darkcomet | 5593d25697e1ca127dd3ea72ef86a1df14ebcef6dab7f06da9ed3c8104c4db11

General

Target

5593d25697e1ca127dd3ea72ef86a1df14ebcef6dab7f06da9ed3c8104c4db11.exe
Size

1.1MB
MD5

a69d7489bf86c0bcc6bf5b8a084ae781
SHA1

89bd2b4f2aa013c7babcaf0fa35991cefd81b8da
SHA256

5593d25697e1ca127dd3ea72ef86a1df14ebcef6dab7f06da9ed3c8104c4db11
SHA512

937532d1018aa37e5c512067b3a52ddf3c6ff6f3f6ec883866e3a32b1615d9cbbc34483107d5db17f441454d15fcd9f4aa2ac4c17b3cfc58eecd2a9d6b8efb8b
SSDEEP

12288:YNazwlQZGxtBB5rnYOvhzmT9venv4Fiq271BQ6qG/31kfVvU+42j8j9:YNqMQZI6Ove4nBBj1QP4g49

Score

10^/10

darkcomet newest11 persistence rat trojan

Malware Config

Extracted

Family

darkcomet

Botnet

Newest11

C2

numberoneminecraft.serveminecraft.net:9001

Mutex

DC_MUTEX-NU7E6HS

Attributes

gencode
tlNkFNx3gjhk
install
false
offline_keylogger
false
persistence
false

Signatures

Darkcomet
DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
trojan rat darkcomet

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

5593d25697e1ca127dd3ea72ef86a1df14ebcef6dab7f06da9ed3c8104c4db11.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OmniCoin-Qt = "C:\\Users\\Admin\\AppData\\Local\\Temp\\5593d25697e1ca127dd3ea72ef86a1df14ebcef6dab7f06da9ed3c8104c4db11.exe"	5593d25697e1ca127dd3ea72ef86a1df14ebcef6dab7f06da9ed3c8104c4db11.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

5593d25697e1ca127dd3ea72ef86a1df14ebcef6dab7f06da9ed3c8104c4db11.exe

description	pid	process	target process
PID 764 set thread context of 2164	764	5593d25697e1ca127dd3ea72ef86a1df14ebcef6dab7f06da9ed3c8104c4db11.exe	rundll32.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

5593d25697e1ca127dd3ea72ef86a1df14ebcef6dab7f06da9ed3c8104c4db11.exe

pid	process
764	5593d25697e1ca127dd3ea72ef86a1df14ebcef6dab7f06da9ed3c8104c4db11.exe
764	5593d25697e1ca127dd3ea72ef86a1df14ebcef6dab7f06da9ed3c8104c4db11.exe
764	5593d25697e1ca127dd3ea72ef86a1df14ebcef6dab7f06da9ed3c8104c4db11.exe
764	5593d25697e1ca127dd3ea72ef86a1df14ebcef6dab7f06da9ed3c8104c4db11.exe
764	5593d25697e1ca127dd3ea72ef86a1df14ebcef6dab7f06da9ed3c8104c4db11.exe
764	5593d25697e1ca127dd3ea72ef86a1df14ebcef6dab7f06da9ed3c8104c4db11.exe
764	5593d25697e1ca127dd3ea72ef86a1df14ebcef6dab7f06da9ed3c8104c4db11.exe
764	5593d25697e1ca127dd3ea72ef86a1df14ebcef6dab7f06da9ed3c8104c4db11.exe
764	5593d25697e1ca127dd3ea72ef86a1df14ebcef6dab7f06da9ed3c8104c4db11.exe
764	5593d25697e1ca127dd3ea72ef86a1df14ebcef6dab7f06da9ed3c8104c4db11.exe
764	5593d25697e1ca127dd3ea72ef86a1df14ebcef6dab7f06da9ed3c8104c4db11.exe
764	5593d25697e1ca127dd3ea72ef86a1df14ebcef6dab7f06da9ed3c8104c4db11.exe
764	5593d25697e1ca127dd3ea72ef86a1df14ebcef6dab7f06da9ed3c8104c4db11.exe
764	5593d25697e1ca127dd3ea72ef86a1df14ebcef6dab7f06da9ed3c8104c4db11.exe
764	5593d25697e1ca127dd3ea72ef86a1df14ebcef6dab7f06da9ed3c8104c4db11.exe
764	5593d25697e1ca127dd3ea72ef86a1df14ebcef6dab7f06da9ed3c8104c4db11.exe
764	5593d25697e1ca127dd3ea72ef86a1df14ebcef6dab7f06da9ed3c8104c4db11.exe
764	5593d25697e1ca127dd3ea72ef86a1df14ebcef6dab7f06da9ed3c8104c4db11.exe
764	5593d25697e1ca127dd3ea72ef86a1df14ebcef6dab7f06da9ed3c8104c4db11.exe
764	5593d25697e1ca127dd3ea72ef86a1df14ebcef6dab7f06da9ed3c8104c4db11.exe
764	5593d25697e1ca127dd3ea72ef86a1df14ebcef6dab7f06da9ed3c8104c4db11.exe
764	5593d25697e1ca127dd3ea72ef86a1df14ebcef6dab7f06da9ed3c8104c4db11.exe
764	5593d25697e1ca127dd3ea72ef86a1df14ebcef6dab7f06da9ed3c8104c4db11.exe
764	5593d25697e1ca127dd3ea72ef86a1df14ebcef6dab7f06da9ed3c8104c4db11.exe
764	5593d25697e1ca127dd3ea72ef86a1df14ebcef6dab7f06da9ed3c8104c4db11.exe
764	5593d25697e1ca127dd3ea72ef86a1df14ebcef6dab7f06da9ed3c8104c4db11.exe
764	5593d25697e1ca127dd3ea72ef86a1df14ebcef6dab7f06da9ed3c8104c4db11.exe
764	5593d25697e1ca127dd3ea72ef86a1df14ebcef6dab7f06da9ed3c8104c4db11.exe
764	5593d25697e1ca127dd3ea72ef86a1df14ebcef6dab7f06da9ed3c8104c4db11.exe
764	5593d25697e1ca127dd3ea72ef86a1df14ebcef6dab7f06da9ed3c8104c4db11.exe
764	5593d25697e1ca127dd3ea72ef86a1df14ebcef6dab7f06da9ed3c8104c4db11.exe
764	5593d25697e1ca127dd3ea72ef86a1df14ebcef6dab7f06da9ed3c8104c4db11.exe
764	5593d25697e1ca127dd3ea72ef86a1df14ebcef6dab7f06da9ed3c8104c4db11.exe
764	5593d25697e1ca127dd3ea72ef86a1df14ebcef6dab7f06da9ed3c8104c4db11.exe
764	5593d25697e1ca127dd3ea72ef86a1df14ebcef6dab7f06da9ed3c8104c4db11.exe
764	5593d25697e1ca127dd3ea72ef86a1df14ebcef6dab7f06da9ed3c8104c4db11.exe
764	5593d25697e1ca127dd3ea72ef86a1df14ebcef6dab7f06da9ed3c8104c4db11.exe
764	5593d25697e1ca127dd3ea72ef86a1df14ebcef6dab7f06da9ed3c8104c4db11.exe
764	5593d25697e1ca127dd3ea72ef86a1df14ebcef6dab7f06da9ed3c8104c4db11.exe
764	5593d25697e1ca127dd3ea72ef86a1df14ebcef6dab7f06da9ed3c8104c4db11.exe
764	5593d25697e1ca127dd3ea72ef86a1df14ebcef6dab7f06da9ed3c8104c4db11.exe
764	5593d25697e1ca127dd3ea72ef86a1df14ebcef6dab7f06da9ed3c8104c4db11.exe
764	5593d25697e1ca127dd3ea72ef86a1df14ebcef6dab7f06da9ed3c8104c4db11.exe
764	5593d25697e1ca127dd3ea72ef86a1df14ebcef6dab7f06da9ed3c8104c4db11.exe
764	5593d25697e1ca127dd3ea72ef86a1df14ebcef6dab7f06da9ed3c8104c4db11.exe
764	5593d25697e1ca127dd3ea72ef86a1df14ebcef6dab7f06da9ed3c8104c4db11.exe
764	5593d25697e1ca127dd3ea72ef86a1df14ebcef6dab7f06da9ed3c8104c4db11.exe
764	5593d25697e1ca127dd3ea72ef86a1df14ebcef6dab7f06da9ed3c8104c4db11.exe
764	5593d25697e1ca127dd3ea72ef86a1df14ebcef6dab7f06da9ed3c8104c4db11.exe
764	5593d25697e1ca127dd3ea72ef86a1df14ebcef6dab7f06da9ed3c8104c4db11.exe
764	5593d25697e1ca127dd3ea72ef86a1df14ebcef6dab7f06da9ed3c8104c4db11.exe
764	5593d25697e1ca127dd3ea72ef86a1df14ebcef6dab7f06da9ed3c8104c4db11.exe
764	5593d25697e1ca127dd3ea72ef86a1df14ebcef6dab7f06da9ed3c8104c4db11.exe
764	5593d25697e1ca127dd3ea72ef86a1df14ebcef6dab7f06da9ed3c8104c4db11.exe
764	5593d25697e1ca127dd3ea72ef86a1df14ebcef6dab7f06da9ed3c8104c4db11.exe
764	5593d25697e1ca127dd3ea72ef86a1df14ebcef6dab7f06da9ed3c8104c4db11.exe
764	5593d25697e1ca127dd3ea72ef86a1df14ebcef6dab7f06da9ed3c8104c4db11.exe
764	5593d25697e1ca127dd3ea72ef86a1df14ebcef6dab7f06da9ed3c8104c4db11.exe
764	5593d25697e1ca127dd3ea72ef86a1df14ebcef6dab7f06da9ed3c8104c4db11.exe
764	5593d25697e1ca127dd3ea72ef86a1df14ebcef6dab7f06da9ed3c8104c4db11.exe
764	5593d25697e1ca127dd3ea72ef86a1df14ebcef6dab7f06da9ed3c8104c4db11.exe
764	5593d25697e1ca127dd3ea72ef86a1df14ebcef6dab7f06da9ed3c8104c4db11.exe
764	5593d25697e1ca127dd3ea72ef86a1df14ebcef6dab7f06da9ed3c8104c4db11.exe
764	5593d25697e1ca127dd3ea72ef86a1df14ebcef6dab7f06da9ed3c8104c4db11.exe

Suspicious use of AdjustPrivilegeToken 25 IoCs

Processes:

5593d25697e1ca127dd3ea72ef86a1df14ebcef6dab7f06da9ed3c8104c4db11.exerundll32.exe

description	pid	process
Token: SeDebugPrivilege	764	5593d25697e1ca127dd3ea72ef86a1df14ebcef6dab7f06da9ed3c8104c4db11.exe
Token: SeIncreaseQuotaPrivilege	2164	rundll32.exe
Token: SeSecurityPrivilege	2164	rundll32.exe
Token: SeTakeOwnershipPrivilege	2164	rundll32.exe
Token: SeLoadDriverPrivilege	2164	rundll32.exe
Token: SeSystemProfilePrivilege	2164	rundll32.exe
Token: SeSystemtimePrivilege	2164	rundll32.exe
Token: SeProfSingleProcessPrivilege	2164	rundll32.exe
Token: SeIncBasePriorityPrivilege	2164	rundll32.exe
Token: SeCreatePagefilePrivilege	2164	rundll32.exe
Token: SeBackupPrivilege	2164	rundll32.exe
Token: SeRestorePrivilege	2164	rundll32.exe
Token: SeShutdownPrivilege	2164	rundll32.exe
Token: SeDebugPrivilege	2164	rundll32.exe
Token: SeSystemEnvironmentPrivilege	2164	rundll32.exe
Token: SeChangeNotifyPrivilege	2164	rundll32.exe
Token: SeRemoteShutdownPrivilege	2164	rundll32.exe
Token: SeUndockPrivilege	2164	rundll32.exe
Token: SeManageVolumePrivilege	2164	rundll32.exe
Token: SeImpersonatePrivilege	2164	rundll32.exe
Token: SeCreateGlobalPrivilege	2164	rundll32.exe
Token: 33	2164	rundll32.exe
Token: 34	2164	rundll32.exe
Token: 35	2164	rundll32.exe
Token: 36	2164	rundll32.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

5593d25697e1ca127dd3ea72ef86a1df14ebcef6dab7f06da9ed3c8104c4db11.exe

description	pid	process	target process
PID 764 wrote to memory of 2164	764	5593d25697e1ca127dd3ea72ef86a1df14ebcef6dab7f06da9ed3c8104c4db11.exe	rundll32.exe
PID 764 wrote to memory of 2164	764	5593d25697e1ca127dd3ea72ef86a1df14ebcef6dab7f06da9ed3c8104c4db11.exe	rundll32.exe
PID 764 wrote to memory of 2164	764	5593d25697e1ca127dd3ea72ef86a1df14ebcef6dab7f06da9ed3c8104c4db11.exe	rundll32.exe
PID 764 wrote to memory of 2164	764	5593d25697e1ca127dd3ea72ef86a1df14ebcef6dab7f06da9ed3c8104c4db11.exe	rundll32.exe
PID 764 wrote to memory of 2164	764	5593d25697e1ca127dd3ea72ef86a1df14ebcef6dab7f06da9ed3c8104c4db11.exe	rundll32.exe
PID 764 wrote to memory of 2164	764	5593d25697e1ca127dd3ea72ef86a1df14ebcef6dab7f06da9ed3c8104c4db11.exe	rundll32.exe
PID 764 wrote to memory of 2164	764	5593d25697e1ca127dd3ea72ef86a1df14ebcef6dab7f06da9ed3c8104c4db11.exe	rundll32.exe
PID 764 wrote to memory of 2164	764	5593d25697e1ca127dd3ea72ef86a1df14ebcef6dab7f06da9ed3c8104c4db11.exe	rundll32.exe
PID 764 wrote to memory of 2164	764	5593d25697e1ca127dd3ea72ef86a1df14ebcef6dab7f06da9ed3c8104c4db11.exe	rundll32.exe
PID 764 wrote to memory of 2164	764	5593d25697e1ca127dd3ea72ef86a1df14ebcef6dab7f06da9ed3c8104c4db11.exe	rundll32.exe
PID 764 wrote to memory of 2164	764	5593d25697e1ca127dd3ea72ef86a1df14ebcef6dab7f06da9ed3c8104c4db11.exe	rundll32.exe
PID 764 wrote to memory of 2164	764	5593d25697e1ca127dd3ea72ef86a1df14ebcef6dab7f06da9ed3c8104c4db11.exe	rundll32.exe

C:\Users\Admin\AppData\Local\Temp\5593d25697e1ca127dd3ea72ef86a1df14ebcef6dab7f06da9ed3c8104c4db11.exe
"C:\Users\Admin\AppData\Local\Temp\5593d25697e1ca127dd3ea72ef86a1df14ebcef6dab7f06da9ed3c8104c4db11.exe"
1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:764

C:\Windows\SysWOW64\rundll32.exe
"C:\Windows\system32\rundll32.exe"
2⤵
- Suspicious use of AdjustPrivilegeToken
PID:2164

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/764-132-0x0000000075580000-0x0000000075B31000-memory.dmp

Filesize
5.7MB

Download
memory/764-138-0x0000000075580000-0x0000000075B31000-memory.dmp

Filesize
5.7MB

Download
memory/2164-133-0x0000000000000000-mapping.dmp

Download
memory/2164-134-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/2164-135-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/2164-136-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/2164-137-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/2164-139-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads