6a6a90ac8a53b5dd0d56eb0f4bfa6cebfb21eef5a41516c467c5fdbe.exe
PID 4768 wrote to memory of 1132	4768	401be40f6a6a90ac8a53b5dd0d56eb0f4bfa6cebfb21eef5a41516c467c5fdbe.exe	401be40f6a6a90ac8a53b5dd0d56eb0f4bfa6cebfb21eef5a41516c467c5fdbe.exe
PID 4768 wrote to memory of 1132	4768	401be40f6a6a90ac8a53b5dd0d56eb0f4bfa6cebfb21eef5a41516c467c5fdbe.exe	401be40f6a6a90ac8a53b5dd0d56eb0f4bfa6cebfb21eef5a41516c467c5fdbe.exe
PID 4768 wrote to memory of 1132	4768	401be40f6a6a90ac8a53b5dd0d56eb0f4bfa6cebfb21eef5a41516c467c5fdbe.exe	401be40f6a6a90ac8a53b5dd0d56eb0f4bfa6cebfb21eef5a41516c467c5fdbe.exe
PID 4768 wrote to memory of 1132	4768	401be40f6a6a90ac8a53b5dd0d56eb0f4bfa6cebfb21eef5a41516c467c5fdbe.exe	401be40f6a6a90ac8a53b5dd0d56eb0f4bfa6cebfb21eef5a41516c467c5fdbe.exe
PID 4768 wrote to memory of 1132	4768	401be40f6a6a90ac8a53b5dd0d56eb0f4bfa6cebfb21eef5a41516c467c5fdbe.exe	401be40f6a6a90ac8a53b5dd0d56eb0f4bfa6cebfb21eef5a41516c467c5fdbe.exe
PID 4768 wrote to memory of 1132	4768	401be40f6a6a90ac8a53b5dd0d56eb0f4bfa6cebfb21eef5a41516c467c5fdbe.exe	401be40f6a6a90ac8a53b5dd0d56eb0f4bfa6cebfb21eef5a41516c467c5fdbe.exe
PID 4768 wrote to memory of 1132	4768	401be40f6a6a90ac8a53b5dd0d56eb0f4bfa6cebfb21eef5a41516c467c5fdbe.exe	401be40f6a6a90ac8a53b5dd0d56eb0f4bfa6cebfb21eef5a41516c467c5fdbe.exe
PID 4768 wrote to memory of 1132	4768	401be40f6a6a90ac8a53b5dd0d56eb0f4bfa6cebfb21eef5a41516c467c5fdbe.exe	401be40f6a6a90ac8a53b5dd0d56eb0f4bfa6cebfb21eef5a41516c467c5fdbe.exe
PID 4768 wrote to memory of 1132	4768	401be40f6a6a90ac8a53b5dd0d56eb0f4bfa6cebfb21eef5a41516c467c5fdbe.exe	401be40f6a6a90ac8a53b5dd0d56eb0f4bfa6cebfb21eef5a41516c467c5fdbe.exe
PID 4768 wrote to memory of 1132	4768	401be40f6a6a90ac8a53b5dd0d56eb0f4bfa6cebfb21eef5a41516c467c5fdbe.exe	401be40f6a6a90ac8a53b5dd0d56eb0f4bfa6cebfb21eef5a41516c467c5fdbe.exe
PID 4768 wrote to memory of 1132	4768	401be40f6a6a90ac8a53b5dd0d56eb0f4bfa6cebfb21eef5a41516c467c5fdbe.exe	401be40f6a6a90ac8a53b5dd0d56eb0f4bfa6cebfb21eef5a41516c467c5fdbe.exe
PID 4768 wrote to memory of 3440	4768	401be40f6a6a90ac8a53b5dd0d56eb0f4bfa6cebfb21eef5a41516c467c5fdbe.exe	401be40f6a6a90ac8a53b5dd0d56eb0f4bfa6cebfb21eef5a41516c467c5fdbe.exe
PID 4768 wrote to memory of 3440	4768	401be40f6a6a90ac8a53b5dd0d56eb0f4bfa6cebfb21eef5a41516c467c5fdbe.exe	401be40f6a6a90ac8a53b5dd0d56eb0f4bfa6cebfb21eef5a41516c467c5fdbe.exe
PID 4768 wrote to memory of 3440	4768	401be40f6a6a90ac8a53b5dd0d56eb0f4bfa6cebfb21eef5a41516c467c5fdbe.exe	401be40f6a6a90ac8a53b5dd0d56eb0f4bfa6cebfb21eef5a41516c467c5fdbe.exe
PID 4768 wrote to memory of 3440	4768	401be40f6a6a90ac8a53b5dd0d56eb0f4bfa6cebfb21eef5a41516c467c5fdbe.exe	401be40f6a6a90ac8a53b5dd0d56eb0f4bfa6cebfb21eef5a41516c467c5fdbe.exe
PID 4768 wrote to memory of 3440	4768	401be40f6a6a90ac8a53b5dd0d56eb0f4bfa6cebfb21eef5a41516c467c5fdbe.exe	401be40f6a6a90ac8a53b5dd0d56eb0f4bfa6cebfb21eef5a41516c467c5fdbe.exe
PID 4768 wrote to memory of 3440	4768	401be40f6a6a90ac8a53b5dd0d56eb0f4bfa6cebfb21eef5a41516c467c5fdbe.exe	401be40f6a6a90ac8a53b5dd0d56eb0f4bfa6cebfb21eef5a41516c467c5fdbe.exe
PID 4768 wrote to memory of 3440	4768	401be40f6a6a90ac8a53b5dd0d56eb0f4bfa6cebfb21eef5a41516c467c5fdbe.exe	401be40f6a6a90ac8a53b5dd0d56eb0f4bfa6cebfb21eef5a41516c467c5fdbe.exe
PID 4768 wrote to memory of 3440	4768	401be40f6a6a90ac8a53b5dd0d56eb0f4bfa6cebfb21eef5a41516c467c5fdbe.exe	401be40f6a6a90ac8a53b5dd0d56eb0f4bfa6cebfb21eef5a41516c467c5fdbe.exe
PID 4768 wrote to memory of 3440	4768	401be40f6a6a90ac8a53b5dd0d56eb0f4bfa6cebfb21eef5a41516c467c5fdbe.exe	401be40f6a6a90ac8a53b5dd0d56eb0f4bfa6cebfb21eef5a41516c467c5fdbe.exe
PID 4768 wrote to memory of 3440	4768	401be40f6a6a90ac8a53b5dd0d56eb0f4bfa6cebfb21eef5a41516c467c5fdbe.exe	401be40f6a6a90ac8a53b5dd0d56eb0f4bfa6cebfb21eef5a41516c467c5fdbe.exe
PID 4768 wrote to memory of 3440	4768	401be40f6a6a90ac8a53b5dd0d56eb0f4bfa6cebfb21eef5a41516c467c5fdbe.exe	401be40f6a6a90ac8a53b5dd0d56eb0f4bfa6cebfb21eef5a41516c467c5fdbe.exe
PID 4768 wrote to memory of 3440	4768	401be40f6a6a90ac8a53b5dd0d56eb0f4bfa6cebfb21eef5a41516c467c5fdbe.exe	401be40f6a6a90ac8a53b5dd0d56eb0f4bfa6cebfb21eef5a41516c467c5fdbe.exe
PID 4768 wrote to memory of 3440	4768	401be40f6a6a90ac8a53b5dd0d56eb0f4bfa6cebfb21eef5a41516c467c5fdbe.exe	401be40f6a6a90ac8a53b5dd0d56eb0f4bfa6cebfb21eef5a41516c467c5fdbe.exe

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads