darkcomet | d3860e7bdc5ebf614a5ea6f3c6dfc256eb03969957923ce3073ec9c769d9712b

General

Target

d3860e7bdc5ebf614a5ea6f3c6dfc256eb03969957923ce3073ec9c769d9712b.exe
Size

1.6MB
MD5

e478e9199dc2f5fedf5b38bf74321bfb
SHA1

8b1ab9750f30bf32d368300b0b0e5162283658e3
SHA256

d3860e7bdc5ebf614a5ea6f3c6dfc256eb03969957923ce3073ec9c769d9712b
SHA512

e59e10d58c48f15b344c1667844ef1eeefc3674032739d4120c8b5549ffe6c07ab2a6469740b0516b447a8e064e0e194708c7df619f770cbcb81df196594cb83
SSDEEP

49152:7JZoQrbTFZY1iaCYUziQCx77XsgR+PS4+F7xu7:7trbTA1mubXXtKExu7

Score

10^/10

darkcomet 29/05/2014 persistence rat trojan

Malware Config

Extracted

Family

darkcomet

Botnet

29/05/2014

C2

mcnwahiri.no-ip.org:1604

Mutex

DC_MUTEX-D3JEDVK

Attributes

gencode
wnHpKe3tUJD9
install
false
offline_keylogger
true
persistence
false

Signatures

Darkcomet
DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
trojan rat darkcomet

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run	d3860e7bdc5ebf614a5ea6f3c6dfc256eb03969957923ce3073ec9c769d9712b.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\d3860e7bdc5ebf614a5ea6f3c6dfc256eb03969957923ce3073ec9c769d9712b.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\d3860e7bdc5ebf614a5ea6f3c6dfc256eb03969957923ce3073ec9c769d9712b.exe"	d3860e7bdc5ebf614a5ea6f3c6dfc256eb03969957923ce3073ec9c769d9712b.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4180 set thread context of 4336	4180	d3860e7bdc5ebf614a5ea6f3c6dfc256eb03969957923ce3073ec9c769d9712b.exe	80

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 24 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	4336	d3860e7bdc5ebf614a5ea6f3c6dfc256eb03969957923ce3073ec9c769d9712b.exe
Token: SeSecurityPrivilege	4336	d3860e7bdc5ebf614a5ea6f3c6dfc256eb03969957923ce3073ec9c769d9712b.exe
Token: SeTakeOwnershipPrivilege	4336	d3860e7bdc5ebf614a5ea6f3c6dfc256eb03969957923ce3073ec9c769d9712b.exe
Token: SeLoadDriverPrivilege	4336	d3860e7bdc5ebf614a5ea6f3c6dfc256eb03969957923ce3073ec9c769d9712b.exe
Token: SeSystemProfilePrivilege	4336	d3860e7bdc5ebf614a5ea6f3c6dfc256eb03969957923ce3073ec9c769d9712b.exe
Token: SeSystemtimePrivilege	4336	d3860e7bdc5ebf614a5ea6f3c6dfc256eb03969957923ce3073ec9c769d9712b.exe
Token: SeProfSingleProcessPrivilege	4336	d3860e7bdc5ebf614a5ea6f3c6dfc256eb03969957923ce3073ec9c769d9712b.exe
Token: SeIncBasePriorityPrivilege	4336	d3860e7bdc5ebf614a5ea6f3c6dfc256eb03969957923ce3073ec9c769d9712b.exe
Token: SeCreatePagefilePrivilege	4336	d3860e7bdc5ebf614a5ea6f3c6dfc256eb03969957923ce3073ec9c769d9712b.exe
Token: SeBackupPrivilege	4336	d3860e7bdc5ebf614a5ea6f3c6dfc256eb03969957923ce3073ec9c769d9712b.exe
Token: SeRestorePrivilege	4336	d3860e7bdc5ebf614a5ea6f3c6dfc256eb03969957923ce3073ec9c769d9712b.exe
Token: SeShutdownPrivilege	4336	d3860e7bdc5ebf614a5ea6f3c6dfc256eb03969957923ce3073ec9c769d9712b.exe
Token: SeDebugPrivilege	4336	d3860e7bdc5ebf614a5ea6f3c6dfc256eb03969957923ce3073ec9c769d9712b.exe
Token: SeSystemEnvironmentPrivilege	4336	d3860e7bdc5ebf614a5ea6f3c6dfc256eb03969957923ce3073ec9c769d9712b.exe
Token: SeChangeNotifyPrivilege	4336	d3860e7bdc5ebf614a5ea6f3c6dfc256eb03969957923ce3073ec9c769d9712b.exe
Token: SeRemoteShutdownPrivilege	4336	d3860e7bdc5ebf614a5ea6f3c6dfc256eb03969957923ce3073ec9c769d9712b.exe
Token: SeUndockPrivilege	4336	d3860e7bdc5ebf614a5ea6f3c6dfc256eb03969957923ce3073ec9c769d9712b.exe
Token: SeManageVolumePrivilege	4336	d3860e7bdc5ebf614a5ea6f3c6dfc256eb03969957923ce3073ec9c769d9712b.exe
Token: SeImpersonatePrivilege	4336	d3860e7bdc5ebf614a5ea6f3c6dfc256eb03969957923ce3073ec9c769d9712b.exe
Token: SeCreateGlobalPrivilege	4336	d3860e7bdc5ebf614a5ea6f3c6dfc256eb03969957923ce3073ec9c769d9712b.exe
Token: 33	4336	d3860e7bdc5ebf614a5ea6f3c6dfc256eb03969957923ce3073ec9c769d9712b.exe
Token: 34	4336	d3860e7bdc5ebf614a5ea6f3c6dfc256eb03969957923ce3073ec9c769d9712b.exe
Token: 35	4336	d3860e7bdc5ebf614a5ea6f3c6dfc256eb03969957923ce3073ec9c769d9712b.exe
Token: 36	4336	d3860e7bdc5ebf614a5ea6f3c6dfc256eb03969957923ce3073ec9c769d9712b.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
4180	d3860e7bdc5ebf614a5ea6f3c6dfc256eb03969957923ce3073ec9c769d9712b.exe
4180	d3860e7bdc5ebf614a5ea6f3c6dfc256eb03969957923ce3073ec9c769d9712b.exe
4180	d3860e7bdc5ebf614a5ea6f3c6dfc256eb03969957923ce3073ec9c769d9712b.exe

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
4180	d3860e7bdc5ebf614a5ea6f3c6dfc256eb03969957923ce3073ec9c769d9712b.exe
4180	d3860e7bdc5ebf614a5ea6f3c6dfc256eb03969957923ce3073ec9c769d9712b.exe
4180	d3860e7bdc5ebf614a5ea6f3c6dfc256eb03969957923ce3073ec9c769d9712b.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4336	d3860e7bdc5ebf614a5ea6f3c6dfc256eb03969957923ce3073ec9c769d9712b.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 4180 wrote to memory of 4336	4180	d3860e7bdc5ebf614a5ea6f3c6dfc256eb03969957923ce3073ec9c769d9712b.exe	80
PID 4180 wrote to memory of 4336	4180	d3860e7bdc5ebf614a5ea6f3c6dfc256eb03969957923ce3073ec9c769d9712b.exe	80
PID 4180 wrote to memory of 4336	4180	d3860e7bdc5ebf614a5ea6f3c6dfc256eb03969957923ce3073ec9c769d9712b.exe	80
PID 4180 wrote to memory of 4336	4180	d3860e7bdc5ebf614a5ea6f3c6dfc256eb03969957923ce3073ec9c769d9712b.exe	80
PID 4180 wrote to memory of 4336	4180	d3860e7bdc5ebf614a5ea6f3c6dfc256eb03969957923ce3073ec9c769d9712b.exe	80
PID 4180 wrote to memory of 4336	4180	d3860e7bdc5ebf614a5ea6f3c6dfc256eb03969957923ce3073ec9c769d9712b.exe	80
PID 4180 wrote to memory of 4336	4180	d3860e7bdc5ebf614a5ea6f3c6dfc256eb03969957923ce3073ec9c769d9712b.exe	80
PID 4180 wrote to memory of 4336	4180	d3860e7bdc5ebf614a5ea6f3c6dfc256eb03969957923ce3073ec9c769d9712b.exe	80
PID 4180 wrote to memory of 4336	4180	d3860e7bdc5ebf614a5ea6f3c6dfc256eb03969957923ce3073ec9c769d9712b.exe	80
PID 4180 wrote to memory of 4336	4180	d3860e7bdc5ebf614a5ea6f3c6dfc256eb03969957923ce3073ec9c769d9712b.exe	80
PID 4180 wrote to memory of 4336	4180	d3860e7bdc5ebf614a5ea6f3c6dfc256eb03969957923ce3073ec9c769d9712b.exe	80
PID 4180 wrote to memory of 4336	4180	d3860e7bdc5ebf614a5ea6f3c6dfc256eb03969957923ce3073ec9c769d9712b.exe	80
PID 4180 wrote to memory of 4336	4180	d3860e7bdc5ebf614a5ea6f3c6dfc256eb03969957923ce3073ec9c769d9712b.exe	80
PID 4180 wrote to memory of 4336	4180	d3860e7bdc5ebf614a5ea6f3c6dfc256eb03969957923ce3073ec9c769d9712b.exe	80

C:\Users\Admin\AppData\Local\Temp\d3860e7bdc5ebf614a5ea6f3c6dfc256eb03969957923ce3073ec9c769d9712b.exe
"C:\Users\Admin\AppData\Local\Temp\d3860e7bdc5ebf614a5ea6f3c6dfc256eb03969957923ce3073ec9c769d9712b.exe"
1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4180
- C:\Users\Admin\AppData\Local\Temp\d3860e7bdc5ebf614a5ea6f3c6dfc256eb03969957923ce3073ec9c769d9712b.exe
  "C:\Users\Admin\AppData\Local\Temp\d3860e7bdc5ebf614a5ea6f3c6dfc256eb03969957923ce3073ec9c769d9712b.exe"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:4336

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4336-132-0x0000000000000000-mapping.dmp

Download
memory/4336-133-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/4336-134-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/4336-135-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/4336-136-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/4336-137-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download

Analysis

Sharing