darkcomet | 13c87ec5cdd4bde216f82669472b2a079ed5145a3b09527b57fb0a1b76b6bb62

General

Target

13c87ec5cdd4bde216f82669472b2a079ed5145a3b09527b57fb0a1b76b6bb62.exe
Size

658KB
MD5

00af39b462c2f465725866dc7cea198e
SHA1

868f6ed44da9171317e69649d3d4624e5578074f
SHA256

13c87ec5cdd4bde216f82669472b2a079ed5145a3b09527b57fb0a1b76b6bb62
SHA512

bd76fa132692c7008e41cd4f90ff133a09800b833e20a7edc317e4227b999b9ae02118c1104a283be0f03b2cc36d39e3958c69e1bf7de6863229234fa6cf453c
SSDEEP

12288:y9HFJ9rJxRX1uVVjoaWSoynxdO1FVBaOiRZTERfIhNkNCCLo9Ek5C/hf:eZ1xuVVjfFoynPaVBUR8f+kN10EB9

Score

10^/10

darkcomet notepad persistence rat trojan

Malware Config

Extracted

Family

darkcomet

Botnet

notepad

C2

narcotraf.mooo.com:1313

Mutex

DCMIN_MUTEX-3YC9AYX

Attributes

InstallPath
DCSCMIN\IMDCSC.exe
gencode
w65vCHHgcD65
install
true
offline_keylogger
true
persistence
false
reg_key
DarkComet RAT

Signatures

Darkcomet
DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
trojan rat darkcomet

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1004

Modify Registry

T1112

Processes:

13c87ec5cdd4bde216f82669472b2a079ed5145a3b09527b57fb0a1b76b6bb62.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Users\\Admin\\Documents\\DCSCMIN\\IMDCSC.exe"	13c87ec5cdd4bde216f82669472b2a079ed5145a3b09527b57fb0a1b76b6bb62.exe

Executes dropped EXE 1 IoCs

Processes:

IMDCSC.exe

pid process

888 IMDCSC.exe

pid	process
888	IMDCSC.exe

Loads dropped DLL 2 IoCs

Processes:

13c87ec5cdd4bde216f82669472b2a079ed5145a3b09527b57fb0a1b76b6bb62.exe

pid	process
1788	13c87ec5cdd4bde216f82669472b2a079ed5145a3b09527b57fb0a1b76b6bb62.exe
1788	13c87ec5cdd4bde216f82669472b2a079ed5145a3b09527b57fb0a1b76b6bb62.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

13c87ec5cdd4bde216f82669472b2a079ed5145a3b09527b57fb0a1b76b6bb62.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\DarkComet RAT = "C:\\Users\\Admin\\Documents\\DCSCMIN\\IMDCSC.exe"	13c87ec5cdd4bde216f82669472b2a079ed5145a3b09527b57fb0a1b76b6bb62.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 46 IoCs

Processes:

13c87ec5cdd4bde216f82669472b2a079ed5145a3b09527b57fb0a1b76b6bb62.exeIMDCSC.exe

description	pid	process
Token: SeIncreaseQuotaPrivilege	1788	13c87ec5cdd4bde216f82669472b2a079ed5145a3b09527b57fb0a1b76b6bb62.exe
Token: SeSecurityPrivilege	1788	13c87ec5cdd4bde216f82669472b2a079ed5145a3b09527b57fb0a1b76b6bb62.exe
Token: SeTakeOwnershipPrivilege	1788	13c87ec5cdd4bde216f82669472b2a079ed5145a3b09527b57fb0a1b76b6bb62.exe
Token: SeLoadDriverPrivilege	1788	13c87ec5cdd4bde216f82669472b2a079ed5145a3b09527b57fb0a1b76b6bb62.exe
Token: SeSystemProfilePrivilege	1788	13c87ec5cdd4bde216f82669472b2a079ed5145a3b09527b57fb0a1b76b6bb62.exe
Token: SeSystemtimePrivilege	1788	13c87ec5cdd4bde216f82669472b2a079ed5145a3b09527b57fb0a1b76b6bb62.exe
Token: SeProfSingleProcessPrivilege	1788	13c87ec5cdd4bde216f82669472b2a079ed5145a3b09527b57fb0a1b76b6bb62.exe
Token: SeIncBasePriorityPrivilege	1788	13c87ec5cdd4bde216f82669472b2a079ed5145a3b09527b57fb0a1b76b6bb62.exe
Token: SeCreatePagefilePrivilege	1788	13c87ec5cdd4bde216f82669472b2a079ed5145a3b09527b57fb0a1b76b6bb62.exe
Token: SeBackupPrivilege	1788	13c87ec5cdd4bde216f82669472b2a079ed5145a3b09527b57fb0a1b76b6bb62.exe
Token: SeRestorePrivilege	1788	13c87ec5cdd4bde216f82669472b2a079ed5145a3b09527b57fb0a1b76b6bb62.exe
Token: SeShutdownPrivilege	1788	13c87ec5cdd4bde216f82669472b2a079ed5145a3b09527b57fb0a1b76b6bb62.exe
Token: SeDebugPrivilege	1788	13c87ec5cdd4bde216f82669472b2a079ed5145a3b09527b57fb0a1b76b6bb62.exe
Token: SeSystemEnvironmentPrivilege	1788	13c87ec5cdd4bde216f82669472b2a079ed5145a3b09527b57fb0a1b76b6bb62.exe
Token: SeChangeNotifyPrivilege	1788	13c87ec5cdd4bde216f82669472b2a079ed5145a3b09527b57fb0a1b76b6bb62.exe
Token: SeRemoteShutdownPrivilege	1788	13c87ec5cdd4bde216f82669472b2a079ed5145a3b09527b57fb0a1b76b6bb62.exe
Token: SeUndockPrivilege	1788	13c87ec5cdd4bde216f82669472b2a079ed5145a3b09527b57fb0a1b76b6bb62.exe
Token: SeManageVolumePrivilege	1788	13c87ec5cdd4bde216f82669472b2a079ed5145a3b09527b57fb0a1b76b6bb62.exe
Token: SeImpersonatePrivilege	1788	13c87ec5cdd4bde216f82669472b2a079ed5145a3b09527b57fb0a1b76b6bb62.exe
Token: SeCreateGlobalPrivilege	1788	13c87ec5cdd4bde216f82669472b2a079ed5145a3b09527b57fb0a1b76b6bb62.exe
Token: 33	1788	13c87ec5cdd4bde216f82669472b2a079ed5145a3b09527b57fb0a1b76b6bb62.exe
Token: 34	1788	13c87ec5cdd4bde216f82669472b2a079ed5145a3b09527b57fb0a1b76b6bb62.exe
Token: 35	1788	13c87ec5cdd4bde216f82669472b2a079ed5145a3b09527b57fb0a1b76b6bb62.exe
Token: SeIncreaseQuotaPrivilege	888	IMDCSC.exe
Token: SeSecurityPrivilege	888	IMDCSC.exe
Token: SeTakeOwnershipPrivilege	888	IMDCSC.exe
Token: SeLoadDriverPrivilege	888	IMDCSC.exe
Token: SeSystemProfilePrivilege	888	IMDCSC.exe
Token: SeSystemtimePrivilege	888	IMDCSC.exe
Token: SeProfSingleProcessPrivilege	888	IMDCSC.exe
Token: SeIncBasePriorityPrivilege	888	IMDCSC.exe
Token: SeCreatePagefilePrivilege	888	IMDCSC.exe
Token: SeBackupPrivilege	888	IMDCSC.exe
Token: SeRestorePrivilege	888	IMDCSC.exe
Token: SeShutdownPrivilege	888	IMDCSC.exe
Token: SeDebugPrivilege	888	IMDCSC.exe
Token: SeSystemEnvironmentPrivilege	888	IMDCSC.exe
Token: SeChangeNotifyPrivilege	888	IMDCSC.exe
Token: SeRemoteShutdownPrivilege	888	IMDCSC.exe
Token: SeUndockPrivilege	888	IMDCSC.exe
Token: SeManageVolumePrivilege	888	IMDCSC.exe
Token: SeImpersonatePrivilege	888	IMDCSC.exe
Token: SeCreateGlobalPrivilege	888	IMDCSC.exe
Token: 33	888	IMDCSC.exe
Token: 34	888	IMDCSC.exe
Token: 35	888	IMDCSC.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

IMDCSC.exe

pid process

888 IMDCSC.exe

pid	process
888	IMDCSC.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

13c87ec5cdd4bde216f82669472b2a079ed5145a3b09527b57fb0a1b76b6bb62.exe

description	pid	process	target process
PID 1788 wrote to memory of 888	1788	13c87ec5cdd4bde216f82669472b2a079ed5145a3b09527b57fb0a1b76b6bb62.exe	IMDCSC.exe
PID 1788 wrote to memory of 888	1788	13c87ec5cdd4bde216f82669472b2a079ed5145a3b09527b57fb0a1b76b6bb62.exe	IMDCSC.exe
PID 1788 wrote to memory of 888	1788	13c87ec5cdd4bde216f82669472b2a079ed5145a3b09527b57fb0a1b76b6bb62.exe	IMDCSC.exe
PID 1788 wrote to memory of 888	1788	13c87ec5cdd4bde216f82669472b2a079ed5145a3b09527b57fb0a1b76b6bb62.exe	IMDCSC.exe

C:\Users\Admin\AppData\Local\Temp\13c87ec5cdd4bde216f82669472b2a079ed5145a3b09527b57fb0a1b76b6bb62.exe
"C:\Users\Admin\AppData\Local\Temp\13c87ec5cdd4bde216f82669472b2a079ed5145a3b09527b57fb0a1b76b6bb62.exe"
1⤵
- Modifies WinLogon for persistence
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1788

C:\Users\Admin\Documents\DCSCMIN\IMDCSC.exe
"C:\Users\Admin\Documents\DCSCMIN\IMDCSC.exe"
2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:888

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Winlogon Helper DLL

1

T1004

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

2

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\Documents\DCSCMIN\IMDCSC.exe
Filesize
658KB

MD5
00af39b462c2f465725866dc7cea198e

SHA1
868f6ed44da9171317e69649d3d4624e5578074f

SHA256
13c87ec5cdd4bde216f82669472b2a079ed5145a3b09527b57fb0a1b76b6bb62

SHA512
bd76fa132692c7008e41cd4f90ff133a09800b833e20a7edc317e4227b999b9ae02118c1104a283be0f03b2cc36d39e3958c69e1bf7de6863229234fa6cf453c

Download Submit
C:\Users\Admin\Documents\DCSCMIN\IMDCSC.exe
Filesize
658KB

MD5
00af39b462c2f465725866dc7cea198e

SHA1
868f6ed44da9171317e69649d3d4624e5578074f

SHA256
13c87ec5cdd4bde216f82669472b2a079ed5145a3b09527b57fb0a1b76b6bb62

SHA512
bd76fa132692c7008e41cd4f90ff133a09800b833e20a7edc317e4227b999b9ae02118c1104a283be0f03b2cc36d39e3958c69e1bf7de6863229234fa6cf453c

Download Submit
\Users\Admin\Documents\DCSCMIN\IMDCSC.exe
Filesize
658KB

MD5
00af39b462c2f465725866dc7cea198e

SHA1
868f6ed44da9171317e69649d3d4624e5578074f

SHA256
13c87ec5cdd4bde216f82669472b2a079ed5145a3b09527b57fb0a1b76b6bb62

SHA512
bd76fa132692c7008e41cd4f90ff133a09800b833e20a7edc317e4227b999b9ae02118c1104a283be0f03b2cc36d39e3958c69e1bf7de6863229234fa6cf453c

Download Submit
\Users\Admin\Documents\DCSCMIN\IMDCSC.exe
Filesize
658KB

MD5
00af39b462c2f465725866dc7cea198e

SHA1
868f6ed44da9171317e69649d3d4624e5578074f

SHA256
13c87ec5cdd4bde216f82669472b2a079ed5145a3b09527b57fb0a1b76b6bb62

SHA512
bd76fa132692c7008e41cd4f90ff133a09800b833e20a7edc317e4227b999b9ae02118c1104a283be0f03b2cc36d39e3958c69e1bf7de6863229234fa6cf453c

Download Submit
memory/888-57-0x0000000000000000-mapping.dmp

Download
memory/1788-54-0x0000000076201000-0x0000000076203000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads