darkcomet | daa8802270996f3d7b4835fd9fba42da054ad1a58403854c0f86b0666c631ac1

Analysis

max time kernel
208s
max time network
124s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
26-11-2022 11:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

108.exe
Size

1.5MB
MD5

10d88208d6fc2e26cb4eed0397dab235
SHA1

7f008ecd348766769d024c8c85dbf9c6a46f4833
SHA256

0f4ecea31c8a309dc0c26d4cdddc38f0aaf307399a4705df82088b38553901eb
SHA512

80c9e1403860884e5e361c1ecbb95335636924d1897794078ff0286abb900dc040c3441a7ab5f1ce475b32c22a5ebf03ea4235be2c6db4ab6a5fd601cd38cc05
SSDEEP

24576:vOFgW1J2afML80j0YLKh45y/nsfkNzUOtS0i3lPb0KIEEFNPaNETiLb+J2vs9:vD022+90Dn/Ukw0iVTPEF9LiVE

Score

10^/10

darkcomet mtcn persistence rat trojan

Malware Config

Extracted

Family

darkcomet

Botnet

MTCN

darkcomet.jumpingcrab.com:222

Mutex

DCMIN_MUTEX-PBF9KT3

Attributes

gencode
rTqGpqgXdwrj
install
false
offline_keylogger
true
persistence
false

Signatures

Darkcomet
DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
trojan rat darkcomet

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "C:\\Users\\Admin\\AppData\\Roaming\\FolderName\\file.exe"	108.exe

Executes dropped EXE 1 IoCs

pid	Process
1860	Wiki .exe

Deletes itself 1 IoCs

pid	Process
1812	cmd.exe

Loads dropped DLL 1 IoCs

pid	Process
1168	108.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1168 set thread context of 1860	1168	108.exe	31

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
1168	108.exe
1168	108.exe
1168	108.exe

Suspicious use of AdjustPrivilegeToken 26 IoCs

description	pid	Process
Token: SeDebugPrivilege	1168	108.exe
Token: 33	1168	108.exe
Token: SeIncBasePriorityPrivilege	1168	108.exe
Token: SeIncreaseQuotaPrivilege	1860	Wiki .exe
Token: SeSecurityPrivilege	1860	Wiki .exe
Token: SeTakeOwnershipPrivilege	1860	Wiki .exe
Token: SeLoadDriverPrivilege	1860	Wiki .exe
Token: SeSystemProfilePrivilege	1860	Wiki .exe
Token: SeSystemtimePrivilege	1860	Wiki .exe
Token: SeProfSingleProcessPrivilege	1860	Wiki .exe
Token: SeIncBasePriorityPrivilege	1860	Wiki .exe
Token: SeCreatePagefilePrivilege	1860	Wiki .exe
Token: SeBackupPrivilege	1860	Wiki .exe
Token: SeRestorePrivilege	1860	Wiki .exe
Token: SeShutdownPrivilege	1860	Wiki .exe
Token: SeDebugPrivilege	1860	Wiki .exe
Token: SeSystemEnvironmentPrivilege	1860	Wiki .exe
Token: SeChangeNotifyPrivilege	1860	Wiki .exe
Token: SeRemoteShutdownPrivilege	1860	Wiki .exe
Token: SeUndockPrivilege	1860	Wiki .exe
Token: SeManageVolumePrivilege	1860	Wiki .exe
Token: SeImpersonatePrivilege	1860	Wiki .exe
Token: SeCreateGlobalPrivilege	1860	Wiki .exe
Token: 33	1860	Wiki .exe
Token: 34	1860	Wiki .exe
Token: 35	1860	Wiki .exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1860	Wiki .exe

Suspicious use of WriteProcessMemory 25 IoCs

description	pid	Process	procid_target
PID 1168 wrote to memory of 568	1168	108.exe	28
PID 1168 wrote to memory of 568	1168	108.exe	28
PID 1168 wrote to memory of 568	1168	108.exe	28
PID 1168 wrote to memory of 568	1168	108.exe	28
PID 568 wrote to memory of 2004	568	cmd.exe	30
PID 568 wrote to memory of 2004	568	cmd.exe	30
PID 568 wrote to memory of 2004	568	cmd.exe	30
PID 568 wrote to memory of 2004	568	cmd.exe	30
PID 1168 wrote to memory of 1860	1168	108.exe	31
PID 1168 wrote to memory of 1860	1168	108.exe	31
PID 1168 wrote to memory of 1860	1168	108.exe	31
PID 1168 wrote to memory of 1860	1168	108.exe	31
PID 1168 wrote to memory of 1860	1168	108.exe	31
PID 1168 wrote to memory of 1860	1168	108.exe	31
PID 1168 wrote to memory of 1860	1168	108.exe	31
PID 1168 wrote to memory of 1860	1168	108.exe	31
PID 1168 wrote to memory of 1860	1168	108.exe	31
PID 1168 wrote to memory of 1860	1168	108.exe	31
PID 1168 wrote to memory of 1860	1168	108.exe	31
PID 1168 wrote to memory of 1860	1168	108.exe	31
PID 1168 wrote to memory of 1860	1168	108.exe	31
PID 1168 wrote to memory of 1812	1168	108.exe	32
PID 1168 wrote to memory of 1812	1168	108.exe	32
PID 1168 wrote to memory of 1812	1168	108.exe	32
PID 1168 wrote to memory of 1812	1168	108.exe	32

C:\Users\Admin\AppData\Local\Temp\108.exe
"C:\Users\Admin\AppData\Local\Temp\108.exe"
1⤵
- Modifies WinLogon for persistence
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1168
- C:\Windows\SysWOW64\cmd.exe
  cmd /c C:\Users\Admin\AppData\Roaming\FolderName\mata.bat
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:568
- - C:\Windows\SysWOW64\wscript.exe
    wscript.exe "C:\Users\Admin\AppData\Roaming\FolderName\invs.vbs" "C:\Users\Admin\AppData\Roaming\FolderName\mata2.bat
    3⤵
    PID:2004
- C:\Users\Admin\AppData\Roaming\Wiki .exe
  "C:\Users\Admin\AppData\Roaming\Wiki .exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:1860
- C:\Windows\SysWOW64\cmd.exe
  cmd /c C:\Users\Admin\AppData\Roaming\FolderName\melt.bat
  2⤵
  - Deletes itself
  PID:1812

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Winlogon Helper DLL

T1004

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\FolderName\invs.vbs

Filesize
78B

MD5
c578d9653b22800c3eb6b6a51219bbb8

SHA1
a97aa251901bbe179a48dbc7a0c1872e163b1f2d

SHA256
20a98a7e6e137bb1b9bd5ef6911a479cb8eac925b80d6db4e70b19f62a40cce2

SHA512
3ae6dc8f02d1a78e1235a0782b632972da5a74ab32287cc41aa672d4fa4a9d34bb5fc50eba07b6915f2e61c402927cd5f6feeb7f7602afa2f64e91efb3b7fc4d

Download Submit
C:\Users\Admin\AppData\Roaming\FolderName\mata.bat

Filesize
75B

MD5
b33985e3fc0ff1814a70626c744d2fd9

SHA1
269ff1b7ff5510822cd5207ca8593e48672d7431

SHA256
b4a06f7d7c2b2887801515c8f0cdc7a4cf8245af5afa38314f72952bd18fb357

SHA512
689de361836ff6053e2f0c88942e0b7ac62a3cbc8e8ef923d49c6e84e4c28e65c11588b6d88b69abad86e06d5eb22586d22cafe1abff1ceb6e0fc0d930a97769

Download Submit
C:\Users\Admin\AppData\Roaming\FolderName\melt.bat

Filesize
59B

MD5
c8bf4448cdf466f87ac38d84250f7d92

SHA1
d1eff52a39465b0adc6afa0530465d1350489a17

SHA256
90d67f8a4a0edfc608155bbad9358b3ba3252fd441c2dfa7543bb8e64ad2a77b

SHA512
ec2a64d035d363f65b17be7b94b7c6ff3c863a83066b67d11c87258956bcedc308b3fe2b0c0d012036700b8415e3ba432ab7a3372a07d55fa29db921be8a7b3f

Download Submit
C:\Users\Admin\AppData\Roaming\Wiki .exe

Filesize
54KB

MD5
0f01571a3e4c71eb4313175aae86488e

SHA1
2ba648afe2cd52edf5f25e304f77d457abf7ac0e

SHA256
8cc51c4c2efc8c6a401aa83a0aeced0925d5d9d2a43192f35561893cdf704022

SHA512
159dfbb7d385bf92f4fc48ca389b89d69f6c2616e90dfa056e725d7da78a3702694a28f9c5cab7b55adc4d4dbd7bfe5d272c8b1c9931e3ac95f6326d74576794

Download Submit
C:\Users\Admin\AppData\Roaming\Wiki .exe

Filesize
54KB

MD5
0f01571a3e4c71eb4313175aae86488e

SHA1
2ba648afe2cd52edf5f25e304f77d457abf7ac0e

SHA256
8cc51c4c2efc8c6a401aa83a0aeced0925d5d9d2a43192f35561893cdf704022

SHA512
159dfbb7d385bf92f4fc48ca389b89d69f6c2616e90dfa056e725d7da78a3702694a28f9c5cab7b55adc4d4dbd7bfe5d272c8b1c9931e3ac95f6326d74576794

Download Submit
\Users\Admin\AppData\Roaming\Wiki .exe

Filesize
54KB

MD5
0f01571a3e4c71eb4313175aae86488e

SHA1
2ba648afe2cd52edf5f25e304f77d457abf7ac0e

SHA256
8cc51c4c2efc8c6a401aa83a0aeced0925d5d9d2a43192f35561893cdf704022

SHA512
159dfbb7d385bf92f4fc48ca389b89d69f6c2616e90dfa056e725d7da78a3702694a28f9c5cab7b55adc4d4dbd7bfe5d272c8b1c9931e3ac95f6326d74576794

Download Submit
memory/1168-54-0x0000000074FD1000-0x0000000074FD3000-memory.dmp

Filesize
8KB

Download
memory/1168-55-0x0000000074200000-0x00000000747AB000-memory.dmp

Filesize
5.7MB

Download
memory/1168-85-0x0000000074200000-0x00000000747AB000-memory.dmp

Filesize
5.7MB

Download
memory/1168-81-0x0000000074200000-0x00000000747AB000-memory.dmp

Filesize
5.7MB

Download
memory/1860-70-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/1860-66-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/1860-73-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/1860-68-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/1860-75-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/1860-79-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/1860-71-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/1860-82-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/1860-64-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/1860-61-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/1860-60-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/1860-86-0x000000000048F000-0x0000000000491000-memory.dmp

Filesize
8KB

Download
memory/1860-87-0x0000000000401000-0x000000000048F000-memory.dmp

Filesize
568KB

Download