darkcomet | 94083535c21ab05d2f041cf7b99da107adb38c8a871163305f4027ebf389c686

General

Target

94083535c21ab05d2f041cf7b99da107adb38c8a871163305f4027ebf389c686.exe
Size

873KB
MD5

30579e0d9d850264acc6019518fcd1a8
SHA1

4b978cdfbe709286814040d65b757db967d3897a
SHA256

94083535c21ab05d2f041cf7b99da107adb38c8a871163305f4027ebf389c686
SHA512

44a3bdf0c26e727b96a88e9d35616a5b6efabdd228c590fed2107dbdac02cfc47b9722bae805cc3fef863913b0e18b34e02e3d6837cbd9ca9fd84aa08ed7eff3
SSDEEP

12288:2GopSuXh1gducHobZ5TTXraU4RFH4nQFAvQsg1W98a/Xcg5P0wf7:2x7baPF6QFAvSW986j007

Score

10^/10

darkcomet guest16 rat trojan

Malware Config

Extracted

Family

darkcomet

Botnet

Guest16

C2

kelvindrk.no-ip.biz:1008

Mutex

DC_MUTEX-DXAW4U7

Attributes

InstallPath
MSDCSC\msdcsc.exe
gencode
B7nmveDZ5jn1
install
true
offline_keylogger
true
persistence
true
reg_key
MicroUpdate

Signatures

Darkcomet
DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
trojan rat darkcomet

Suspicious use of SetThreadContext 1 IoCs

Processes:

94083535c21ab05d2f041cf7b99da107adb38c8a871163305f4027ebf389c686.exe

description	pid	process	target process
PID 812 set thread context of 4808	812	94083535c21ab05d2f041cf7b99da107adb38c8a871163305f4027ebf389c686.exe	94083535c21ab05d2f041cf7b99da107adb38c8a871163305f4027ebf389c686.exe

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

4480 4808 WerFault.exe 94083535c21ab05d2f041cf7b99da107adb38c8a871163305f4027ebf389c686.exe

pid	pid_target	process	target process
4480	4808	WerFault.exe	94083535c21ab05d2f041cf7b99da107adb38c8a871163305f4027ebf389c686.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

94083535c21ab05d2f041cf7b99da107adb38c8a871163305f4027ebf389c686.exe

pid	process
812	94083535c21ab05d2f041cf7b99da107adb38c8a871163305f4027ebf389c686.exe
812	94083535c21ab05d2f041cf7b99da107adb38c8a871163305f4027ebf389c686.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

94083535c21ab05d2f041cf7b99da107adb38c8a871163305f4027ebf389c686.exe

description pid process

Token: SeDebugPrivilege 812 94083535c21ab05d2f041cf7b99da107adb38c8a871163305f4027ebf389c686.exe

description	pid	process
Token: SeDebugPrivilege	812	94083535c21ab05d2f041cf7b99da107adb38c8a871163305f4027ebf389c686.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

94083535c21ab05d2f041cf7b99da107adb38c8a871163305f4027ebf389c686.exe

description	pid	process	target process
PID 812 wrote to memory of 4808	812	94083535c21ab05d2f041cf7b99da107adb38c8a871163305f4027ebf389c686.exe	94083535c21ab05d2f041cf7b99da107adb38c8a871163305f4027ebf389c686.exe
PID 812 wrote to memory of 4808	812	94083535c21ab05d2f041cf7b99da107adb38c8a871163305f4027ebf389c686.exe	94083535c21ab05d2f041cf7b99da107adb38c8a871163305f4027ebf389c686.exe
PID 812 wrote to memory of 4808	812	94083535c21ab05d2f041cf7b99da107adb38c8a871163305f4027ebf389c686.exe	94083535c21ab05d2f041cf7b99da107adb38c8a871163305f4027ebf389c686.exe
PID 812 wrote to memory of 4808	812	94083535c21ab05d2f041cf7b99da107adb38c8a871163305f4027ebf389c686.exe	94083535c21ab05d2f041cf7b99da107adb38c8a871163305f4027ebf389c686.exe
PID 812 wrote to memory of 4808	812	94083535c21ab05d2f041cf7b99da107adb38c8a871163305f4027ebf389c686.exe	94083535c21ab05d2f041cf7b99da107adb38c8a871163305f4027ebf389c686.exe
PID 812 wrote to memory of 4808	812	94083535c21ab05d2f041cf7b99da107adb38c8a871163305f4027ebf389c686.exe	94083535c21ab05d2f041cf7b99da107adb38c8a871163305f4027ebf389c686.exe
PID 812 wrote to memory of 4808	812	94083535c21ab05d2f041cf7b99da107adb38c8a871163305f4027ebf389c686.exe	94083535c21ab05d2f041cf7b99da107adb38c8a871163305f4027ebf389c686.exe
PID 812 wrote to memory of 4808	812	94083535c21ab05d2f041cf7b99da107adb38c8a871163305f4027ebf389c686.exe	94083535c21ab05d2f041cf7b99da107adb38c8a871163305f4027ebf389c686.exe
PID 812 wrote to memory of 4808	812	94083535c21ab05d2f041cf7b99da107adb38c8a871163305f4027ebf389c686.exe	94083535c21ab05d2f041cf7b99da107adb38c8a871163305f4027ebf389c686.exe
PID 812 wrote to memory of 4808	812	94083535c21ab05d2f041cf7b99da107adb38c8a871163305f4027ebf389c686.exe	94083535c21ab05d2f041cf7b99da107adb38c8a871163305f4027ebf389c686.exe
PID 812 wrote to memory of 4808	812	94083535c21ab05d2f041cf7b99da107adb38c8a871163305f4027ebf389c686.exe	94083535c21ab05d2f041cf7b99da107adb38c8a871163305f4027ebf389c686.exe
PID 812 wrote to memory of 4808	812	94083535c21ab05d2f041cf7b99da107adb38c8a871163305f4027ebf389c686.exe	94083535c21ab05d2f041cf7b99da107adb38c8a871163305f4027ebf389c686.exe

C:\Users\Admin\AppData\Local\Temp\94083535c21ab05d2f041cf7b99da107adb38c8a871163305f4027ebf389c686.exe
"C:\Users\Admin\AppData\Local\Temp\94083535c21ab05d2f041cf7b99da107adb38c8a871163305f4027ebf389c686.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:812

C:\Users\Admin\AppData\Local\Temp\94083535c21ab05d2f041cf7b99da107adb38c8a871163305f4027ebf389c686.exe
"C:\Users\Admin\AppData\Local\Temp\94083535c21ab05d2f041cf7b99da107adb38c8a871163305f4027ebf389c686.exe"
2⤵
PID:4808

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4808 -s 520
3⤵
- Program crash
PID:4480

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 188 -p 4808 -ip 4808
1⤵
PID:740

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/812-132-0x0000000074C70000-0x0000000075221000-memory.dmp

Filesize
5.7MB

Download
memory/812-133-0x0000000074C70000-0x0000000075221000-memory.dmp

Filesize
5.7MB

Download
memory/812-139-0x0000000074C70000-0x0000000075221000-memory.dmp

Filesize
5.7MB

Download
memory/4808-134-0x0000000000000000-mapping.dmp

Download
memory/4808-136-0x0000000000800000-0x00000000008B2000-memory.dmp

Filesize
712KB

Download
memory/4808-142-0x0000000000800000-0x00000000008B2000-memory.dmp

Filesize
712KB

Download
memory/4808-147-0x0000000000800000-0x00000000008B2000-memory.dmp

Filesize
712KB

Download
memory/4808-148-0x0000000000800000-0x00000000008B2000-memory.dmp

Filesize
712KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads