darkcomet | 303ce30cc6ee7ac4470315f2c5b482f5a78da67aabf9040c4919028cd582c2a5

General

Target

303ce30cc6ee7ac4470315f2c5b482f5a78da67aabf9040c4919028cd582c2a5.exe
Size

2.1MB
MD5

d8f0e75804117835d69281293845569e
SHA1

5d9c27d2010d4655d17f92cca72199c81befd9af
SHA256

303ce30cc6ee7ac4470315f2c5b482f5a78da67aabf9040c4919028cd582c2a5
SHA512

2bdc2ee659e60c88b3567767e446ee3e6532c90a5d153f48a1f77a7f0da7ca45096a18950bfe87fc24d6d43f33ed17a7a661eab76ba52b4373299ad027446df8
SSDEEP

49152:GJZoQrbTFZY1iajRDbVYGFv1imxqLkfdZHuNwW7TM0yEKj:GtrbTA1Tgmd6NwW3bc

Score

10^/10

darkcomet bot persistence rat trojan

Malware Config

Extracted

Family

darkcomet

Botnet

Bot

C2

0stg4me.no-ip.biz:1604

Mutex

DC_MUTEX-Y5BANY4

Attributes

gencode
Rii6Wg6l0MXD
install
false
offline_keylogger
true
persistence
false

Signatures

Darkcomet
DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
trojan rat darkcomet

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

303ce30cc6ee7ac4470315f2c5b482f5a78da67aabf9040c4919028cd582c2a5.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\303ce30cc6ee7ac4470315f2c5b482f5a78da67aabf9040c4919028cd582c2a5.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\303ce30cc6ee7ac4470315f2c5b482f5a78da67aabf9040c4919028cd582c2a5.exe"	303ce30cc6ee7ac4470315f2c5b482f5a78da67aabf9040c4919028cd582c2a5.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	303ce30cc6ee7ac4470315f2c5b482f5a78da67aabf9040c4919028cd582c2a5.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

303ce30cc6ee7ac4470315f2c5b482f5a78da67aabf9040c4919028cd582c2a5.exe

description	pid	process	target process
PID 576 set thread context of 1344	576	303ce30cc6ee7ac4470315f2c5b482f5a78da67aabf9040c4919028cd582c2a5.exe	303ce30cc6ee7ac4470315f2c5b482f5a78da67aabf9040c4919028cd582c2a5.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 23 IoCs

Processes:

303ce30cc6ee7ac4470315f2c5b482f5a78da67aabf9040c4919028cd582c2a5.exe

description	pid	process
Token: SeIncreaseQuotaPrivilege	1344	303ce30cc6ee7ac4470315f2c5b482f5a78da67aabf9040c4919028cd582c2a5.exe
Token: SeSecurityPrivilege	1344	303ce30cc6ee7ac4470315f2c5b482f5a78da67aabf9040c4919028cd582c2a5.exe
Token: SeTakeOwnershipPrivilege	1344	303ce30cc6ee7ac4470315f2c5b482f5a78da67aabf9040c4919028cd582c2a5.exe
Token: SeLoadDriverPrivilege	1344	303ce30cc6ee7ac4470315f2c5b482f5a78da67aabf9040c4919028cd582c2a5.exe
Token: SeSystemProfilePrivilege	1344	303ce30cc6ee7ac4470315f2c5b482f5a78da67aabf9040c4919028cd582c2a5.exe
Token: SeSystemtimePrivilege	1344	303ce30cc6ee7ac4470315f2c5b482f5a78da67aabf9040c4919028cd582c2a5.exe
Token: SeProfSingleProcessPrivilege	1344	303ce30cc6ee7ac4470315f2c5b482f5a78da67aabf9040c4919028cd582c2a5.exe
Token: SeIncBasePriorityPrivilege	1344	303ce30cc6ee7ac4470315f2c5b482f5a78da67aabf9040c4919028cd582c2a5.exe
Token: SeCreatePagefilePrivilege	1344	303ce30cc6ee7ac4470315f2c5b482f5a78da67aabf9040c4919028cd582c2a5.exe
Token: SeBackupPrivilege	1344	303ce30cc6ee7ac4470315f2c5b482f5a78da67aabf9040c4919028cd582c2a5.exe
Token: SeRestorePrivilege	1344	303ce30cc6ee7ac4470315f2c5b482f5a78da67aabf9040c4919028cd582c2a5.exe
Token: SeShutdownPrivilege	1344	303ce30cc6ee7ac4470315f2c5b482f5a78da67aabf9040c4919028cd582c2a5.exe
Token: SeDebugPrivilege	1344	303ce30cc6ee7ac4470315f2c5b482f5a78da67aabf9040c4919028cd582c2a5.exe
Token: SeSystemEnvironmentPrivilege	1344	303ce30cc6ee7ac4470315f2c5b482f5a78da67aabf9040c4919028cd582c2a5.exe
Token: SeChangeNotifyPrivilege	1344	303ce30cc6ee7ac4470315f2c5b482f5a78da67aabf9040c4919028cd582c2a5.exe
Token: SeRemoteShutdownPrivilege	1344	303ce30cc6ee7ac4470315f2c5b482f5a78da67aabf9040c4919028cd582c2a5.exe
Token: SeUndockPrivilege	1344	303ce30cc6ee7ac4470315f2c5b482f5a78da67aabf9040c4919028cd582c2a5.exe
Token: SeManageVolumePrivilege	1344	303ce30cc6ee7ac4470315f2c5b482f5a78da67aabf9040c4919028cd582c2a5.exe
Token: SeImpersonatePrivilege	1344	303ce30cc6ee7ac4470315f2c5b482f5a78da67aabf9040c4919028cd582c2a5.exe
Token: SeCreateGlobalPrivilege	1344	303ce30cc6ee7ac4470315f2c5b482f5a78da67aabf9040c4919028cd582c2a5.exe
Token: 33	1344	303ce30cc6ee7ac4470315f2c5b482f5a78da67aabf9040c4919028cd582c2a5.exe
Token: 34	1344	303ce30cc6ee7ac4470315f2c5b482f5a78da67aabf9040c4919028cd582c2a5.exe
Token: 35	1344	303ce30cc6ee7ac4470315f2c5b482f5a78da67aabf9040c4919028cd582c2a5.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

303ce30cc6ee7ac4470315f2c5b482f5a78da67aabf9040c4919028cd582c2a5.exe

pid process

576 303ce30cc6ee7ac4470315f2c5b482f5a78da67aabf9040c4919028cd582c2a5.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

303ce30cc6ee7ac4470315f2c5b482f5a78da67aabf9040c4919028cd582c2a5.exe

pid process

1344 303ce30cc6ee7ac4470315f2c5b482f5a78da67aabf9040c4919028cd582c2a5.exe

pid	process
576	303ce30cc6ee7ac4470315f2c5b482f5a78da67aabf9040c4919028cd582c2a5.exe

pid	process
1344	303ce30cc6ee7ac4470315f2c5b482f5a78da67aabf9040c4919028cd582c2a5.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

303ce30cc6ee7ac4470315f2c5b482f5a78da67aabf9040c4919028cd582c2a5.exe

description	pid	process	target process
PID 576 wrote to memory of 1344	576	303ce30cc6ee7ac4470315f2c5b482f5a78da67aabf9040c4919028cd582c2a5.exe	303ce30cc6ee7ac4470315f2c5b482f5a78da67aabf9040c4919028cd582c2a5.exe
PID 576 wrote to memory of 1344	576	303ce30cc6ee7ac4470315f2c5b482f5a78da67aabf9040c4919028cd582c2a5.exe	303ce30cc6ee7ac4470315f2c5b482f5a78da67aabf9040c4919028cd582c2a5.exe
PID 576 wrote to memory of 1344	576	303ce30cc6ee7ac4470315f2c5b482f5a78da67aabf9040c4919028cd582c2a5.exe	303ce30cc6ee7ac4470315f2c5b482f5a78da67aabf9040c4919028cd582c2a5.exe
PID 576 wrote to memory of 1344	576	303ce30cc6ee7ac4470315f2c5b482f5a78da67aabf9040c4919028cd582c2a5.exe	303ce30cc6ee7ac4470315f2c5b482f5a78da67aabf9040c4919028cd582c2a5.exe
PID 576 wrote to memory of 1344	576	303ce30cc6ee7ac4470315f2c5b482f5a78da67aabf9040c4919028cd582c2a5.exe	303ce30cc6ee7ac4470315f2c5b482f5a78da67aabf9040c4919028cd582c2a5.exe
PID 576 wrote to memory of 1344	576	303ce30cc6ee7ac4470315f2c5b482f5a78da67aabf9040c4919028cd582c2a5.exe	303ce30cc6ee7ac4470315f2c5b482f5a78da67aabf9040c4919028cd582c2a5.exe

C:\Users\Admin\AppData\Local\Temp\303ce30cc6ee7ac4470315f2c5b482f5a78da67aabf9040c4919028cd582c2a5.exe
"C:\Users\Admin\AppData\Local\Temp\303ce30cc6ee7ac4470315f2c5b482f5a78da67aabf9040c4919028cd582c2a5.exe"
1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:576

C:\Users\Admin\AppData\Local\Temp\303ce30cc6ee7ac4470315f2c5b482f5a78da67aabf9040c4919028cd582c2a5.exe
C:\Windows\SysWOW64\svchost.exe
2⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1344

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/576-54-0x0000000075F21000-0x0000000075F23000-memory.dmp

Filesize
8KB

Download
memory/1344-55-0x00000000000C0000-0x0000000000172000-memory.dmp

Filesize
712KB

Download
memory/1344-57-0x00000000000C0000-0x0000000000172000-memory.dmp

Filesize
712KB

Download
memory/1344-58-0x000000000014F888-mapping.dmp

Download
memory/1344-59-0x00000000000C0000-0x0000000000172000-memory.dmp

Filesize
712KB

Download
memory/1344-61-0x00000000000C0000-0x0000000000172000-memory.dmp

Filesize
712KB

Download
memory/1344-62-0x00000000000C0000-0x0000000000172000-memory.dmp

Filesize
712KB

Download
memory/1344-63-0x00000000000C0000-0x0000000000172000-memory.dmp

Filesize
712KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads