darkcomet | 54cb5b421df95ed5d7f6ce8756693f467a95aadfd7b038a95d8aaf1433a419ea

General

Target

54cb5b421df95ed5d7f6ce8756693f467a95aadfd7b038a95d8aaf1433a419ea.exe
Size

271KB
MD5

c239c75c787b2181d8dc1a0882b4a159
SHA1

a0e573b00493677797969c52e3c30e3d145e0eae
SHA256

54cb5b421df95ed5d7f6ce8756693f467a95aadfd7b038a95d8aaf1433a419ea
SHA512

ab4aede8fb02bf481336004c6ce90806852bb39de431fd4d028ee7c048390beab680debb851eec36d40c71f971d41370ed1f3b2fa3782cae7489d9b8a2a7dcc8
SSDEEP

6144:XgfVPno0A98mfqyFD2ibY6aRwqlg1NpHcCxxuTklqttnN4l:XgfBo0iqyFD2ijs2B9cbbal

Score

10^/10

darkcomet guest16 persistence rat trojan upx

Malware Config

Extracted

Family

darkcomet

Botnet

Guest16

C2

212.7.208.94:16047

Mutex

DC_MUTEX-AUBVEGH

Attributes

gencode
YutS7R9UNRic
install
false
offline_keylogger
true
persistence
false

Signatures

Darkcomet
DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
trojan rat darkcomet

UPX packed file 5 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/1516-136-0x0000000000400000-0x00000000004B7000-memory.dmp	upx
behavioral2/memory/1516-137-0x0000000000400000-0x00000000004B7000-memory.dmp	upx
behavioral2/memory/1516-138-0x0000000000400000-0x00000000004B7000-memory.dmp	upx
behavioral2/memory/1516-139-0x0000000000400000-0x00000000004B7000-memory.dmp	upx
behavioral2/memory/1516-140-0x0000000000400000-0x00000000004B7000-memory.dmp	upx

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	54cb5b421df95ed5d7f6ce8756693f467a95aadfd7b038a95d8aaf1433a419ea.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Windows Software Utilizer = "C:\\Users\\Admin\\AppData\\Roaming\\Windows Utilizer.exe"	WScript.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce	WScript.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4816 set thread context of 1516	4816	54cb5b421df95ed5d7f6ce8756693f467a95aadfd7b038a95d8aaf1433a419ea.exe	80

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings	explorer.exe

Suspicious use of AdjustPrivilegeToken 25 IoCs

description	pid	Process
Token: SeDebugPrivilege	4816	54cb5b421df95ed5d7f6ce8756693f467a95aadfd7b038a95d8aaf1433a419ea.exe
Token: SeIncreaseQuotaPrivilege	1516	54cb5b421df95ed5d7f6ce8756693f467a95aadfd7b038a95d8aaf1433a419ea.exe
Token: SeSecurityPrivilege	1516	54cb5b421df95ed5d7f6ce8756693f467a95aadfd7b038a95d8aaf1433a419ea.exe
Token: SeTakeOwnershipPrivilege	1516	54cb5b421df95ed5d7f6ce8756693f467a95aadfd7b038a95d8aaf1433a419ea.exe
Token: SeLoadDriverPrivilege	1516	54cb5b421df95ed5d7f6ce8756693f467a95aadfd7b038a95d8aaf1433a419ea.exe
Token: SeSystemProfilePrivilege	1516	54cb5b421df95ed5d7f6ce8756693f467a95aadfd7b038a95d8aaf1433a419ea.exe
Token: SeSystemtimePrivilege	1516	54cb5b421df95ed5d7f6ce8756693f467a95aadfd7b038a95d8aaf1433a419ea.exe
Token: SeProfSingleProcessPrivilege	1516	54cb5b421df95ed5d7f6ce8756693f467a95aadfd7b038a95d8aaf1433a419ea.exe
Token: SeIncBasePriorityPrivilege	1516	54cb5b421df95ed5d7f6ce8756693f467a95aadfd7b038a95d8aaf1433a419ea.exe
Token: SeCreatePagefilePrivilege	1516	54cb5b421df95ed5d7f6ce8756693f467a95aadfd7b038a95d8aaf1433a419ea.exe
Token: SeBackupPrivilege	1516	54cb5b421df95ed5d7f6ce8756693f467a95aadfd7b038a95d8aaf1433a419ea.exe
Token: SeRestorePrivilege	1516	54cb5b421df95ed5d7f6ce8756693f467a95aadfd7b038a95d8aaf1433a419ea.exe
Token: SeShutdownPrivilege	1516	54cb5b421df95ed5d7f6ce8756693f467a95aadfd7b038a95d8aaf1433a419ea.exe
Token: SeDebugPrivilege	1516	54cb5b421df95ed5d7f6ce8756693f467a95aadfd7b038a95d8aaf1433a419ea.exe
Token: SeSystemEnvironmentPrivilege	1516	54cb5b421df95ed5d7f6ce8756693f467a95aadfd7b038a95d8aaf1433a419ea.exe
Token: SeChangeNotifyPrivilege	1516	54cb5b421df95ed5d7f6ce8756693f467a95aadfd7b038a95d8aaf1433a419ea.exe
Token: SeRemoteShutdownPrivilege	1516	54cb5b421df95ed5d7f6ce8756693f467a95aadfd7b038a95d8aaf1433a419ea.exe
Token: SeUndockPrivilege	1516	54cb5b421df95ed5d7f6ce8756693f467a95aadfd7b038a95d8aaf1433a419ea.exe
Token: SeManageVolumePrivilege	1516	54cb5b421df95ed5d7f6ce8756693f467a95aadfd7b038a95d8aaf1433a419ea.exe
Token: SeImpersonatePrivilege	1516	54cb5b421df95ed5d7f6ce8756693f467a95aadfd7b038a95d8aaf1433a419ea.exe
Token: SeCreateGlobalPrivilege	1516	54cb5b421df95ed5d7f6ce8756693f467a95aadfd7b038a95d8aaf1433a419ea.exe
Token: 33	1516	54cb5b421df95ed5d7f6ce8756693f467a95aadfd7b038a95d8aaf1433a419ea.exe
Token: 34	1516	54cb5b421df95ed5d7f6ce8756693f467a95aadfd7b038a95d8aaf1433a419ea.exe
Token: 35	1516	54cb5b421df95ed5d7f6ce8756693f467a95aadfd7b038a95d8aaf1433a419ea.exe
Token: 36	1516	54cb5b421df95ed5d7f6ce8756693f467a95aadfd7b038a95d8aaf1433a419ea.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1516	54cb5b421df95ed5d7f6ce8756693f467a95aadfd7b038a95d8aaf1433a419ea.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 4816 wrote to memory of 1960	4816	54cb5b421df95ed5d7f6ce8756693f467a95aadfd7b038a95d8aaf1433a419ea.exe	79
PID 4816 wrote to memory of 1960	4816	54cb5b421df95ed5d7f6ce8756693f467a95aadfd7b038a95d8aaf1433a419ea.exe	79
PID 4816 wrote to memory of 1960	4816	54cb5b421df95ed5d7f6ce8756693f467a95aadfd7b038a95d8aaf1433a419ea.exe	79
PID 4816 wrote to memory of 1516	4816	54cb5b421df95ed5d7f6ce8756693f467a95aadfd7b038a95d8aaf1433a419ea.exe	80
PID 4816 wrote to memory of 1516	4816	54cb5b421df95ed5d7f6ce8756693f467a95aadfd7b038a95d8aaf1433a419ea.exe	80
PID 4816 wrote to memory of 1516	4816	54cb5b421df95ed5d7f6ce8756693f467a95aadfd7b038a95d8aaf1433a419ea.exe	80
PID 4816 wrote to memory of 1516	4816	54cb5b421df95ed5d7f6ce8756693f467a95aadfd7b038a95d8aaf1433a419ea.exe	80
PID 4816 wrote to memory of 1516	4816	54cb5b421df95ed5d7f6ce8756693f467a95aadfd7b038a95d8aaf1433a419ea.exe	80
PID 4816 wrote to memory of 1516	4816	54cb5b421df95ed5d7f6ce8756693f467a95aadfd7b038a95d8aaf1433a419ea.exe	80
PID 4816 wrote to memory of 1516	4816	54cb5b421df95ed5d7f6ce8756693f467a95aadfd7b038a95d8aaf1433a419ea.exe	80
PID 3536 wrote to memory of 4500	3536	explorer.exe	82
PID 3536 wrote to memory of 4500	3536	explorer.exe	82

C:\Users\Admin\AppData\Local\Temp\54cb5b421df95ed5d7f6ce8756693f467a95aadfd7b038a95d8aaf1433a419ea.exe
"C:\Users\Admin\AppData\Local\Temp\54cb5b421df95ed5d7f6ce8756693f467a95aadfd7b038a95d8aaf1433a419ea.exe"
1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4816
- C:\Windows\SysWOW64\explorer.exe
  "C:\Windows\System32\explorer.exe" C:\Users\Admin\AppData\Roaming\QObrNNBeF.vbs
  2⤵
  PID:1960
- C:\Users\Admin\AppData\Local\Temp\54cb5b421df95ed5d7f6ce8756693f467a95aadfd7b038a95d8aaf1433a419ea.exe
  "C:\Users\Admin\AppData\Local\Temp\54cb5b421df95ed5d7f6ce8756693f467a95aadfd7b038a95d8aaf1433a419ea.exe"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:1516

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3536
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\QObrNNBeF.vbs"
  2⤵
  - Adds Run key to start application
  PID:4500

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\QObrNNBeF.vbs

Filesize
601B

MD5
3f9a9f31e88eb653e15525f7568d2ce3

SHA1
7db2de7325dbd8c2574c78f661fc1c28ebc10301

SHA256
712461277fd0b416b766321612ba0346c5ae4c2e181f6fbc4d984fdb757d9159

SHA512
94810b387cbe26fca10e39f6f4f7cd605caefe69b4f23d5d1d06f764cbb53744c6048a44fd203b85e14318679ab67b2cc11aa50fe6ebc1c821ad970d0c6ea313

Download Submit
memory/1516-136-0x0000000000400000-0x00000000004B7000-memory.dmp

Filesize
732KB

Download
memory/1516-137-0x0000000000400000-0x00000000004B7000-memory.dmp

Filesize
732KB

Download
memory/1516-138-0x0000000000400000-0x00000000004B7000-memory.dmp

Filesize
732KB

Download
memory/1516-139-0x0000000000400000-0x00000000004B7000-memory.dmp

Filesize
732KB

Download
memory/1516-140-0x0000000000400000-0x00000000004B7000-memory.dmp

Filesize
732KB

Download
memory/4816-132-0x0000000075420000-0x00000000759D1000-memory.dmp

Filesize
5.7MB

Download
memory/4816-133-0x0000000075420000-0x00000000759D1000-memory.dmp

Filesize
5.7MB

Download

Analysis

Sharing