darkcomet | f386b6a1a42d356dc069ae5aa5cf827687b82902ad4cd2cbfc33fad86e32c86b

General

Target

f386b6a1a42d356dc069ae5aa5cf827687b82902ad4cd2cbfc33fad86e32c86b.exe
Size

661KB
MD5

6ea15a00eee5168a3b36a60833460951
SHA1

fd9698312c7564c08420f27f4936cfc65e8580fc
SHA256

f386b6a1a42d356dc069ae5aa5cf827687b82902ad4cd2cbfc33fad86e32c86b
SHA512

8d4d7d18bf980a41ecdaeaed7706d75e1333eddd443cb5f0226a029b46a19865c462bd8785d2d9efe47c387f1122148a748533bcfe37b71234ef8e94a6df47a9
SSDEEP

12288:IXhpvNWw276S/DuoeFcfbmiJ99VPhYR5MTSHvLenELrWv1lZw4JuMkMh/fy452Uf:unAw2WWeFcfbP9VPSPMTSPL/rWvzq4Jv

Score

10^/10

darkcomet zombie persistence rat trojan

Malware Config

Extracted

Family

darkcomet

Botnet

Zombie

C2

nahasamapetilan.zapto.org:5000

nahasamapetilan.zapto.org:5001

nahasamapetilan.zapto.org:5002

nahasamapetilan.zapto.org:5003

nahasamapetilan.zapto.org:5004

nahasamapetilan.zapto.org:5005

Mutex

DC_MUTEX-NHLL5VX

Attributes

InstallPath
SounDrivers\WinSounds.exe
gencode
UqEe6BPFAJwd
install
true
offline_keylogger
true
password
mohamed
persistence
true
reg_key
SoundDrivers

Signatures

Darkcomet
DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
trojan rat darkcomet

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1004

Modify Registry

T1112

Processes:

f386b6a1a42d356dc069ae5aa5cf827687b82902ad4cd2cbfc33fad86e32c86b.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Users\\Admin\\AppData\\Roaming\\SounDrivers\\WinSounds.exe"	f386b6a1a42d356dc069ae5aa5cf827687b82902ad4cd2cbfc33fad86e32c86b.exe

Executes dropped EXE 1 IoCs

Processes:

WinSounds.exe

pid process

4756 WinSounds.exe

pid	process
4756	WinSounds.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

f386b6a1a42d356dc069ae5aa5cf827687b82902ad4cd2cbfc33fad86e32c86b.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation	f386b6a1a42d356dc069ae5aa5cf827687b82902ad4cd2cbfc33fad86e32c86b.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

f386b6a1a42d356dc069ae5aa5cf827687b82902ad4cd2cbfc33fad86e32c86b.exeWinSounds.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SoundDrivers = "C:\\Users\\Admin\\AppData\\Roaming\\SounDrivers\\WinSounds.exe"	f386b6a1a42d356dc069ae5aa5cf827687b82902ad4cd2cbfc33fad86e32c86b.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SoundDrivers = "C:\\Users\\Admin\\AppData\\Roaming\\SounDrivers\\WinSounds.exe"	WinSounds.exe

Drops file in System32 directory 2 IoCs

Processes:

svchost.exe

description	ioc	process
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\InstallService\{ED679C28-04B1-48C4-AD8F-943B40E469DB}.catalogItem	svchost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\InstallService\{8847B125-E3A0-4F09-8044-58093ABFEF3F}.catalogItem	svchost.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

svchost.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	svchost.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

svchost.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	svchost.exe

Suspicious use of AdjustPrivilegeToken 48 IoCs

Processes:

f386b6a1a42d356dc069ae5aa5cf827687b82902ad4cd2cbfc33fad86e32c86b.exeWinSounds.exe

description	pid	process
Token: SeIncreaseQuotaPrivilege	1404	f386b6a1a42d356dc069ae5aa5cf827687b82902ad4cd2cbfc33fad86e32c86b.exe
Token: SeSecurityPrivilege	1404	f386b6a1a42d356dc069ae5aa5cf827687b82902ad4cd2cbfc33fad86e32c86b.exe
Token: SeTakeOwnershipPrivilege	1404	f386b6a1a42d356dc069ae5aa5cf827687b82902ad4cd2cbfc33fad86e32c86b.exe
Token: SeLoadDriverPrivilege	1404	f386b6a1a42d356dc069ae5aa5cf827687b82902ad4cd2cbfc33fad86e32c86b.exe
Token: SeSystemProfilePrivilege	1404	f386b6a1a42d356dc069ae5aa5cf827687b82902ad4cd2cbfc33fad86e32c86b.exe
Token: SeSystemtimePrivilege	1404	f386b6a1a42d356dc069ae5aa5cf827687b82902ad4cd2cbfc33fad86e32c86b.exe
Token: SeProfSingleProcessPrivilege	1404	f386b6a1a42d356dc069ae5aa5cf827687b82902ad4cd2cbfc33fad86e32c86b.exe
Token: SeIncBasePriorityPrivilege	1404	f386b6a1a42d356dc069ae5aa5cf827687b82902ad4cd2cbfc33fad86e32c86b.exe
Token: SeCreatePagefilePrivilege	1404	f386b6a1a42d356dc069ae5aa5cf827687b82902ad4cd2cbfc33fad86e32c86b.exe
Token: SeBackupPrivilege	1404	f386b6a1a42d356dc069ae5aa5cf827687b82902ad4cd2cbfc33fad86e32c86b.exe
Token: SeRestorePrivilege	1404	f386b6a1a42d356dc069ae5aa5cf827687b82902ad4cd2cbfc33fad86e32c86b.exe
Token: SeShutdownPrivilege	1404	f386b6a1a42d356dc069ae5aa5cf827687b82902ad4cd2cbfc33fad86e32c86b.exe
Token: SeDebugPrivilege	1404	f386b6a1a42d356dc069ae5aa5cf827687b82902ad4cd2cbfc33fad86e32c86b.exe
Token: SeSystemEnvironmentPrivilege	1404	f386b6a1a42d356dc069ae5aa5cf827687b82902ad4cd2cbfc33fad86e32c86b.exe
Token: SeChangeNotifyPrivilege	1404	f386b6a1a42d356dc069ae5aa5cf827687b82902ad4cd2cbfc33fad86e32c86b.exe
Token: SeRemoteShutdownPrivilege	1404	f386b6a1a42d356dc069ae5aa5cf827687b82902ad4cd2cbfc33fad86e32c86b.exe
Token: SeUndockPrivilege	1404	f386b6a1a42d356dc069ae5aa5cf827687b82902ad4cd2cbfc33fad86e32c86b.exe
Token: SeManageVolumePrivilege	1404	f386b6a1a42d356dc069ae5aa5cf827687b82902ad4cd2cbfc33fad86e32c86b.exe
Token: SeImpersonatePrivilege	1404	f386b6a1a42d356dc069ae5aa5cf827687b82902ad4cd2cbfc33fad86e32c86b.exe
Token: SeCreateGlobalPrivilege	1404	f386b6a1a42d356dc069ae5aa5cf827687b82902ad4cd2cbfc33fad86e32c86b.exe
Token: 33	1404	f386b6a1a42d356dc069ae5aa5cf827687b82902ad4cd2cbfc33fad86e32c86b.exe
Token: 34	1404	f386b6a1a42d356dc069ae5aa5cf827687b82902ad4cd2cbfc33fad86e32c86b.exe
Token: 35	1404	f386b6a1a42d356dc069ae5aa5cf827687b82902ad4cd2cbfc33fad86e32c86b.exe
Token: 36	1404	f386b6a1a42d356dc069ae5aa5cf827687b82902ad4cd2cbfc33fad86e32c86b.exe
Token: SeIncreaseQuotaPrivilege	4756	WinSounds.exe
Token: SeSecurityPrivilege	4756	WinSounds.exe
Token: SeTakeOwnershipPrivilege	4756	WinSounds.exe
Token: SeLoadDriverPrivilege	4756	WinSounds.exe
Token: SeSystemProfilePrivilege	4756	WinSounds.exe
Token: SeSystemtimePrivilege	4756	WinSounds.exe
Token: SeProfSingleProcessPrivilege	4756	WinSounds.exe
Token: SeIncBasePriorityPrivilege	4756	WinSounds.exe
Token: SeCreatePagefilePrivilege	4756	WinSounds.exe
Token: SeBackupPrivilege	4756	WinSounds.exe
Token: SeRestorePrivilege	4756	WinSounds.exe
Token: SeShutdownPrivilege	4756	WinSounds.exe
Token: SeDebugPrivilege	4756	WinSounds.exe
Token: SeSystemEnvironmentPrivilege	4756	WinSounds.exe
Token: SeChangeNotifyPrivilege	4756	WinSounds.exe
Token: SeRemoteShutdownPrivilege	4756	WinSounds.exe
Token: SeUndockPrivilege	4756	WinSounds.exe
Token: SeManageVolumePrivilege	4756	WinSounds.exe
Token: SeImpersonatePrivilege	4756	WinSounds.exe
Token: SeCreateGlobalPrivilege	4756	WinSounds.exe
Token: 33	4756	WinSounds.exe
Token: 34	4756	WinSounds.exe
Token: 35	4756	WinSounds.exe
Token: 36	4756	WinSounds.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

WinSounds.exe

pid process

4756 WinSounds.exe

pid	process
4756	WinSounds.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

f386b6a1a42d356dc069ae5aa5cf827687b82902ad4cd2cbfc33fad86e32c86b.exe

description	pid	process	target process
PID 1404 wrote to memory of 4756	1404	f386b6a1a42d356dc069ae5aa5cf827687b82902ad4cd2cbfc33fad86e32c86b.exe	WinSounds.exe
PID 1404 wrote to memory of 4756	1404	f386b6a1a42d356dc069ae5aa5cf827687b82902ad4cd2cbfc33fad86e32c86b.exe	WinSounds.exe
PID 1404 wrote to memory of 4756	1404	f386b6a1a42d356dc069ae5aa5cf827687b82902ad4cd2cbfc33fad86e32c86b.exe	WinSounds.exe

C:\Users\Admin\AppData\Local\Temp\f386b6a1a42d356dc069ae5aa5cf827687b82902ad4cd2cbfc33fad86e32c86b.exe
"C:\Users\Admin\AppData\Local\Temp\f386b6a1a42d356dc069ae5aa5cf827687b82902ad4cd2cbfc33fad86e32c86b.exe"
1⤵
- Modifies WinLogon for persistence
- Checks computer location settings
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1404

C:\Users\Admin\AppData\Roaming\SounDrivers\WinSounds.exe
"C:\Users\Admin\AppData\Roaming\SounDrivers\WinSounds.exe"
2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:4756

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p
1⤵
- Drops file in System32 directory
- Checks processor information in registry
- Enumerates system info in registry
PID:1008

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Winlogon Helper DLL

1

T1004

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

2

T1112

Credential Access

Discovery

Query Registry

3

T1012

System Information Discovery

4

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\SounDrivers\WinSounds.exe
Filesize
661KB

MD5
6ea15a00eee5168a3b36a60833460951

SHA1
fd9698312c7564c08420f27f4936cfc65e8580fc

SHA256
f386b6a1a42d356dc069ae5aa5cf827687b82902ad4cd2cbfc33fad86e32c86b

SHA512
8d4d7d18bf980a41ecdaeaed7706d75e1333eddd443cb5f0226a029b46a19865c462bd8785d2d9efe47c387f1122148a748533bcfe37b71234ef8e94a6df47a9

Download Submit
C:\Users\Admin\AppData\Roaming\SounDrivers\WinSounds.exe
Filesize
661KB

MD5
6ea15a00eee5168a3b36a60833460951

SHA1
fd9698312c7564c08420f27f4936cfc65e8580fc

SHA256
f386b6a1a42d356dc069ae5aa5cf827687b82902ad4cd2cbfc33fad86e32c86b

SHA512
8d4d7d18bf980a41ecdaeaed7706d75e1333eddd443cb5f0226a029b46a19865c462bd8785d2d9efe47c387f1122148a748533bcfe37b71234ef8e94a6df47a9

Download Submit
memory/4756-132-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads