darkcomet | aa3a1953002d68e2a47184a4330b91550386826949b7aba5b0472b16d7fdba68

General

Target

aa3a1953002d68e2a47184a4330b91550386826949b7aba5b0472b16d7fdba68.exe
Size

688KB
MD5

c373556332f48435c9ee85d7f7b59fa5
SHA1

894e1ca1487ae6f5b56ca07aae1368f142157335
SHA256

aa3a1953002d68e2a47184a4330b91550386826949b7aba5b0472b16d7fdba68
SHA512

9ef0fa7179fc5fcff49d80a152b53d13bbe2c6d3b87f88056ddb5ea3fbec4c0c7c2520e14468fd2116967030258f24119e86b7cc53292b2feb00ce284576ab48
SSDEEP

12288:eCp61Z0OYunIBU+KMSZWQmzHZEV81N68wUUl9G9TsjNk4AhveYp1:eCg1BIBU+6ZWQmzWlgSW4Ah7

Score

10^/10

darkcomet dc 5.1 persistence rat trojan upx

Malware Config

Extracted

Family

darkcomet

Botnet

DC 5.1

C2

netspych.no-ip.biz:1604

Mutex

DC_MUTEX-X8NHXUZ

Attributes

gencode
1tkzfnt8C2wn
install
false
offline_keylogger
true
password
nsc2012
persistence
false

Signatures

Darkcomet
DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
trojan rat darkcomet

UPX packed file 9 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral1/memory/952-60-0x0000000000400000-0x00000000004B5000-memory.dmp	upx
behavioral1/memory/952-62-0x0000000000400000-0x00000000004B5000-memory.dmp	upx
behavioral1/memory/952-63-0x0000000000400000-0x00000000004B5000-memory.dmp	upx
behavioral1/memory/952-65-0x0000000000400000-0x00000000004B5000-memory.dmp	upx
behavioral1/memory/952-67-0x0000000000400000-0x00000000004B5000-memory.dmp	upx
behavioral1/memory/952-68-0x0000000000400000-0x00000000004B5000-memory.dmp	upx
behavioral1/memory/952-71-0x0000000000400000-0x00000000004B5000-memory.dmp	upx
behavioral1/memory/952-72-0x0000000000400000-0x00000000004B5000-memory.dmp	upx
behavioral1/memory/952-73-0x0000000000400000-0x00000000004B5000-memory.dmp	upx

Uses the VBS compiler for execution 1 TTPs

Scripting
T1064

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

aa3a1953002d68e2a47184a4330b91550386826949b7aba5b0472b16d7fdba68.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run	aa3a1953002d68e2a47184a4330b91550386826949b7aba5b0472b16d7fdba68.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\taskhost = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\System\\Services\\taskhost.exe"	aa3a1953002d68e2a47184a4330b91550386826949b7aba5b0472b16d7fdba68.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

aa3a1953002d68e2a47184a4330b91550386826949b7aba5b0472b16d7fdba68.exe

description pid process target process

PID 2016 set thread context of 952 2016 aa3a1953002d68e2a47184a4330b91550386826949b7aba5b0472b16d7fdba68.exe vbc.exe

description	pid	process	target process
PID 2016 set thread context of 952	2016	aa3a1953002d68e2a47184a4330b91550386826949b7aba5b0472b16d7fdba68.exe	vbc.exe

NTFS ADS 3 IoCs

Processes:

aa3a1953002d68e2a47184a4330b91550386826949b7aba5b0472b16d7fdba68.exe

description	ioc	process
File created	C:\Users\Public\Desktop:$SS_DESCRIPTOR_XBVLV2PKPV19FKN45LJ8K8M3UKVVVVTJV6VVBVT	aa3a1953002d68e2a47184a4330b91550386826949b7aba5b0472b16d7fdba68.exe
File created	C:\ProgramData:$SS_DESCRIPTOR_XBVLV2PKPV19FKN45LJ8K8M3UKVVVVTJV6VVBVT	aa3a1953002d68e2a47184a4330b91550386826949b7aba5b0472b16d7fdba68.exe
File created	C:\ProgramData\MyProject\1.0.0:$SS_DESCRIPTOR_XBVLV2PKPV19FKN45LJ8K8M3UKVVVVTJV6VVBVT	aa3a1953002d68e2a47184a4330b91550386826949b7aba5b0472b16d7fdba68.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

Processes:

aa3a1953002d68e2a47184a4330b91550386826949b7aba5b0472b16d7fdba68.exe

pid	process
2016	aa3a1953002d68e2a47184a4330b91550386826949b7aba5b0472b16d7fdba68.exe
2016	aa3a1953002d68e2a47184a4330b91550386826949b7aba5b0472b16d7fdba68.exe
2016	aa3a1953002d68e2a47184a4330b91550386826949b7aba5b0472b16d7fdba68.exe

Suspicious use of AdjustPrivilegeToken 23 IoCs

Processes:

vbc.exe

description	pid	process
Token: SeIncreaseQuotaPrivilege	952	vbc.exe
Token: SeSecurityPrivilege	952	vbc.exe
Token: SeTakeOwnershipPrivilege	952	vbc.exe
Token: SeLoadDriverPrivilege	952	vbc.exe
Token: SeSystemProfilePrivilege	952	vbc.exe
Token: SeSystemtimePrivilege	952	vbc.exe
Token: SeProfSingleProcessPrivilege	952	vbc.exe
Token: SeIncBasePriorityPrivilege	952	vbc.exe
Token: SeCreatePagefilePrivilege	952	vbc.exe
Token: SeBackupPrivilege	952	vbc.exe
Token: SeRestorePrivilege	952	vbc.exe
Token: SeShutdownPrivilege	952	vbc.exe
Token: SeDebugPrivilege	952	vbc.exe
Token: SeSystemEnvironmentPrivilege	952	vbc.exe
Token: SeChangeNotifyPrivilege	952	vbc.exe
Token: SeRemoteShutdownPrivilege	952	vbc.exe
Token: SeUndockPrivilege	952	vbc.exe
Token: SeManageVolumePrivilege	952	vbc.exe
Token: SeImpersonatePrivilege	952	vbc.exe
Token: SeCreateGlobalPrivilege	952	vbc.exe
Token: 33	952	vbc.exe
Token: 34	952	vbc.exe
Token: 35	952	vbc.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

vbc.exe

pid process

952 vbc.exe

pid	process
952	vbc.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

aa3a1953002d68e2a47184a4330b91550386826949b7aba5b0472b16d7fdba68.exe

description	pid	process	target process
PID 2016 wrote to memory of 952	2016	aa3a1953002d68e2a47184a4330b91550386826949b7aba5b0472b16d7fdba68.exe	vbc.exe
PID 2016 wrote to memory of 952	2016	aa3a1953002d68e2a47184a4330b91550386826949b7aba5b0472b16d7fdba68.exe	vbc.exe
PID 2016 wrote to memory of 952	2016	aa3a1953002d68e2a47184a4330b91550386826949b7aba5b0472b16d7fdba68.exe	vbc.exe
PID 2016 wrote to memory of 952	2016	aa3a1953002d68e2a47184a4330b91550386826949b7aba5b0472b16d7fdba68.exe	vbc.exe
PID 2016 wrote to memory of 952	2016	aa3a1953002d68e2a47184a4330b91550386826949b7aba5b0472b16d7fdba68.exe	vbc.exe
PID 2016 wrote to memory of 952	2016	aa3a1953002d68e2a47184a4330b91550386826949b7aba5b0472b16d7fdba68.exe	vbc.exe
PID 2016 wrote to memory of 952	2016	aa3a1953002d68e2a47184a4330b91550386826949b7aba5b0472b16d7fdba68.exe	vbc.exe
PID 2016 wrote to memory of 952	2016	aa3a1953002d68e2a47184a4330b91550386826949b7aba5b0472b16d7fdba68.exe	vbc.exe

C:\Users\Admin\AppData\Local\Temp\aa3a1953002d68e2a47184a4330b91550386826949b7aba5b0472b16d7fdba68.exe
"C:\Users\Admin\AppData\Local\Temp\aa3a1953002d68e2a47184a4330b91550386826949b7aba5b0472b16d7fdba68.exe"
1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2016
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
  C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:952

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scripting

1

T1064

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

Scripting

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/952-64-0x00000000004B3B60-mapping.dmp

Download
memory/952-59-0x0000000000400000-0x00000000004B5000-memory.dmp

Filesize
724KB

Download
memory/952-73-0x0000000000400000-0x00000000004B5000-memory.dmp

Filesize
724KB

Download
memory/952-72-0x0000000000400000-0x00000000004B5000-memory.dmp

Filesize
724KB

Download
memory/952-65-0x0000000000400000-0x00000000004B5000-memory.dmp

Filesize
724KB

Download
memory/952-60-0x0000000000400000-0x00000000004B5000-memory.dmp

Filesize
724KB

Download
memory/952-62-0x0000000000400000-0x00000000004B5000-memory.dmp

Filesize
724KB

Download
memory/952-67-0x0000000000400000-0x00000000004B5000-memory.dmp

Filesize
724KB

Download
memory/952-71-0x0000000000400000-0x00000000004B5000-memory.dmp

Filesize
724KB

Download
memory/952-68-0x0000000000400000-0x00000000004B5000-memory.dmp

Filesize
724KB

Download
memory/952-63-0x0000000000400000-0x00000000004B5000-memory.dmp

Filesize
724KB

Download
memory/2016-69-0x0000000000400000-0x00000000004F0000-memory.dmp

Filesize
960KB

Download
memory/2016-56-0x0000000000400000-0x00000000004F0000-memory.dmp

Filesize
960KB

Download
memory/2016-70-0x0000000074820000-0x0000000074DCB000-memory.dmp

Filesize
5.7MB

Download
memory/2016-57-0x0000000000400000-0x00000000004F0000-memory.dmp

Filesize
960KB

Download
memory/2016-58-0x0000000074820000-0x0000000074DCB000-memory.dmp

Filesize
5.7MB

Download
memory/2016-55-0x00000000761F1000-0x00000000761F3000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads