darkcomet | 303ce30cc6ee7ac4470315f2c5b482f5a78da67aabf9040c4919028cd582c2a5

General

Target

303ce30cc6ee7ac4470315f2c5b482f5a78da67aabf9040c4919028cd582c2a5.exe
Size

2.1MB
MD5

d8f0e75804117835d69281293845569e
SHA1

5d9c27d2010d4655d17f92cca72199c81befd9af
SHA256

303ce30cc6ee7ac4470315f2c5b482f5a78da67aabf9040c4919028cd582c2a5
SHA512

2bdc2ee659e60c88b3567767e446ee3e6532c90a5d153f48a1f77a7f0da7ca45096a18950bfe87fc24d6d43f33ed17a7a661eab76ba52b4373299ad027446df8
SSDEEP

49152:GJZoQrbTFZY1iajRDbVYGFv1imxqLkfdZHuNwW7TM0yEKj:GtrbTA1Tgmd6NwW3bc

Score

10^/10

darkcomet bot persistence rat trojan

Malware Config

Extracted

Family

darkcomet

Botnet

Bot

C2

0stg4me.no-ip.biz:1604

Mutex

DC_MUTEX-Y5BANY4

Attributes

gencode
Rii6Wg6l0MXD
install
false
offline_keylogger
true
persistence
false

Signatures

Darkcomet
DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
trojan rat darkcomet

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

303ce30cc6ee7ac4470315f2c5b482f5a78da67aabf9040c4919028cd582c2a5.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	303ce30cc6ee7ac4470315f2c5b482f5a78da67aabf9040c4919028cd582c2a5.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\303ce30cc6ee7ac4470315f2c5b482f5a78da67aabf9040c4919028cd582c2a5.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\303ce30cc6ee7ac4470315f2c5b482f5a78da67aabf9040c4919028cd582c2a5.exe"	303ce30cc6ee7ac4470315f2c5b482f5a78da67aabf9040c4919028cd582c2a5.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

303ce30cc6ee7ac4470315f2c5b482f5a78da67aabf9040c4919028cd582c2a5.exe

description	pid	process	target process
PID 4844 set thread context of 444	4844	303ce30cc6ee7ac4470315f2c5b482f5a78da67aabf9040c4919028cd582c2a5.exe	303ce30cc6ee7ac4470315f2c5b482f5a78da67aabf9040c4919028cd582c2a5.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 24 IoCs

Processes:

303ce30cc6ee7ac4470315f2c5b482f5a78da67aabf9040c4919028cd582c2a5.exe

description	pid	process
Token: SeIncreaseQuotaPrivilege	444	303ce30cc6ee7ac4470315f2c5b482f5a78da67aabf9040c4919028cd582c2a5.exe
Token: SeSecurityPrivilege	444	303ce30cc6ee7ac4470315f2c5b482f5a78da67aabf9040c4919028cd582c2a5.exe
Token: SeTakeOwnershipPrivilege	444	303ce30cc6ee7ac4470315f2c5b482f5a78da67aabf9040c4919028cd582c2a5.exe
Token: SeLoadDriverPrivilege	444	303ce30cc6ee7ac4470315f2c5b482f5a78da67aabf9040c4919028cd582c2a5.exe
Token: SeSystemProfilePrivilege	444	303ce30cc6ee7ac4470315f2c5b482f5a78da67aabf9040c4919028cd582c2a5.exe
Token: SeSystemtimePrivilege	444	303ce30cc6ee7ac4470315f2c5b482f5a78da67aabf9040c4919028cd582c2a5.exe
Token: SeProfSingleProcessPrivilege	444	303ce30cc6ee7ac4470315f2c5b482f5a78da67aabf9040c4919028cd582c2a5.exe
Token: SeIncBasePriorityPrivilege	444	303ce30cc6ee7ac4470315f2c5b482f5a78da67aabf9040c4919028cd582c2a5.exe
Token: SeCreatePagefilePrivilege	444	303ce30cc6ee7ac4470315f2c5b482f5a78da67aabf9040c4919028cd582c2a5.exe
Token: SeBackupPrivilege	444	303ce30cc6ee7ac4470315f2c5b482f5a78da67aabf9040c4919028cd582c2a5.exe
Token: SeRestorePrivilege	444	303ce30cc6ee7ac4470315f2c5b482f5a78da67aabf9040c4919028cd582c2a5.exe
Token: SeShutdownPrivilege	444	303ce30cc6ee7ac4470315f2c5b482f5a78da67aabf9040c4919028cd582c2a5.exe
Token: SeDebugPrivilege	444	303ce30cc6ee7ac4470315f2c5b482f5a78da67aabf9040c4919028cd582c2a5.exe
Token: SeSystemEnvironmentPrivilege	444	303ce30cc6ee7ac4470315f2c5b482f5a78da67aabf9040c4919028cd582c2a5.exe
Token: SeChangeNotifyPrivilege	444	303ce30cc6ee7ac4470315f2c5b482f5a78da67aabf9040c4919028cd582c2a5.exe
Token: SeRemoteShutdownPrivilege	444	303ce30cc6ee7ac4470315f2c5b482f5a78da67aabf9040c4919028cd582c2a5.exe
Token: SeUndockPrivilege	444	303ce30cc6ee7ac4470315f2c5b482f5a78da67aabf9040c4919028cd582c2a5.exe
Token: SeManageVolumePrivilege	444	303ce30cc6ee7ac4470315f2c5b482f5a78da67aabf9040c4919028cd582c2a5.exe
Token: SeImpersonatePrivilege	444	303ce30cc6ee7ac4470315f2c5b482f5a78da67aabf9040c4919028cd582c2a5.exe
Token: SeCreateGlobalPrivilege	444	303ce30cc6ee7ac4470315f2c5b482f5a78da67aabf9040c4919028cd582c2a5.exe
Token: 33	444	303ce30cc6ee7ac4470315f2c5b482f5a78da67aabf9040c4919028cd582c2a5.exe
Token: 34	444	303ce30cc6ee7ac4470315f2c5b482f5a78da67aabf9040c4919028cd582c2a5.exe
Token: 35	444	303ce30cc6ee7ac4470315f2c5b482f5a78da67aabf9040c4919028cd582c2a5.exe
Token: 36	444	303ce30cc6ee7ac4470315f2c5b482f5a78da67aabf9040c4919028cd582c2a5.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

303ce30cc6ee7ac4470315f2c5b482f5a78da67aabf9040c4919028cd582c2a5.exe

pid process

4844 303ce30cc6ee7ac4470315f2c5b482f5a78da67aabf9040c4919028cd582c2a5.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

303ce30cc6ee7ac4470315f2c5b482f5a78da67aabf9040c4919028cd582c2a5.exe

pid process

444 303ce30cc6ee7ac4470315f2c5b482f5a78da67aabf9040c4919028cd582c2a5.exe

pid	process
4844	303ce30cc6ee7ac4470315f2c5b482f5a78da67aabf9040c4919028cd582c2a5.exe

pid	process
444	303ce30cc6ee7ac4470315f2c5b482f5a78da67aabf9040c4919028cd582c2a5.exe

Suspicious use of WriteProcessMemory 5 IoCs

Processes:

303ce30cc6ee7ac4470315f2c5b482f5a78da67aabf9040c4919028cd582c2a5.exe

description	pid	process	target process
PID 4844 wrote to memory of 444	4844	303ce30cc6ee7ac4470315f2c5b482f5a78da67aabf9040c4919028cd582c2a5.exe	303ce30cc6ee7ac4470315f2c5b482f5a78da67aabf9040c4919028cd582c2a5.exe
PID 4844 wrote to memory of 444	4844	303ce30cc6ee7ac4470315f2c5b482f5a78da67aabf9040c4919028cd582c2a5.exe	303ce30cc6ee7ac4470315f2c5b482f5a78da67aabf9040c4919028cd582c2a5.exe
PID 4844 wrote to memory of 444	4844	303ce30cc6ee7ac4470315f2c5b482f5a78da67aabf9040c4919028cd582c2a5.exe	303ce30cc6ee7ac4470315f2c5b482f5a78da67aabf9040c4919028cd582c2a5.exe
PID 4844 wrote to memory of 444	4844	303ce30cc6ee7ac4470315f2c5b482f5a78da67aabf9040c4919028cd582c2a5.exe	303ce30cc6ee7ac4470315f2c5b482f5a78da67aabf9040c4919028cd582c2a5.exe
PID 4844 wrote to memory of 444	4844	303ce30cc6ee7ac4470315f2c5b482f5a78da67aabf9040c4919028cd582c2a5.exe	303ce30cc6ee7ac4470315f2c5b482f5a78da67aabf9040c4919028cd582c2a5.exe

C:\Users\Admin\AppData\Local\Temp\303ce30cc6ee7ac4470315f2c5b482f5a78da67aabf9040c4919028cd582c2a5.exe
"C:\Users\Admin\AppData\Local\Temp\303ce30cc6ee7ac4470315f2c5b482f5a78da67aabf9040c4919028cd582c2a5.exe"
1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:4844

C:\Users\Admin\AppData\Local\Temp\303ce30cc6ee7ac4470315f2c5b482f5a78da67aabf9040c4919028cd582c2a5.exe
C:\Windows\SysWOW64\svchost.exe
2⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:444

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/444-132-0x0000000000000000-mapping.dmp

Download
memory/444-133-0x00000000000D0000-0x0000000000182000-memory.dmp

Filesize
712KB

Download
memory/444-134-0x00000000000D0000-0x0000000000182000-memory.dmp

Filesize
712KB

Download
memory/444-135-0x00000000000D0000-0x0000000000182000-memory.dmp

Filesize
712KB

Download
memory/444-136-0x00000000000D0000-0x0000000000182000-memory.dmp

Filesize
712KB

Download
memory/444-137-0x00000000000D0000-0x0000000000182000-memory.dmp

Filesize
712KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads