darkcomet | 1f4d24135ae9d20c3522988f9623529a0b1b320d4a1ab25c8fded65497bc9094

General

Target

1f4d24135ae9d20c3522988f9623529a0b1b320d4a1ab25c8fded65497bc9094.exe
Size

1.7MB
MD5

2387eb39ea6d9b53dc2a70ac836d9638
SHA1

8780a3b880ec482f7a63a40aa3f01b15ad47bc81
SHA256

1f4d24135ae9d20c3522988f9623529a0b1b320d4a1ab25c8fded65497bc9094
SHA512

24ce82fc4da5f9caf98c53197200191d48acd18c468367631236f38c80a9fca4611d4192d522a1e90a68faef368c92c573f6e3c07a84cd3de0a21277f2d00d71
SSDEEP

24576:M4lavt0LkLL9IMixoEgeaP60tmf9auZwjkiRik97PeBpgBNbam01hO3aq9MmCS:bkwkn9IMHeaP6df8uJiD7WWHqEqaPCS

Score

10^/10

darkcomet work16 persistence rat trojan

Malware Config

Extracted

Family

darkcomet

Botnet

Work16

C2

jimmykarcter.ddnsking.com:1490

Mutex

DC_MUTEX-GLGCLP0

Attributes

gencode
QaH9xjy6PUoh
install
false
offline_keylogger
true
persistence
false

Signatures

Darkcomet
DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
trojan rat darkcomet

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run	1f4d24135ae9d20c3522988f9623529a0b1b320d4a1ab25c8fded65497bc9094.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\jkj = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1f4d24135ae9d20c3522988f9623529a0b1b320d4a1ab25c8fded65497bc9094.exe"	1f4d24135ae9d20c3522988f9623529a0b1b320d4a1ab25c8fded65497bc9094.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	1f4d24135ae9d20c3522988f9623529a0b1b320d4a1ab25c8fded65497bc9094.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\jkj = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1f4d24135ae9d20c3522988f9623529a0b1b320d4a1ab25c8fded65497bc9094.exe"	1f4d24135ae9d20c3522988f9623529a0b1b320d4a1ab25c8fded65497bc9094.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1832 set thread context of 844	1832	1f4d24135ae9d20c3522988f9623529a0b1b320d4a1ab25c8fded65497bc9094.exe	27

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1832	1f4d24135ae9d20c3522988f9623529a0b1b320d4a1ab25c8fded65497bc9094.exe

Suspicious use of AdjustPrivilegeToken 23 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	844	1f4d24135ae9d20c3522988f9623529a0b1b320d4a1ab25c8fded65497bc9094.exe
Token: SeSecurityPrivilege	844	1f4d24135ae9d20c3522988f9623529a0b1b320d4a1ab25c8fded65497bc9094.exe
Token: SeTakeOwnershipPrivilege	844	1f4d24135ae9d20c3522988f9623529a0b1b320d4a1ab25c8fded65497bc9094.exe
Token: SeLoadDriverPrivilege	844	1f4d24135ae9d20c3522988f9623529a0b1b320d4a1ab25c8fded65497bc9094.exe
Token: SeSystemProfilePrivilege	844	1f4d24135ae9d20c3522988f9623529a0b1b320d4a1ab25c8fded65497bc9094.exe
Token: SeSystemtimePrivilege	844	1f4d24135ae9d20c3522988f9623529a0b1b320d4a1ab25c8fded65497bc9094.exe
Token: SeProfSingleProcessPrivilege	844	1f4d24135ae9d20c3522988f9623529a0b1b320d4a1ab25c8fded65497bc9094.exe
Token: SeIncBasePriorityPrivilege	844	1f4d24135ae9d20c3522988f9623529a0b1b320d4a1ab25c8fded65497bc9094.exe
Token: SeCreatePagefilePrivilege	844	1f4d24135ae9d20c3522988f9623529a0b1b320d4a1ab25c8fded65497bc9094.exe
Token: SeBackupPrivilege	844	1f4d24135ae9d20c3522988f9623529a0b1b320d4a1ab25c8fded65497bc9094.exe
Token: SeRestorePrivilege	844	1f4d24135ae9d20c3522988f9623529a0b1b320d4a1ab25c8fded65497bc9094.exe
Token: SeShutdownPrivilege	844	1f4d24135ae9d20c3522988f9623529a0b1b320d4a1ab25c8fded65497bc9094.exe
Token: SeDebugPrivilege	844	1f4d24135ae9d20c3522988f9623529a0b1b320d4a1ab25c8fded65497bc9094.exe
Token: SeSystemEnvironmentPrivilege	844	1f4d24135ae9d20c3522988f9623529a0b1b320d4a1ab25c8fded65497bc9094.exe
Token: SeChangeNotifyPrivilege	844	1f4d24135ae9d20c3522988f9623529a0b1b320d4a1ab25c8fded65497bc9094.exe
Token: SeRemoteShutdownPrivilege	844	1f4d24135ae9d20c3522988f9623529a0b1b320d4a1ab25c8fded65497bc9094.exe
Token: SeUndockPrivilege	844	1f4d24135ae9d20c3522988f9623529a0b1b320d4a1ab25c8fded65497bc9094.exe
Token: SeManageVolumePrivilege	844	1f4d24135ae9d20c3522988f9623529a0b1b320d4a1ab25c8fded65497bc9094.exe
Token: SeImpersonatePrivilege	844	1f4d24135ae9d20c3522988f9623529a0b1b320d4a1ab25c8fded65497bc9094.exe
Token: SeCreateGlobalPrivilege	844	1f4d24135ae9d20c3522988f9623529a0b1b320d4a1ab25c8fded65497bc9094.exe
Token: 33	844	1f4d24135ae9d20c3522988f9623529a0b1b320d4a1ab25c8fded65497bc9094.exe
Token: 34	844	1f4d24135ae9d20c3522988f9623529a0b1b320d4a1ab25c8fded65497bc9094.exe
Token: 35	844	1f4d24135ae9d20c3522988f9623529a0b1b320d4a1ab25c8fded65497bc9094.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
844	1f4d24135ae9d20c3522988f9623529a0b1b320d4a1ab25c8fded65497bc9094.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1832 wrote to memory of 844	1832	1f4d24135ae9d20c3522988f9623529a0b1b320d4a1ab25c8fded65497bc9094.exe	27
PID 1832 wrote to memory of 844	1832	1f4d24135ae9d20c3522988f9623529a0b1b320d4a1ab25c8fded65497bc9094.exe	27
PID 1832 wrote to memory of 844	1832	1f4d24135ae9d20c3522988f9623529a0b1b320d4a1ab25c8fded65497bc9094.exe	27
PID 1832 wrote to memory of 844	1832	1f4d24135ae9d20c3522988f9623529a0b1b320d4a1ab25c8fded65497bc9094.exe	27
PID 1832 wrote to memory of 844	1832	1f4d24135ae9d20c3522988f9623529a0b1b320d4a1ab25c8fded65497bc9094.exe	27
PID 1832 wrote to memory of 844	1832	1f4d24135ae9d20c3522988f9623529a0b1b320d4a1ab25c8fded65497bc9094.exe	27

C:\Users\Admin\AppData\Local\Temp\1f4d24135ae9d20c3522988f9623529a0b1b320d4a1ab25c8fded65497bc9094.exe
"C:\Users\Admin\AppData\Local\Temp\1f4d24135ae9d20c3522988f9623529a0b1b320d4a1ab25c8fded65497bc9094.exe"
1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1832
- C:\Users\Admin\AppData\Local\Temp\1f4d24135ae9d20c3522988f9623529a0b1b320d4a1ab25c8fded65497bc9094.exe
  "C:\Users\Admin\AppData\Local\Temp\1f4d24135ae9d20c3522988f9623529a0b1b320d4a1ab25c8fded65497bc9094.exe"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:844

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/844-55-0x0000000000160000-0x0000000000212000-memory.dmp

Filesize
712KB

Download
memory/844-57-0x0000000000160000-0x0000000000212000-memory.dmp

Filesize
712KB

Download
memory/844-59-0x0000000000160000-0x0000000000212000-memory.dmp

Filesize
712KB

Download
memory/844-61-0x0000000000160000-0x0000000000212000-memory.dmp

Filesize
712KB

Download
memory/844-62-0x0000000000160000-0x0000000000212000-memory.dmp

Filesize
712KB

Download
memory/844-63-0x0000000000160000-0x0000000000212000-memory.dmp

Filesize
712KB

Download
memory/1832-54-0x0000000076401000-0x0000000076403000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing