darkcomet | d3860e7bdc5ebf614a5ea6f3c6dfc256eb03969957923ce3073ec9c769d9712b

General

Target

d3860e7bdc5ebf614a5ea6f3c6dfc256eb03969957923ce3073ec9c769d9712b.exe
Size

1.6MB
MD5

e478e9199dc2f5fedf5b38bf74321bfb
SHA1

8b1ab9750f30bf32d368300b0b0e5162283658e3
SHA256

d3860e7bdc5ebf614a5ea6f3c6dfc256eb03969957923ce3073ec9c769d9712b
SHA512

e59e10d58c48f15b344c1667844ef1eeefc3674032739d4120c8b5549ffe6c07ab2a6469740b0516b447a8e064e0e194708c7df619f770cbcb81df196594cb83
SSDEEP

49152:7JZoQrbTFZY1iaCYUziQCx77XsgR+PS4+F7xu7:7trbTA1mubXXtKExu7

Score

10^/10

darkcomet 29/05/2014 persistence rat trojan

Malware Config

Extracted

Family

darkcomet

Botnet

29/05/2014

C2

mcnwahiri.no-ip.org:1604

Mutex

DC_MUTEX-D3JEDVK

Attributes

gencode
wnHpKe3tUJD9
install
false
offline_keylogger
true
persistence
false

Signatures

Darkcomet
DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
trojan rat darkcomet

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run	d3860e7bdc5ebf614a5ea6f3c6dfc256eb03969957923ce3073ec9c769d9712b.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run\d3860e7bdc5ebf614a5ea6f3c6dfc256eb03969957923ce3073ec9c769d9712b.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\d3860e7bdc5ebf614a5ea6f3c6dfc256eb03969957923ce3073ec9c769d9712b.exe"	d3860e7bdc5ebf614a5ea6f3c6dfc256eb03969957923ce3073ec9c769d9712b.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 432 set thread context of 544	432	d3860e7bdc5ebf614a5ea6f3c6dfc256eb03969957923ce3073ec9c769d9712b.exe	27

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 23 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	544	d3860e7bdc5ebf614a5ea6f3c6dfc256eb03969957923ce3073ec9c769d9712b.exe
Token: SeSecurityPrivilege	544	d3860e7bdc5ebf614a5ea6f3c6dfc256eb03969957923ce3073ec9c769d9712b.exe
Token: SeTakeOwnershipPrivilege	544	d3860e7bdc5ebf614a5ea6f3c6dfc256eb03969957923ce3073ec9c769d9712b.exe
Token: SeLoadDriverPrivilege	544	d3860e7bdc5ebf614a5ea6f3c6dfc256eb03969957923ce3073ec9c769d9712b.exe
Token: SeSystemProfilePrivilege	544	d3860e7bdc5ebf614a5ea6f3c6dfc256eb03969957923ce3073ec9c769d9712b.exe
Token: SeSystemtimePrivilege	544	d3860e7bdc5ebf614a5ea6f3c6dfc256eb03969957923ce3073ec9c769d9712b.exe
Token: SeProfSingleProcessPrivilege	544	d3860e7bdc5ebf614a5ea6f3c6dfc256eb03969957923ce3073ec9c769d9712b.exe
Token: SeIncBasePriorityPrivilege	544	d3860e7bdc5ebf614a5ea6f3c6dfc256eb03969957923ce3073ec9c769d9712b.exe
Token: SeCreatePagefilePrivilege	544	d3860e7bdc5ebf614a5ea6f3c6dfc256eb03969957923ce3073ec9c769d9712b.exe
Token: SeBackupPrivilege	544	d3860e7bdc5ebf614a5ea6f3c6dfc256eb03969957923ce3073ec9c769d9712b.exe
Token: SeRestorePrivilege	544	d3860e7bdc5ebf614a5ea6f3c6dfc256eb03969957923ce3073ec9c769d9712b.exe
Token: SeShutdownPrivilege	544	d3860e7bdc5ebf614a5ea6f3c6dfc256eb03969957923ce3073ec9c769d9712b.exe
Token: SeDebugPrivilege	544	d3860e7bdc5ebf614a5ea6f3c6dfc256eb03969957923ce3073ec9c769d9712b.exe
Token: SeSystemEnvironmentPrivilege	544	d3860e7bdc5ebf614a5ea6f3c6dfc256eb03969957923ce3073ec9c769d9712b.exe
Token: SeChangeNotifyPrivilege	544	d3860e7bdc5ebf614a5ea6f3c6dfc256eb03969957923ce3073ec9c769d9712b.exe
Token: SeRemoteShutdownPrivilege	544	d3860e7bdc5ebf614a5ea6f3c6dfc256eb03969957923ce3073ec9c769d9712b.exe
Token: SeUndockPrivilege	544	d3860e7bdc5ebf614a5ea6f3c6dfc256eb03969957923ce3073ec9c769d9712b.exe
Token: SeManageVolumePrivilege	544	d3860e7bdc5ebf614a5ea6f3c6dfc256eb03969957923ce3073ec9c769d9712b.exe
Token: SeImpersonatePrivilege	544	d3860e7bdc5ebf614a5ea6f3c6dfc256eb03969957923ce3073ec9c769d9712b.exe
Token: SeCreateGlobalPrivilege	544	d3860e7bdc5ebf614a5ea6f3c6dfc256eb03969957923ce3073ec9c769d9712b.exe
Token: 33	544	d3860e7bdc5ebf614a5ea6f3c6dfc256eb03969957923ce3073ec9c769d9712b.exe
Token: 34	544	d3860e7bdc5ebf614a5ea6f3c6dfc256eb03969957923ce3073ec9c769d9712b.exe
Token: 35	544	d3860e7bdc5ebf614a5ea6f3c6dfc256eb03969957923ce3073ec9c769d9712b.exe

Suspicious use of FindShellTrayWindow 4 IoCs

pid	Process
432	d3860e7bdc5ebf614a5ea6f3c6dfc256eb03969957923ce3073ec9c769d9712b.exe
432	d3860e7bdc5ebf614a5ea6f3c6dfc256eb03969957923ce3073ec9c769d9712b.exe
432	d3860e7bdc5ebf614a5ea6f3c6dfc256eb03969957923ce3073ec9c769d9712b.exe
432	d3860e7bdc5ebf614a5ea6f3c6dfc256eb03969957923ce3073ec9c769d9712b.exe

Suspicious use of SendNotifyMessage 4 IoCs

pid	Process
432	d3860e7bdc5ebf614a5ea6f3c6dfc256eb03969957923ce3073ec9c769d9712b.exe
432	d3860e7bdc5ebf614a5ea6f3c6dfc256eb03969957923ce3073ec9c769d9712b.exe
432	d3860e7bdc5ebf614a5ea6f3c6dfc256eb03969957923ce3073ec9c769d9712b.exe
432	d3860e7bdc5ebf614a5ea6f3c6dfc256eb03969957923ce3073ec9c769d9712b.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
544	d3860e7bdc5ebf614a5ea6f3c6dfc256eb03969957923ce3073ec9c769d9712b.exe

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 432 wrote to memory of 544	432	d3860e7bdc5ebf614a5ea6f3c6dfc256eb03969957923ce3073ec9c769d9712b.exe	27
PID 432 wrote to memory of 544	432	d3860e7bdc5ebf614a5ea6f3c6dfc256eb03969957923ce3073ec9c769d9712b.exe	27
PID 432 wrote to memory of 544	432	d3860e7bdc5ebf614a5ea6f3c6dfc256eb03969957923ce3073ec9c769d9712b.exe	27
PID 432 wrote to memory of 544	432	d3860e7bdc5ebf614a5ea6f3c6dfc256eb03969957923ce3073ec9c769d9712b.exe	27
PID 432 wrote to memory of 544	432	d3860e7bdc5ebf614a5ea6f3c6dfc256eb03969957923ce3073ec9c769d9712b.exe	27
PID 432 wrote to memory of 544	432	d3860e7bdc5ebf614a5ea6f3c6dfc256eb03969957923ce3073ec9c769d9712b.exe	27
PID 432 wrote to memory of 544	432	d3860e7bdc5ebf614a5ea6f3c6dfc256eb03969957923ce3073ec9c769d9712b.exe	27
PID 432 wrote to memory of 544	432	d3860e7bdc5ebf614a5ea6f3c6dfc256eb03969957923ce3073ec9c769d9712b.exe	27
PID 432 wrote to memory of 544	432	d3860e7bdc5ebf614a5ea6f3c6dfc256eb03969957923ce3073ec9c769d9712b.exe	27
PID 432 wrote to memory of 544	432	d3860e7bdc5ebf614a5ea6f3c6dfc256eb03969957923ce3073ec9c769d9712b.exe	27
PID 432 wrote to memory of 544	432	d3860e7bdc5ebf614a5ea6f3c6dfc256eb03969957923ce3073ec9c769d9712b.exe	27
PID 432 wrote to memory of 544	432	d3860e7bdc5ebf614a5ea6f3c6dfc256eb03969957923ce3073ec9c769d9712b.exe	27
PID 432 wrote to memory of 544	432	d3860e7bdc5ebf614a5ea6f3c6dfc256eb03969957923ce3073ec9c769d9712b.exe	27

C:\Users\Admin\AppData\Local\Temp\d3860e7bdc5ebf614a5ea6f3c6dfc256eb03969957923ce3073ec9c769d9712b.exe
"C:\Users\Admin\AppData\Local\Temp\d3860e7bdc5ebf614a5ea6f3c6dfc256eb03969957923ce3073ec9c769d9712b.exe"
1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:432
- C:\Users\Admin\AppData\Local\Temp\d3860e7bdc5ebf614a5ea6f3c6dfc256eb03969957923ce3073ec9c769d9712b.exe
  "C:\Users\Admin\AppData\Local\Temp\d3860e7bdc5ebf614a5ea6f3c6dfc256eb03969957923ce3073ec9c769d9712b.exe"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:544

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/432-54-0x0000000074DA1000-0x0000000074DA3000-memory.dmp

Filesize
8KB

Download
memory/544-55-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/544-56-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/544-58-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/544-60-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/544-62-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/544-64-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/544-65-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/544-67-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/544-69-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/544-71-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/544-73-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/544-74-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/544-75-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download

Analysis

Sharing