darkcomet | daa8802270996f3d7b4835fd9fba42da054ad1a58403854c0f86b0666c631ac1

Analysis

max time kernel
150s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
26-11-2022 11:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

108.exe
Size

1.5MB
MD5

10d88208d6fc2e26cb4eed0397dab235
SHA1

7f008ecd348766769d024c8c85dbf9c6a46f4833
SHA256

0f4ecea31c8a309dc0c26d4cdddc38f0aaf307399a4705df82088b38553901eb
SHA512

80c9e1403860884e5e361c1ecbb95335636924d1897794078ff0286abb900dc040c3441a7ab5f1ce475b32c22a5ebf03ea4235be2c6db4ab6a5fd601cd38cc05
SSDEEP

24576:vOFgW1J2afML80j0YLKh45y/nsfkNzUOtS0i3lPb0KIEEFNPaNETiLb+J2vs9:vD022+90Dn/Ukw0iVTPEF9LiVE

Score

10^/10

darkcomet mtcn persistence rat trojan

Malware Config

Extracted

Family

darkcomet

Botnet

MTCN

darkcomet.jumpingcrab.com:222

Mutex

DCMIN_MUTEX-PBF9KT3

Attributes

gencode
rTqGpqgXdwrj
install
false
offline_keylogger
true
persistence
false

Signatures

Darkcomet
DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
trojan rat darkcomet

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "C:\\Users\\Admin\\AppData\\Roaming\\FolderName\\file.exe"	108.exe

Executes dropped EXE 1 IoCs

pid	Process
5092	Wiki .exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation	wscript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation	108.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\file.exe	cmd.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\file.exe	cmd.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 5076 set thread context of 5092	5076	108.exe	83

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Delays execution with timeout.exe 1 IoCs

evasion

pid	Process
4304	timeout.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
5076	108.exe
5076	108.exe
5076	108.exe

Suspicious use of AdjustPrivilegeToken 27 IoCs

description	pid	Process
Token: SeDebugPrivilege	5076	108.exe
Token: 33	5076	108.exe
Token: SeIncBasePriorityPrivilege	5076	108.exe
Token: SeIncreaseQuotaPrivilege	5092	Wiki .exe
Token: SeSecurityPrivilege	5092	Wiki .exe
Token: SeTakeOwnershipPrivilege	5092	Wiki .exe
Token: SeLoadDriverPrivilege	5092	Wiki .exe
Token: SeSystemProfilePrivilege	5092	Wiki .exe
Token: SeSystemtimePrivilege	5092	Wiki .exe
Token: SeProfSingleProcessPrivilege	5092	Wiki .exe
Token: SeIncBasePriorityPrivilege	5092	Wiki .exe
Token: SeCreatePagefilePrivilege	5092	Wiki .exe
Token: SeBackupPrivilege	5092	Wiki .exe
Token: SeRestorePrivilege	5092	Wiki .exe
Token: SeShutdownPrivilege	5092	Wiki .exe
Token: SeDebugPrivilege	5092	Wiki .exe
Token: SeSystemEnvironmentPrivilege	5092	Wiki .exe
Token: SeChangeNotifyPrivilege	5092	Wiki .exe
Token: SeRemoteShutdownPrivilege	5092	Wiki .exe
Token: SeUndockPrivilege	5092	Wiki .exe
Token: SeManageVolumePrivilege	5092	Wiki .exe
Token: SeImpersonatePrivilege	5092	Wiki .exe
Token: SeCreateGlobalPrivilege	5092	Wiki .exe
Token: 33	5092	Wiki .exe
Token: 34	5092	Wiki .exe
Token: 35	5092	Wiki .exe
Token: 36	5092	Wiki .exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
5092	Wiki .exe

Suspicious use of WriteProcessMemory 32 IoCs

description	pid	Process	procid_target
PID 5076 wrote to memory of 2160	5076	108.exe	81
PID 5076 wrote to memory of 2160	5076	108.exe	81
PID 5076 wrote to memory of 2160	5076	108.exe	81
PID 5076 wrote to memory of 5092	5076	108.exe	83
PID 5076 wrote to memory of 5092	5076	108.exe	83
PID 5076 wrote to memory of 5092	5076	108.exe	83
PID 5076 wrote to memory of 5092	5076	108.exe	83
PID 2160 wrote to memory of 5088	2160	cmd.exe	84
PID 2160 wrote to memory of 5088	2160	cmd.exe	84
PID 2160 wrote to memory of 5088	2160	cmd.exe	84
PID 5076 wrote to memory of 5092	5076	108.exe	83
PID 5076 wrote to memory of 5092	5076	108.exe	83
PID 5076 wrote to memory of 5092	5076	108.exe	83
PID 5076 wrote to memory of 5092	5076	108.exe	83
PID 5076 wrote to memory of 5092	5076	108.exe	83
PID 5076 wrote to memory of 5092	5076	108.exe	83
PID 5076 wrote to memory of 5092	5076	108.exe	83
PID 5076 wrote to memory of 5092	5076	108.exe	83
PID 5076 wrote to memory of 5092	5076	108.exe	83
PID 5076 wrote to memory of 5092	5076	108.exe	83
PID 5088 wrote to memory of 4292	5088	wscript.exe	85
PID 5088 wrote to memory of 4292	5088	wscript.exe	85
PID 5088 wrote to memory of 4292	5088	wscript.exe	85
PID 5076 wrote to memory of 4620	5076	108.exe	93
PID 5076 wrote to memory of 4620	5076	108.exe	93
PID 5076 wrote to memory of 4620	5076	108.exe	93
PID 5076 wrote to memory of 456	5076	108.exe	95
PID 5076 wrote to memory of 456	5076	108.exe	95
PID 5076 wrote to memory of 456	5076	108.exe	95
PID 4620 wrote to memory of 4304	4620	cmd.exe	97
PID 4620 wrote to memory of 4304	4620	cmd.exe	97
PID 4620 wrote to memory of 4304	4620	cmd.exe	97

C:\Users\Admin\AppData\Local\Temp\108.exe
"C:\Users\Admin\AppData\Local\Temp\108.exe"
1⤵
- Modifies WinLogon for persistence
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5076
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\FolderName\mata.bat
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2160
- - C:\Windows\SysWOW64\wscript.exe
    wscript.exe "C:\Users\Admin\AppData\Roaming\FolderName\invs.vbs" "C:\Users\Admin\AppData\Roaming\FolderName\mata2.bat
    3⤵
    - Checks computer location settings
    - Suspicious use of WriteProcessMemory
    PID:5088
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\FolderName\mata2.bat" "
      4⤵
      Drops startup file
      PID:4292
- C:\Users\Admin\AppData\Roaming\Wiki .exe
  "C:\Users\Admin\AppData\Roaming\Wiki .exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:5092
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\FolderName\Wiki.bat" "
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4620
- - C:\Windows\SysWOW64\timeout.exe
    timeout /t 300
    3⤵
    - Delays execution with timeout.exe
    PID:4304
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\FolderName\melt.bat
  2⤵
  PID:456

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Winlogon Helper DLL

T1004

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\FolderName\Wiki.bat

Filesize
202B

MD5
c95e1c0701b2529c4c71341011fc4f94

SHA1
62da53ba5c9ad39d794b09bfa690dc3e6693603d

SHA256
2e3b78ebf3b20ef27aa2d7e5b2a3f3796f652cd7776d92c56a28c356adb125a9

SHA512
872cc14ab6eceb1eefbc8ae334a9d07e9cedec9f561dc16c2629538830aa5b01e9944c369b3a1ee878c3f5718cd96c6d7ee65bb6b54d64c5e8a0332f63188b48

Download Submit
C:\Users\Admin\AppData\Roaming\FolderName\file.exe

Filesize
1.5MB

MD5
10d88208d6fc2e26cb4eed0397dab235

SHA1
7f008ecd348766769d024c8c85dbf9c6a46f4833

SHA256
0f4ecea31c8a309dc0c26d4cdddc38f0aaf307399a4705df82088b38553901eb

SHA512
80c9e1403860884e5e361c1ecbb95335636924d1897794078ff0286abb900dc040c3441a7ab5f1ce475b32c22a5ebf03ea4235be2c6db4ab6a5fd601cd38cc05

Download Submit
C:\Users\Admin\AppData\Roaming\FolderName\invs.vbs

Filesize
78B

MD5
c578d9653b22800c3eb6b6a51219bbb8

SHA1
a97aa251901bbe179a48dbc7a0c1872e163b1f2d

SHA256
20a98a7e6e137bb1b9bd5ef6911a479cb8eac925b80d6db4e70b19f62a40cce2

SHA512
3ae6dc8f02d1a78e1235a0782b632972da5a74ab32287cc41aa672d4fa4a9d34bb5fc50eba07b6915f2e61c402927cd5f6feeb7f7602afa2f64e91efb3b7fc4d

Download Submit
C:\Users\Admin\AppData\Roaming\FolderName\mata.bat

Filesize
75B

MD5
b33985e3fc0ff1814a70626c744d2fd9

SHA1
269ff1b7ff5510822cd5207ca8593e48672d7431

SHA256
b4a06f7d7c2b2887801515c8f0cdc7a4cf8245af5afa38314f72952bd18fb357

SHA512
689de361836ff6053e2f0c88942e0b7ac62a3cbc8e8ef923d49c6e84e4c28e65c11588b6d88b69abad86e06d5eb22586d22cafe1abff1ceb6e0fc0d930a97769

Download Submit
C:\Users\Admin\AppData\Roaming\FolderName\mata2.bat

Filesize
185B

MD5
8b9ea9611468250a9763d08a2fab2037

SHA1
4c5b65d96238edc85bffb23dba3f3e29db534e35

SHA256
895fb1f50bc39ac6f22b82347fc5c25585dc028c0a18bf33207da1b24f50cc16

SHA512
05b632efce3c0e70016f07c9a1a588152a710291e82fac1575e7c4ad3c56254934d6da40756990fb1902c91516b87d2446dfb36ffb2efaa319845b2514d276ea

Download Submit
C:\Users\Admin\AppData\Roaming\FolderName\melt.bat

Filesize
59B

MD5
c8bf4448cdf466f87ac38d84250f7d92

SHA1
d1eff52a39465b0adc6afa0530465d1350489a17

SHA256
90d67f8a4a0edfc608155bbad9358b3ba3252fd441c2dfa7543bb8e64ad2a77b

SHA512
ec2a64d035d363f65b17be7b94b7c6ff3c863a83066b67d11c87258956bcedc308b3fe2b0c0d012036700b8415e3ba432ab7a3372a07d55fa29db921be8a7b3f

Download Submit
C:\Users\Admin\AppData\Roaming\FolderName\rundll11-.txt

Filesize
1.5MB

MD5
10d88208d6fc2e26cb4eed0397dab235

SHA1
7f008ecd348766769d024c8c85dbf9c6a46f4833

SHA256
0f4ecea31c8a309dc0c26d4cdddc38f0aaf307399a4705df82088b38553901eb

SHA512
80c9e1403860884e5e361c1ecbb95335636924d1897794078ff0286abb900dc040c3441a7ab5f1ce475b32c22a5ebf03ea4235be2c6db4ab6a5fd601cd38cc05

Download Submit
C:\Users\Admin\AppData\Roaming\Wiki .exe

Filesize
57KB

MD5
454501a66ad6e85175a6757573d79f8b

SHA1
8ca96c61f26a640a5b1b1152d055260b9d43e308

SHA256
7fd4f35aff4a0d4bfaae3a5dfb14b94934276df0e96d1a417a8f3693915e72c8

SHA512
9dc3b9a9b7e661acc3ac9a0ff4fd764097fc41ccbc2e7969cae9805cc693a87e8255e459ea5f315271825e7e517a46649acc8d42122a8018264cc3f2efa34fb7

Download Submit
C:\Users\Admin\AppData\Roaming\Wiki .exe

Filesize
57KB

MD5
454501a66ad6e85175a6757573d79f8b

SHA1
8ca96c61f26a640a5b1b1152d055260b9d43e308

SHA256
7fd4f35aff4a0d4bfaae3a5dfb14b94934276df0e96d1a417a8f3693915e72c8

SHA512
9dc3b9a9b7e661acc3ac9a0ff4fd764097fc41ccbc2e7969cae9805cc693a87e8255e459ea5f315271825e7e517a46649acc8d42122a8018264cc3f2efa34fb7

Download Submit
memory/5076-152-0x0000000074AC0000-0x0000000075071000-memory.dmp

Filesize
5.7MB

Download
memory/5076-132-0x0000000074AC0000-0x0000000075071000-memory.dmp

Filesize
5.7MB

Download
memory/5076-148-0x0000000074AC0000-0x0000000075071000-memory.dmp

Filesize
5.7MB

Download
memory/5092-137-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/5092-144-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/5092-142-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/5092-140-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download