darkcomet | fd42ca44c810ec12475aa748620dd57a0aa8565ffb27bfc01201032b0561eceb | Triage

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
27-11-2022 14:31

Sharing

Report Analysis Logs

General

Target

fd42ca44c810ec12475aa748620dd57a0aa8565ffb27bfc01201032b0561eceb.exe
Size

803KB
MD5

3a0639a82455512cc6b3e62de87f4731
SHA1

7f326297f899e97954953c779244bbbade00d6f4
SHA256

fd42ca44c810ec12475aa748620dd57a0aa8565ffb27bfc01201032b0561eceb
SHA512

47ec748a97461a263b4c677c620296616cac84fa51a0b0212102d4c7350bf9d339fdf7934fa46689fe52a6f0d731157536b6bb85ff3841c03c5b3b8798007779
SSDEEP

12288:d8pU57DxU2ku9aM96k+naM3BjuUfS0qAPEIMWDXhE9qGerhRatWu6:a25Jhkm9rnMgUK0qBIVVGeD9

Score

10^/10

darkcomet zombie persistence rat trojan

Malware Config

Extracted

Family

darkcomet

Botnet

Zombie

C2

jacksbotlist.zapto.org:1604

Mutex

DC_MUTEX-GB0F9SN

Attributes

gencode
oDRF7HD6Rs4F
install
false
offline_keylogger
true
persistence
false

Signatures

Darkcomet
DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
trojan rat darkcomet

Adds Run key to start application 2 TTPs 1 IoCs

Registry Run Keys / Startup Folder

Modify Registry

Processes:

fd42ca44c810ec12475aa748620dd57a0aa8565ffb27bfc01201032b0561eceb.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\hosts = "C:\\Users\\Admin\\AppData\\Roaming\\hosts\\hosts.exe"	fd42ca44c810ec12475aa748620dd57a0aa8565ffb27bfc01201032b0561eceb.exe

Drops desktop.ini file(s) 2 IoCs

Processes:

fd42ca44c810ec12475aa748620dd57a0aa8565ffb27bfc01201032b0561eceb.exe

description	ioc	process
File created	C:\Windows\assembly\Desktop.ini	fd42ca44c810ec12475aa748620dd57a0aa8565ffb27bfc01201032b0561eceb.exe
File opened for modification	C:\Windows\assembly\Desktop.ini	fd42ca44c810ec12475aa748620dd57a0aa8565ffb27bfc01201032b0561eceb.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

fd42ca44c810ec12475aa748620dd57a0aa8565ffb27bfc01201032b0561eceb.exe

description	pid	process	target process
PID 2416 set thread context of 4916	2416	fd42ca44c810ec12475aa748620dd57a0aa8565ffb27bfc01201032b0561eceb.exe	fd42ca44c810ec12475aa748620dd57a0aa8565ffb27bfc01201032b0561eceb.exe

Drops file in Windows directory 3 IoCs

Processes:

fd42ca44c810ec12475aa748620dd57a0aa8565ffb27bfc01201032b0561eceb.exe

description	ioc	process
File opened for modification	C:\Windows\assembly	fd42ca44c810ec12475aa748620dd57a0aa8565ffb27bfc01201032b0561eceb.exe
File created	C:\Windows\assembly\Desktop.ini	fd42ca44c810ec12475aa748620dd57a0aa8565ffb27bfc01201032b0561eceb.exe
File opened for modification	C:\Windows\assembly\Desktop.ini	fd42ca44c810ec12475aa748620dd57a0aa8565ffb27bfc01201032b0561eceb.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 24 IoCs

Processes:

fd42ca44c810ec12475aa748620dd57a0aa8565ffb27bfc01201032b0561eceb.exe

description	pid	process
Token: SeIncreaseQuotaPrivilege	4916	fd42ca44c810ec12475aa748620dd57a0aa8565ffb27bfc01201032b0561eceb.exe
Token: SeSecurityPrivilege	4916	fd42ca44c810ec12475aa748620dd57a0aa8565ffb27bfc01201032b0561eceb.exe
Token: SeTakeOwnershipPrivilege	4916	fd42ca44c810ec12475aa748620dd57a0aa8565ffb27bfc01201032b0561eceb.exe
Token: SeLoadDriverPrivilege	4916	fd42ca44c810ec12475aa748620dd57a0aa8565ffb27bfc01201032b0561eceb.exe
Token: SeSystemProfilePrivilege	4916	fd42ca44c810ec12475aa748620dd57a0aa8565ffb27bfc01201032b0561eceb.exe
Token: SeSystemtimePrivilege	4916	fd42ca44c810ec12475aa748620dd57a0aa8565ffb27bfc01201032b0561eceb.exe
Token: SeProfSingleProcessPrivilege	4916	fd42ca44c810ec12475aa748620dd57a0aa8565ffb27bfc01201032b0561eceb.exe
Token: SeIncBasePriorityPrivilege	4916	fd42ca44c810ec12475aa748620dd57a0aa8565ffb27bfc01201032b0561eceb.exe
Token: SeCreatePagefilePrivilege	4916	fd42ca44c810ec12475aa748620dd57a0aa8565ffb27bfc01201032b0561eceb.exe
Token: SeBackupPrivilege	4916	fd42ca44c810ec12475aa748620dd57a0aa8565ffb27bfc01201032b0561eceb.exe
Token: SeRestorePrivilege	4916	fd42ca44c810ec12475aa748620dd57a0aa8565ffb27bfc01201032b0561eceb.exe
Token: SeShutdownPrivilege	4916	fd42ca44c810ec12475aa748620dd57a0aa8565ffb27bfc01201032b0561eceb.exe
Token: SeDebugPrivilege	4916	fd42ca44c810ec12475aa748620dd57a0aa8565ffb27bfc01201032b0561eceb.exe
Token: SeSystemEnvironmentPrivilege	4916	fd42ca44c810ec12475aa748620dd57a0aa8565ffb27bfc01201032b0561eceb.exe
Token: SeChangeNotifyPrivilege	4916	fd42ca44c810ec12475aa748620dd57a0aa8565ffb27bfc01201032b0561eceb.exe
Token: SeRemoteShutdownPrivilege	4916	fd42ca44c810ec12475aa748620dd57a0aa8565ffb27bfc01201032b0561eceb.exe
Token: SeUndockPrivilege	4916	fd42ca44c810ec12475aa748620dd57a0aa8565ffb27bfc01201032b0561eceb.exe
Token: SeManageVolumePrivilege	4916	fd42ca44c810ec12475aa748620dd57a0aa8565ffb27bfc01201032b0561eceb.exe
Token: SeImpersonatePrivilege	4916	fd42ca44c810ec12475aa748620dd57a0aa8565ffb27bfc01201032b0561eceb.exe
Token: SeCreateGlobalPrivilege	4916	fd42ca44c810ec12475aa748620dd57a0aa8565ffb27bfc01201032b0561eceb.exe
Token: 33	4916	fd42ca44c810ec12475aa748620dd57a0aa8565ffb27bfc01201032b0561eceb.exe
Token: 34	4916	fd42ca44c810ec12475aa748620dd57a0aa8565ffb27bfc01201032b0561eceb.exe
Token: 35	4916	fd42ca44c810ec12475aa748620dd57a0aa8565ffb27bfc01201032b0561eceb.exe
Token: 36	4916	fd42ca44c810ec12475aa748620dd57a0aa8565ffb27bfc01201032b0561eceb.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

fd42ca44c810ec12475aa748620dd57a0aa8565ffb27bfc01201032b0561eceb.exe

pid process

4916 fd42ca44c810ec12475aa748620dd57a0aa8565ffb27bfc01201032b0561eceb.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

fd42ca44c810ec12475aa748620dd57a0aa8565ffb27bfc01201032b0561eceb.exe

description	pid	process	target process
PID 2416 wrote to memory of 4916	2416	fd42ca44c810ec12475aa748620dd57a0aa8565ffb27bfc01201032b0561eceb.exe	fd42ca44c810ec12475aa748620dd57a0aa8565ffb27bfc01201032b0561eceb.exe
PID 2416 wrote to memory of 4916	2416	fd42ca44c810ec12475aa748620dd57a0aa8565ffb27bfc01201032b0561eceb.exe	fd42ca44c810ec12475aa748620dd57a0aa8565ffb27bfc01201032b0561eceb.exe
PID 2416 wrote to memory of 4916	2416	fd42ca44c810ec12475aa748620dd57a0aa8565ffb27bfc01201032b0561eceb.exe	fd42ca44c810ec12475aa748620dd57a0aa8565ffb27bfc01201032b0561eceb.exe
PID 2416 wrote to memory of 4916	2416	fd42ca44c810ec12475aa748620dd57a0aa8565ffb27bfc01201032b0561eceb.exe	fd42ca44c810ec12475aa748620dd57a0aa8565ffb27bfc01201032b0561eceb.exe
PID 2416 wrote to memory of 4916	2416	fd42ca44c810ec12475aa748620dd57a0aa8565ffb27bfc01201032b0561eceb.exe	fd42ca44c810ec12475aa748620dd57a0aa8565ffb27bfc01201032b0561eceb.exe
PID 2416 wrote to memory of 4916	2416	fd42ca44c810ec12475aa748620dd57a0aa8565ffb27bfc01201032b0561eceb.exe	fd42ca44c810ec12475aa748620dd57a0aa8565ffb27bfc01201032b0561eceb.exe
PID 2416 wrote to memory of 4916	2416	fd42ca44c810ec12475aa748620dd57a0aa8565ffb27bfc01201032b0561eceb.exe	fd42ca44c810ec12475aa748620dd57a0aa8565ffb27bfc01201032b0561eceb.exe
PID 2416 wrote to memory of 4916	2416	fd42ca44c810ec12475aa748620dd57a0aa8565ffb27bfc01201032b0561eceb.exe	fd42ca44c810ec12475aa748620dd57a0aa8565ffb27bfc01201032b0561eceb.exe
PID 2416 wrote to memory of 4916	2416	fd42ca44c810ec12475aa748620dd57a0aa8565ffb27bfc01201032b0561eceb.exe	fd42ca44c810ec12475aa748620dd57a0aa8565ffb27bfc01201032b0561eceb.exe
PID 2416 wrote to memory of 4916	2416	fd42ca44c810ec12475aa748620dd57a0aa8565ffb27bfc01201032b0561eceb.exe	fd42ca44c810ec12475aa748620dd57a0aa8565ffb27bfc01201032b0561eceb.exe
PID 2416 wrote to memory of 4916	2416	fd42ca44c810ec12475aa748620dd57a0aa8565ffb27bfc01201032b0561eceb.exe	fd42ca44c810ec12475aa748620dd57a0aa8565ffb27bfc01201032b0561eceb.exe
PID 2416 wrote to memory of 4916	2416	fd42ca44c810ec12475aa748620dd57a0aa8565ffb27bfc01201032b0561eceb.exe	fd42ca44c810ec12475aa748620dd57a0aa8565ffb27bfc01201032b0561eceb.exe

C:\Users\Admin\AppData\Local\Temp\fd42ca44c810ec12475aa748620dd57a0aa8565ffb27bfc01201032b0561eceb.exe
"C:\Users\Admin\AppData\Local\Temp\fd42ca44c810ec12475aa748620dd57a0aa8565ffb27bfc01201032b0561eceb.exe"
1⤵
- Adds Run key to start application
- Drops desktop.ini file(s)
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2416

C:\Users\Admin\AppData\Local\Temp\fd42ca44c810ec12475aa748620dd57a0aa8565ffb27bfc01201032b0561eceb.exe
"C:\Users\Admin\AppData\Local\Temp\fd42ca44c810ec12475aa748620dd57a0aa8565ffb27bfc01201032b0561eceb.exe"
2⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:4916

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2416-132-0x00000000750D0000-0x0000000075681000-memory.dmp

Filesize
5.7MB

Download
memory/2416-138-0x00000000750D0000-0x0000000075681000-memory.dmp

Filesize
5.7MB

Download
memory/4916-133-0x0000000000000000-mapping.dmp

Download
memory/4916-134-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/4916-135-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/4916-136-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/4916-137-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/4916-139-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download