darkcomet | dbc64acb1e5cb8c28888628b78cdde70c8d9240262c996cb459b20e3baa27c21

General

Target

dbc64acb1e5cb8c28888628b78cdde70c8d9240262c996cb459b20e3baa27c21.exe
Size

2.0MB
MD5

3f757cae8a5d105dc6592cf4583917c9
SHA1

fde460ac17b42158205463f766c60f5e26f24fa7
SHA256

dbc64acb1e5cb8c28888628b78cdde70c8d9240262c996cb459b20e3baa27c21
SHA512

7c75ce701f2b0816009813ede26ba3f628a9a0c3f9e18b2dc30dff46c0f43f2c67e545e74570ab90b0b1e2391d634fa5f27461eeec073fd0d9a709b15c765df1
SSDEEP

24576:RaHM+6Corjmny5QLR7wKaHnCMjORymu7Xmg7FT2bFZ1xuVVjfFoynPaVBUR8f+kx:R1+qj55QLR16zt2g7FarQDgok30o

Score

10^/10

darkcomet guest16_min rat trojan

Malware Config

Extracted

Family

darkcomet

Botnet

Guest16_min

C2

robmob.no-ip.info:1337

Mutex

DCMIN_MUTEX-A2P00UL

Attributes

gencode
hDdVuHJJXcc2
install
false
offline_keylogger
true
persistence
false

Signatures

Darkcomet
DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
trojan rat darkcomet

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 812 set thread context of 4080	812	dbc64acb1e5cb8c28888628b78cdde70c8d9240262c996cb459b20e3baa27c21.exe	84

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 24 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	4080	dbc64acb1e5cb8c28888628b78cdde70c8d9240262c996cb459b20e3baa27c21.exe
Token: SeSecurityPrivilege	4080	dbc64acb1e5cb8c28888628b78cdde70c8d9240262c996cb459b20e3baa27c21.exe
Token: SeTakeOwnershipPrivilege	4080	dbc64acb1e5cb8c28888628b78cdde70c8d9240262c996cb459b20e3baa27c21.exe
Token: SeLoadDriverPrivilege	4080	dbc64acb1e5cb8c28888628b78cdde70c8d9240262c996cb459b20e3baa27c21.exe
Token: SeSystemProfilePrivilege	4080	dbc64acb1e5cb8c28888628b78cdde70c8d9240262c996cb459b20e3baa27c21.exe
Token: SeSystemtimePrivilege	4080	dbc64acb1e5cb8c28888628b78cdde70c8d9240262c996cb459b20e3baa27c21.exe
Token: SeProfSingleProcessPrivilege	4080	dbc64acb1e5cb8c28888628b78cdde70c8d9240262c996cb459b20e3baa27c21.exe
Token: SeIncBasePriorityPrivilege	4080	dbc64acb1e5cb8c28888628b78cdde70c8d9240262c996cb459b20e3baa27c21.exe
Token: SeCreatePagefilePrivilege	4080	dbc64acb1e5cb8c28888628b78cdde70c8d9240262c996cb459b20e3baa27c21.exe
Token: SeBackupPrivilege	4080	dbc64acb1e5cb8c28888628b78cdde70c8d9240262c996cb459b20e3baa27c21.exe
Token: SeRestorePrivilege	4080	dbc64acb1e5cb8c28888628b78cdde70c8d9240262c996cb459b20e3baa27c21.exe
Token: SeShutdownPrivilege	4080	dbc64acb1e5cb8c28888628b78cdde70c8d9240262c996cb459b20e3baa27c21.exe
Token: SeDebugPrivilege	4080	dbc64acb1e5cb8c28888628b78cdde70c8d9240262c996cb459b20e3baa27c21.exe
Token: SeSystemEnvironmentPrivilege	4080	dbc64acb1e5cb8c28888628b78cdde70c8d9240262c996cb459b20e3baa27c21.exe
Token: SeChangeNotifyPrivilege	4080	dbc64acb1e5cb8c28888628b78cdde70c8d9240262c996cb459b20e3baa27c21.exe
Token: SeRemoteShutdownPrivilege	4080	dbc64acb1e5cb8c28888628b78cdde70c8d9240262c996cb459b20e3baa27c21.exe
Token: SeUndockPrivilege	4080	dbc64acb1e5cb8c28888628b78cdde70c8d9240262c996cb459b20e3baa27c21.exe
Token: SeManageVolumePrivilege	4080	dbc64acb1e5cb8c28888628b78cdde70c8d9240262c996cb459b20e3baa27c21.exe
Token: SeImpersonatePrivilege	4080	dbc64acb1e5cb8c28888628b78cdde70c8d9240262c996cb459b20e3baa27c21.exe
Token: SeCreateGlobalPrivilege	4080	dbc64acb1e5cb8c28888628b78cdde70c8d9240262c996cb459b20e3baa27c21.exe
Token: 33	4080	dbc64acb1e5cb8c28888628b78cdde70c8d9240262c996cb459b20e3baa27c21.exe
Token: 34	4080	dbc64acb1e5cb8c28888628b78cdde70c8d9240262c996cb459b20e3baa27c21.exe
Token: 35	4080	dbc64acb1e5cb8c28888628b78cdde70c8d9240262c996cb459b20e3baa27c21.exe
Token: 36	4080	dbc64acb1e5cb8c28888628b78cdde70c8d9240262c996cb459b20e3baa27c21.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4080	dbc64acb1e5cb8c28888628b78cdde70c8d9240262c996cb459b20e3baa27c21.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 812 wrote to memory of 4080	812	dbc64acb1e5cb8c28888628b78cdde70c8d9240262c996cb459b20e3baa27c21.exe	84
PID 812 wrote to memory of 4080	812	dbc64acb1e5cb8c28888628b78cdde70c8d9240262c996cb459b20e3baa27c21.exe	84
PID 812 wrote to memory of 4080	812	dbc64acb1e5cb8c28888628b78cdde70c8d9240262c996cb459b20e3baa27c21.exe	84
PID 812 wrote to memory of 4080	812	dbc64acb1e5cb8c28888628b78cdde70c8d9240262c996cb459b20e3baa27c21.exe	84
PID 812 wrote to memory of 4080	812	dbc64acb1e5cb8c28888628b78cdde70c8d9240262c996cb459b20e3baa27c21.exe	84
PID 812 wrote to memory of 4080	812	dbc64acb1e5cb8c28888628b78cdde70c8d9240262c996cb459b20e3baa27c21.exe	84
PID 812 wrote to memory of 4080	812	dbc64acb1e5cb8c28888628b78cdde70c8d9240262c996cb459b20e3baa27c21.exe	84
PID 812 wrote to memory of 4080	812	dbc64acb1e5cb8c28888628b78cdde70c8d9240262c996cb459b20e3baa27c21.exe	84
PID 812 wrote to memory of 4080	812	dbc64acb1e5cb8c28888628b78cdde70c8d9240262c996cb459b20e3baa27c21.exe	84
PID 812 wrote to memory of 4080	812	dbc64acb1e5cb8c28888628b78cdde70c8d9240262c996cb459b20e3baa27c21.exe	84
PID 812 wrote to memory of 4080	812	dbc64acb1e5cb8c28888628b78cdde70c8d9240262c996cb459b20e3baa27c21.exe	84
PID 812 wrote to memory of 4080	812	dbc64acb1e5cb8c28888628b78cdde70c8d9240262c996cb459b20e3baa27c21.exe	84
PID 812 wrote to memory of 4080	812	dbc64acb1e5cb8c28888628b78cdde70c8d9240262c996cb459b20e3baa27c21.exe	84
PID 812 wrote to memory of 4080	812	dbc64acb1e5cb8c28888628b78cdde70c8d9240262c996cb459b20e3baa27c21.exe	84

C:\Users\Admin\AppData\Local\Temp\dbc64acb1e5cb8c28888628b78cdde70c8d9240262c996cb459b20e3baa27c21.exe
"C:\Users\Admin\AppData\Local\Temp\dbc64acb1e5cb8c28888628b78cdde70c8d9240262c996cb459b20e3baa27c21.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:812
- C:\Users\Admin\AppData\Local\Temp\dbc64acb1e5cb8c28888628b78cdde70c8d9240262c996cb459b20e3baa27c21.exe
  "C:\Users\Admin\AppData\Local\Temp\dbc64acb1e5cb8c28888628b78cdde70c8d9240262c996cb459b20e3baa27c21.exe"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:4080

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4080-133-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/4080-134-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/4080-135-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/4080-136-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/4080-137-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download

Analysis

Sharing