darkcomet | 94bd3c56d173ce17903d5ac74459e4cfc641ffcc0c84f5669a1ea1e873910618

General

Target

94bd3c56d173ce17903d5ac74459e4cfc641ffcc0c84f5669a1ea1e873910618.exe
Size

758KB
MD5

97c9689e3b5ea8f15fbcf2919038e02b
SHA1

2aa3bd0c36cc22de727f32e51b0098e9283dc2e8
SHA256

94bd3c56d173ce17903d5ac74459e4cfc641ffcc0c84f5669a1ea1e873910618
SHA512

c859a61666ac338802217709f26a24f3ea76f96e7a67e5b95b0e4a0fd143d09b6a9d9b3948c1eb0ae8325aff4c8e8a86176950d5c2b20b34c0b6b01ac95725ac
SSDEEP

12288:76lOwG2qPnAknEHZCX2N0K4AivtYRiSVXWMMkNV4mAPKmT9YCBBJFihR0ltqeIi:QOr2qPXUCX2NlR6uRiqWbAVPAPZYCBzz

Score

10^/10

darkcomet guest16 rat trojan

Malware Config

Extracted

Family

darkcomet

Botnet

Guest16

C2

127.0.0.1:1604

Mutex

DC_MUTEX-R3938ZJ

Attributes

gencode
pjduwzHB2Fki
install
false
offline_keylogger
true
persistence
false

Signatures

Darkcomet
DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
trojan rat darkcomet

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1028 set thread context of 1444	1028	94bd3c56d173ce17903d5ac74459e4cfc641ffcc0c84f5669a1ea1e873910618.exe	28

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 24 IoCs

description	pid	Process
Token: SeDebugPrivilege	1028	94bd3c56d173ce17903d5ac74459e4cfc641ffcc0c84f5669a1ea1e873910618.exe
Token: SeIncreaseQuotaPrivilege	1444	94bd3c56d173ce17903d5ac74459e4cfc641ffcc0c84f5669a1ea1e873910618.exe
Token: SeSecurityPrivilege	1444	94bd3c56d173ce17903d5ac74459e4cfc641ffcc0c84f5669a1ea1e873910618.exe
Token: SeTakeOwnershipPrivilege	1444	94bd3c56d173ce17903d5ac74459e4cfc641ffcc0c84f5669a1ea1e873910618.exe
Token: SeLoadDriverPrivilege	1444	94bd3c56d173ce17903d5ac74459e4cfc641ffcc0c84f5669a1ea1e873910618.exe
Token: SeSystemProfilePrivilege	1444	94bd3c56d173ce17903d5ac74459e4cfc641ffcc0c84f5669a1ea1e873910618.exe
Token: SeSystemtimePrivilege	1444	94bd3c56d173ce17903d5ac74459e4cfc641ffcc0c84f5669a1ea1e873910618.exe
Token: SeProfSingleProcessPrivilege	1444	94bd3c56d173ce17903d5ac74459e4cfc641ffcc0c84f5669a1ea1e873910618.exe
Token: SeIncBasePriorityPrivilege	1444	94bd3c56d173ce17903d5ac74459e4cfc641ffcc0c84f5669a1ea1e873910618.exe
Token: SeCreatePagefilePrivilege	1444	94bd3c56d173ce17903d5ac74459e4cfc641ffcc0c84f5669a1ea1e873910618.exe
Token: SeBackupPrivilege	1444	94bd3c56d173ce17903d5ac74459e4cfc641ffcc0c84f5669a1ea1e873910618.exe
Token: SeRestorePrivilege	1444	94bd3c56d173ce17903d5ac74459e4cfc641ffcc0c84f5669a1ea1e873910618.exe
Token: SeShutdownPrivilege	1444	94bd3c56d173ce17903d5ac74459e4cfc641ffcc0c84f5669a1ea1e873910618.exe
Token: SeDebugPrivilege	1444	94bd3c56d173ce17903d5ac74459e4cfc641ffcc0c84f5669a1ea1e873910618.exe
Token: SeSystemEnvironmentPrivilege	1444	94bd3c56d173ce17903d5ac74459e4cfc641ffcc0c84f5669a1ea1e873910618.exe
Token: SeChangeNotifyPrivilege	1444	94bd3c56d173ce17903d5ac74459e4cfc641ffcc0c84f5669a1ea1e873910618.exe
Token: SeRemoteShutdownPrivilege	1444	94bd3c56d173ce17903d5ac74459e4cfc641ffcc0c84f5669a1ea1e873910618.exe
Token: SeUndockPrivilege	1444	94bd3c56d173ce17903d5ac74459e4cfc641ffcc0c84f5669a1ea1e873910618.exe
Token: SeManageVolumePrivilege	1444	94bd3c56d173ce17903d5ac74459e4cfc641ffcc0c84f5669a1ea1e873910618.exe
Token: SeImpersonatePrivilege	1444	94bd3c56d173ce17903d5ac74459e4cfc641ffcc0c84f5669a1ea1e873910618.exe
Token: SeCreateGlobalPrivilege	1444	94bd3c56d173ce17903d5ac74459e4cfc641ffcc0c84f5669a1ea1e873910618.exe
Token: 33	1444	94bd3c56d173ce17903d5ac74459e4cfc641ffcc0c84f5669a1ea1e873910618.exe
Token: 34	1444	94bd3c56d173ce17903d5ac74459e4cfc641ffcc0c84f5669a1ea1e873910618.exe
Token: 35	1444	94bd3c56d173ce17903d5ac74459e4cfc641ffcc0c84f5669a1ea1e873910618.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1444	94bd3c56d173ce17903d5ac74459e4cfc641ffcc0c84f5669a1ea1e873910618.exe

Suspicious use of WriteProcessMemory 17 IoCs

description	pid	Process	procid_target
PID 1028 wrote to memory of 1320	1028	94bd3c56d173ce17903d5ac74459e4cfc641ffcc0c84f5669a1ea1e873910618.exe	27
PID 1028 wrote to memory of 1320	1028	94bd3c56d173ce17903d5ac74459e4cfc641ffcc0c84f5669a1ea1e873910618.exe	27
PID 1028 wrote to memory of 1320	1028	94bd3c56d173ce17903d5ac74459e4cfc641ffcc0c84f5669a1ea1e873910618.exe	27
PID 1028 wrote to memory of 1320	1028	94bd3c56d173ce17903d5ac74459e4cfc641ffcc0c84f5669a1ea1e873910618.exe	27
PID 1028 wrote to memory of 1444	1028	94bd3c56d173ce17903d5ac74459e4cfc641ffcc0c84f5669a1ea1e873910618.exe	28
PID 1028 wrote to memory of 1444	1028	94bd3c56d173ce17903d5ac74459e4cfc641ffcc0c84f5669a1ea1e873910618.exe	28
PID 1028 wrote to memory of 1444	1028	94bd3c56d173ce17903d5ac74459e4cfc641ffcc0c84f5669a1ea1e873910618.exe	28
PID 1028 wrote to memory of 1444	1028	94bd3c56d173ce17903d5ac74459e4cfc641ffcc0c84f5669a1ea1e873910618.exe	28
PID 1028 wrote to memory of 1444	1028	94bd3c56d173ce17903d5ac74459e4cfc641ffcc0c84f5669a1ea1e873910618.exe	28
PID 1028 wrote to memory of 1444	1028	94bd3c56d173ce17903d5ac74459e4cfc641ffcc0c84f5669a1ea1e873910618.exe	28
PID 1028 wrote to memory of 1444	1028	94bd3c56d173ce17903d5ac74459e4cfc641ffcc0c84f5669a1ea1e873910618.exe	28
PID 1028 wrote to memory of 1444	1028	94bd3c56d173ce17903d5ac74459e4cfc641ffcc0c84f5669a1ea1e873910618.exe	28
PID 1028 wrote to memory of 1444	1028	94bd3c56d173ce17903d5ac74459e4cfc641ffcc0c84f5669a1ea1e873910618.exe	28
PID 1028 wrote to memory of 1444	1028	94bd3c56d173ce17903d5ac74459e4cfc641ffcc0c84f5669a1ea1e873910618.exe	28
PID 1028 wrote to memory of 1444	1028	94bd3c56d173ce17903d5ac74459e4cfc641ffcc0c84f5669a1ea1e873910618.exe	28
PID 1028 wrote to memory of 1444	1028	94bd3c56d173ce17903d5ac74459e4cfc641ffcc0c84f5669a1ea1e873910618.exe	28
PID 1028 wrote to memory of 1444	1028	94bd3c56d173ce17903d5ac74459e4cfc641ffcc0c84f5669a1ea1e873910618.exe	28

C:\Users\Admin\AppData\Local\Temp\94bd3c56d173ce17903d5ac74459e4cfc641ffcc0c84f5669a1ea1e873910618.exe
"C:\Users\Admin\AppData\Local\Temp\94bd3c56d173ce17903d5ac74459e4cfc641ffcc0c84f5669a1ea1e873910618.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1028
- C:\Users\Admin\AppData\Local\Temp\94bd3c56d173ce17903d5ac74459e4cfc641ffcc0c84f5669a1ea1e873910618.exe
  94bd3c56d173ce17903d5ac74459e4cfc641ffcc0c84f5669a1ea1e873910618.exe
  2⤵
  PID:1320
- C:\Users\Admin\AppData\Local\Temp\94bd3c56d173ce17903d5ac74459e4cfc641ffcc0c84f5669a1ea1e873910618.exe
  94bd3c56d173ce17903d5ac74459e4cfc641ffcc0c84f5669a1ea1e873910618.exe
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:1444

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1028-54-0x0000000075071000-0x0000000075073000-memory.dmp

Filesize
8KB

Download
memory/1028-77-0x0000000073F70000-0x000000007451B000-memory.dmp

Filesize
5.7MB

Download
memory/1028-73-0x0000000073F70000-0x000000007451B000-memory.dmp

Filesize
5.7MB

Download
memory/1444-60-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/1444-70-0x000000000048F888-mapping.dmp

Download
memory/1444-62-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/1444-64-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/1444-65-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/1444-67-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/1444-69-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/1444-58-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/1444-71-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/1444-56-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/1444-74-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/1444-75-0x000000000048F000-0x0000000000491000-memory.dmp

Filesize
8KB

Download
memory/1444-76-0x0000000000401000-0x000000000048F000-memory.dmp

Filesize
568KB

Download
memory/1444-55-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download

Analysis

Sharing