darkcomet | 0b85a3a2a0bb71f4a131d276f1fe8d4c13bac9b6307d9eb96670e9ced1e2620a

General

Target

0b85a3a2a0bb71f4a131d276f1fe8d4c13bac9b6307d9eb96670e9ced1e2620a.exe
Size

943KB
MD5

0d7d7429425801971b952d95ac69bf79
SHA1

812ce1d1e71dd0ca962687705530f6bc4be9fd84
SHA256

0b85a3a2a0bb71f4a131d276f1fe8d4c13bac9b6307d9eb96670e9ced1e2620a
SHA512

d254f16d0e12206b913fa038a8263e8ee7eb37216064d3ff4bda7da8f397a8746ab079fe417ba2faefd6a648bdda54f2301422c2d248a22b656130870b2105ae
SSDEEP

24576:cBoWFTCn5Dn8RCOTwv9UA2d0pAEnR4DlHWQig:EFTS8BK+A+0pAY6DlHWQig

Score

10^/10

darkcomet guest16 persistence rat trojan

Malware Config

Extracted

Family

darkcomet

Botnet

Guest16

C2

Thuglife.chickenkiller.com:1604

Mutex

DC_MUTEX-RF5C32V

Attributes

gencode
04tqcSFoaP7w
install
false
offline_keylogger
true
persistence
false

Signatures

Darkcomet
DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
trojan rat darkcomet

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run	REG.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\regloader = "C:\\Users\\Admin\\AppData\\Roaming\\coreloader.exe"	REG.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2284 set thread context of 4992	2284	0b85a3a2a0bb71f4a131d276f1fe8d4c13bac9b6307d9eb96670e9ced1e2620a.exe	81

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
2284	0b85a3a2a0bb71f4a131d276f1fe8d4c13bac9b6307d9eb96670e9ced1e2620a.exe
2284	0b85a3a2a0bb71f4a131d276f1fe8d4c13bac9b6307d9eb96670e9ced1e2620a.exe
2284	0b85a3a2a0bb71f4a131d276f1fe8d4c13bac9b6307d9eb96670e9ced1e2620a.exe
2284	0b85a3a2a0bb71f4a131d276f1fe8d4c13bac9b6307d9eb96670e9ced1e2620a.exe
2284	0b85a3a2a0bb71f4a131d276f1fe8d4c13bac9b6307d9eb96670e9ced1e2620a.exe

Suspicious use of AdjustPrivilegeToken 25 IoCs

description	pid	Process
Token: SeDebugPrivilege	2284	0b85a3a2a0bb71f4a131d276f1fe8d4c13bac9b6307d9eb96670e9ced1e2620a.exe
Token: SeIncreaseQuotaPrivilege	4992	0b85a3a2a0bb71f4a131d276f1fe8d4c13bac9b6307d9eb96670e9ced1e2620a.exe
Token: SeSecurityPrivilege	4992	0b85a3a2a0bb71f4a131d276f1fe8d4c13bac9b6307d9eb96670e9ced1e2620a.exe
Token: SeTakeOwnershipPrivilege	4992	0b85a3a2a0bb71f4a131d276f1fe8d4c13bac9b6307d9eb96670e9ced1e2620a.exe
Token: SeLoadDriverPrivilege	4992	0b85a3a2a0bb71f4a131d276f1fe8d4c13bac9b6307d9eb96670e9ced1e2620a.exe
Token: SeSystemProfilePrivilege	4992	0b85a3a2a0bb71f4a131d276f1fe8d4c13bac9b6307d9eb96670e9ced1e2620a.exe
Token: SeSystemtimePrivilege	4992	0b85a3a2a0bb71f4a131d276f1fe8d4c13bac9b6307d9eb96670e9ced1e2620a.exe
Token: SeProfSingleProcessPrivilege	4992	0b85a3a2a0bb71f4a131d276f1fe8d4c13bac9b6307d9eb96670e9ced1e2620a.exe
Token: SeIncBasePriorityPrivilege	4992	0b85a3a2a0bb71f4a131d276f1fe8d4c13bac9b6307d9eb96670e9ced1e2620a.exe
Token: SeCreatePagefilePrivilege	4992	0b85a3a2a0bb71f4a131d276f1fe8d4c13bac9b6307d9eb96670e9ced1e2620a.exe
Token: SeBackupPrivilege	4992	0b85a3a2a0bb71f4a131d276f1fe8d4c13bac9b6307d9eb96670e9ced1e2620a.exe
Token: SeRestorePrivilege	4992	0b85a3a2a0bb71f4a131d276f1fe8d4c13bac9b6307d9eb96670e9ced1e2620a.exe
Token: SeShutdownPrivilege	4992	0b85a3a2a0bb71f4a131d276f1fe8d4c13bac9b6307d9eb96670e9ced1e2620a.exe
Token: SeDebugPrivilege	4992	0b85a3a2a0bb71f4a131d276f1fe8d4c13bac9b6307d9eb96670e9ced1e2620a.exe
Token: SeSystemEnvironmentPrivilege	4992	0b85a3a2a0bb71f4a131d276f1fe8d4c13bac9b6307d9eb96670e9ced1e2620a.exe
Token: SeChangeNotifyPrivilege	4992	0b85a3a2a0bb71f4a131d276f1fe8d4c13bac9b6307d9eb96670e9ced1e2620a.exe
Token: SeRemoteShutdownPrivilege	4992	0b85a3a2a0bb71f4a131d276f1fe8d4c13bac9b6307d9eb96670e9ced1e2620a.exe
Token: SeUndockPrivilege	4992	0b85a3a2a0bb71f4a131d276f1fe8d4c13bac9b6307d9eb96670e9ced1e2620a.exe
Token: SeManageVolumePrivilege	4992	0b85a3a2a0bb71f4a131d276f1fe8d4c13bac9b6307d9eb96670e9ced1e2620a.exe
Token: SeImpersonatePrivilege	4992	0b85a3a2a0bb71f4a131d276f1fe8d4c13bac9b6307d9eb96670e9ced1e2620a.exe
Token: SeCreateGlobalPrivilege	4992	0b85a3a2a0bb71f4a131d276f1fe8d4c13bac9b6307d9eb96670e9ced1e2620a.exe
Token: 33	4992	0b85a3a2a0bb71f4a131d276f1fe8d4c13bac9b6307d9eb96670e9ced1e2620a.exe
Token: 34	4992	0b85a3a2a0bb71f4a131d276f1fe8d4c13bac9b6307d9eb96670e9ced1e2620a.exe
Token: 35	4992	0b85a3a2a0bb71f4a131d276f1fe8d4c13bac9b6307d9eb96670e9ced1e2620a.exe
Token: 36	4992	0b85a3a2a0bb71f4a131d276f1fe8d4c13bac9b6307d9eb96670e9ced1e2620a.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4992	0b85a3a2a0bb71f4a131d276f1fe8d4c13bac9b6307d9eb96670e9ced1e2620a.exe

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 2284 wrote to memory of 4992	2284	0b85a3a2a0bb71f4a131d276f1fe8d4c13bac9b6307d9eb96670e9ced1e2620a.exe	81
PID 2284 wrote to memory of 4992	2284	0b85a3a2a0bb71f4a131d276f1fe8d4c13bac9b6307d9eb96670e9ced1e2620a.exe	81
PID 2284 wrote to memory of 4992	2284	0b85a3a2a0bb71f4a131d276f1fe8d4c13bac9b6307d9eb96670e9ced1e2620a.exe	81
PID 2284 wrote to memory of 4992	2284	0b85a3a2a0bb71f4a131d276f1fe8d4c13bac9b6307d9eb96670e9ced1e2620a.exe	81
PID 2284 wrote to memory of 4992	2284	0b85a3a2a0bb71f4a131d276f1fe8d4c13bac9b6307d9eb96670e9ced1e2620a.exe	81
PID 2284 wrote to memory of 4992	2284	0b85a3a2a0bb71f4a131d276f1fe8d4c13bac9b6307d9eb96670e9ced1e2620a.exe	81
PID 2284 wrote to memory of 4992	2284	0b85a3a2a0bb71f4a131d276f1fe8d4c13bac9b6307d9eb96670e9ced1e2620a.exe	81
PID 2284 wrote to memory of 4992	2284	0b85a3a2a0bb71f4a131d276f1fe8d4c13bac9b6307d9eb96670e9ced1e2620a.exe	81
PID 2284 wrote to memory of 4992	2284	0b85a3a2a0bb71f4a131d276f1fe8d4c13bac9b6307d9eb96670e9ced1e2620a.exe	81
PID 2284 wrote to memory of 4992	2284	0b85a3a2a0bb71f4a131d276f1fe8d4c13bac9b6307d9eb96670e9ced1e2620a.exe	81
PID 2284 wrote to memory of 4992	2284	0b85a3a2a0bb71f4a131d276f1fe8d4c13bac9b6307d9eb96670e9ced1e2620a.exe	81
PID 2284 wrote to memory of 4992	2284	0b85a3a2a0bb71f4a131d276f1fe8d4c13bac9b6307d9eb96670e9ced1e2620a.exe	81
PID 2284 wrote to memory of 1292	2284	0b85a3a2a0bb71f4a131d276f1fe8d4c13bac9b6307d9eb96670e9ced1e2620a.exe	82
PID 2284 wrote to memory of 1292	2284	0b85a3a2a0bb71f4a131d276f1fe8d4c13bac9b6307d9eb96670e9ced1e2620a.exe	82
PID 2284 wrote to memory of 1292	2284	0b85a3a2a0bb71f4a131d276f1fe8d4c13bac9b6307d9eb96670e9ced1e2620a.exe	82

C:\Users\Admin\AppData\Local\Temp\0b85a3a2a0bb71f4a131d276f1fe8d4c13bac9b6307d9eb96670e9ced1e2620a.exe
"C:\Users\Admin\AppData\Local\Temp\0b85a3a2a0bb71f4a131d276f1fe8d4c13bac9b6307d9eb96670e9ced1e2620a.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2284
- C:\Users\Admin\AppData\Local\Temp\0b85a3a2a0bb71f4a131d276f1fe8d4c13bac9b6307d9eb96670e9ced1e2620a.exe
  "C:\Users\Admin\AppData\Local\Temp\0b85a3a2a0bb71f4a131d276f1fe8d4c13bac9b6307d9eb96670e9ced1e2620a.exe"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:4992
- C:\Windows\SysWOW64\REG.exe
  REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "regloader" /t REG_SZ /F /D "C:\Users\Admin\AppData\Roaming\coreloader.exe
  2⤵
  - Adds Run key to start application
  PID:1292

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1292-136-0x0000000000000000-mapping.dmp

Download
memory/2284-132-0x00000000754F0000-0x0000000075AA1000-memory.dmp

Filesize
5.7MB

Download
memory/2284-138-0x00000000754F0000-0x0000000075AA1000-memory.dmp

Filesize
5.7MB

Download
memory/4992-133-0x0000000000000000-mapping.dmp

Download
memory/4992-134-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/4992-135-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/4992-137-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/4992-139-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/4992-140-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download

Analysis

Sharing