darkcomet | 1f4d24135ae9d20c3522988f9623529a0b1b320d4a1ab25c8fded65497bc9094

General

Target

1f4d24135ae9d20c3522988f9623529a0b1b320d4a1ab25c8fded65497bc9094.exe
Size

1.7MB
MD5

2387eb39ea6d9b53dc2a70ac836d9638
SHA1

8780a3b880ec482f7a63a40aa3f01b15ad47bc81
SHA256

1f4d24135ae9d20c3522988f9623529a0b1b320d4a1ab25c8fded65497bc9094
SHA512

24ce82fc4da5f9caf98c53197200191d48acd18c468367631236f38c80a9fca4611d4192d522a1e90a68faef368c92c573f6e3c07a84cd3de0a21277f2d00d71
SSDEEP

24576:M4lavt0LkLL9IMixoEgeaP60tmf9auZwjkiRik97PeBpgBNbam01hO3aq9MmCS:bkwkn9IMHeaP6df8uJiD7WWHqEqaPCS

Score

10^/10

darkcomet work16 persistence rat trojan

Malware Config

Extracted

Family

darkcomet

Botnet

Work16

C2

jimmykarcter.ddnsking.com:1490

Mutex

DC_MUTEX-GLGCLP0

Attributes

gencode
QaH9xjy6PUoh
install
false
offline_keylogger
true
persistence
false

Signatures

Darkcomet
DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
trojan rat darkcomet

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\jkj = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1f4d24135ae9d20c3522988f9623529a0b1b320d4a1ab25c8fded65497bc9094.exe"	1f4d24135ae9d20c3522988f9623529a0b1b320d4a1ab25c8fded65497bc9094.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	1f4d24135ae9d20c3522988f9623529a0b1b320d4a1ab25c8fded65497bc9094.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\jkj = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1f4d24135ae9d20c3522988f9623529a0b1b320d4a1ab25c8fded65497bc9094.exe"	1f4d24135ae9d20c3522988f9623529a0b1b320d4a1ab25c8fded65497bc9094.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run	1f4d24135ae9d20c3522988f9623529a0b1b320d4a1ab25c8fded65497bc9094.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4020 set thread context of 2432	4020	1f4d24135ae9d20c3522988f9623529a0b1b320d4a1ab25c8fded65497bc9094.exe	79

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4020	1f4d24135ae9d20c3522988f9623529a0b1b320d4a1ab25c8fded65497bc9094.exe
4020	1f4d24135ae9d20c3522988f9623529a0b1b320d4a1ab25c8fded65497bc9094.exe

Suspicious use of AdjustPrivilegeToken 24 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	2432	1f4d24135ae9d20c3522988f9623529a0b1b320d4a1ab25c8fded65497bc9094.exe
Token: SeSecurityPrivilege	2432	1f4d24135ae9d20c3522988f9623529a0b1b320d4a1ab25c8fded65497bc9094.exe
Token: SeTakeOwnershipPrivilege	2432	1f4d24135ae9d20c3522988f9623529a0b1b320d4a1ab25c8fded65497bc9094.exe
Token: SeLoadDriverPrivilege	2432	1f4d24135ae9d20c3522988f9623529a0b1b320d4a1ab25c8fded65497bc9094.exe
Token: SeSystemProfilePrivilege	2432	1f4d24135ae9d20c3522988f9623529a0b1b320d4a1ab25c8fded65497bc9094.exe
Token: SeSystemtimePrivilege	2432	1f4d24135ae9d20c3522988f9623529a0b1b320d4a1ab25c8fded65497bc9094.exe
Token: SeProfSingleProcessPrivilege	2432	1f4d24135ae9d20c3522988f9623529a0b1b320d4a1ab25c8fded65497bc9094.exe
Token: SeIncBasePriorityPrivilege	2432	1f4d24135ae9d20c3522988f9623529a0b1b320d4a1ab25c8fded65497bc9094.exe
Token: SeCreatePagefilePrivilege	2432	1f4d24135ae9d20c3522988f9623529a0b1b320d4a1ab25c8fded65497bc9094.exe
Token: SeBackupPrivilege	2432	1f4d24135ae9d20c3522988f9623529a0b1b320d4a1ab25c8fded65497bc9094.exe
Token: SeRestorePrivilege	2432	1f4d24135ae9d20c3522988f9623529a0b1b320d4a1ab25c8fded65497bc9094.exe
Token: SeShutdownPrivilege	2432	1f4d24135ae9d20c3522988f9623529a0b1b320d4a1ab25c8fded65497bc9094.exe
Token: SeDebugPrivilege	2432	1f4d24135ae9d20c3522988f9623529a0b1b320d4a1ab25c8fded65497bc9094.exe
Token: SeSystemEnvironmentPrivilege	2432	1f4d24135ae9d20c3522988f9623529a0b1b320d4a1ab25c8fded65497bc9094.exe
Token: SeChangeNotifyPrivilege	2432	1f4d24135ae9d20c3522988f9623529a0b1b320d4a1ab25c8fded65497bc9094.exe
Token: SeRemoteShutdownPrivilege	2432	1f4d24135ae9d20c3522988f9623529a0b1b320d4a1ab25c8fded65497bc9094.exe
Token: SeUndockPrivilege	2432	1f4d24135ae9d20c3522988f9623529a0b1b320d4a1ab25c8fded65497bc9094.exe
Token: SeManageVolumePrivilege	2432	1f4d24135ae9d20c3522988f9623529a0b1b320d4a1ab25c8fded65497bc9094.exe
Token: SeImpersonatePrivilege	2432	1f4d24135ae9d20c3522988f9623529a0b1b320d4a1ab25c8fded65497bc9094.exe
Token: SeCreateGlobalPrivilege	2432	1f4d24135ae9d20c3522988f9623529a0b1b320d4a1ab25c8fded65497bc9094.exe
Token: 33	2432	1f4d24135ae9d20c3522988f9623529a0b1b320d4a1ab25c8fded65497bc9094.exe
Token: 34	2432	1f4d24135ae9d20c3522988f9623529a0b1b320d4a1ab25c8fded65497bc9094.exe
Token: 35	2432	1f4d24135ae9d20c3522988f9623529a0b1b320d4a1ab25c8fded65497bc9094.exe
Token: 36	2432	1f4d24135ae9d20c3522988f9623529a0b1b320d4a1ab25c8fded65497bc9094.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2432	1f4d24135ae9d20c3522988f9623529a0b1b320d4a1ab25c8fded65497bc9094.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 4020 wrote to memory of 2432	4020	1f4d24135ae9d20c3522988f9623529a0b1b320d4a1ab25c8fded65497bc9094.exe	79
PID 4020 wrote to memory of 2432	4020	1f4d24135ae9d20c3522988f9623529a0b1b320d4a1ab25c8fded65497bc9094.exe	79
PID 4020 wrote to memory of 2432	4020	1f4d24135ae9d20c3522988f9623529a0b1b320d4a1ab25c8fded65497bc9094.exe	79
PID 4020 wrote to memory of 2432	4020	1f4d24135ae9d20c3522988f9623529a0b1b320d4a1ab25c8fded65497bc9094.exe	79
PID 4020 wrote to memory of 2432	4020	1f4d24135ae9d20c3522988f9623529a0b1b320d4a1ab25c8fded65497bc9094.exe	79

C:\Users\Admin\AppData\Local\Temp\1f4d24135ae9d20c3522988f9623529a0b1b320d4a1ab25c8fded65497bc9094.exe
"C:\Users\Admin\AppData\Local\Temp\1f4d24135ae9d20c3522988f9623529a0b1b320d4a1ab25c8fded65497bc9094.exe"
1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4020
- C:\Users\Admin\AppData\Local\Temp\1f4d24135ae9d20c3522988f9623529a0b1b320d4a1ab25c8fded65497bc9094.exe
  "C:\Users\Admin\AppData\Local\Temp\1f4d24135ae9d20c3522988f9623529a0b1b320d4a1ab25c8fded65497bc9094.exe"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:2432

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2432-133-0x0000000000A10000-0x0000000000AC2000-memory.dmp

Filesize
712KB

Download
memory/2432-134-0x0000000000A10000-0x0000000000AC2000-memory.dmp

Filesize
712KB

Download
memory/2432-135-0x0000000000A10000-0x0000000000AC2000-memory.dmp

Filesize
712KB

Download
memory/2432-136-0x0000000000A10000-0x0000000000AC2000-memory.dmp

Filesize
712KB

Download
memory/2432-137-0x0000000000A10000-0x0000000000AC2000-memory.dmp

Filesize
712KB

Download

Analysis

Sharing