darkcomet | 89cdf7c759ac447bde00fccbd576398f8e81805e91ac960d9c8186043e01319c

General

Target

89cdf7c759ac447bde00fccbd576398f8e81805e91ac960d9c8186043e01319c.exe
Size

416KB
MD5

9539e0727dd07c8c9ac33b199c23771e
SHA1

b3d6376f44c8463ea7e24b84587c0d88de73f70a
SHA256

89cdf7c759ac447bde00fccbd576398f8e81805e91ac960d9c8186043e01319c
SHA512

c902098a4b7dd5b584351edabf685aef0df81d5b27a02d20ea6d20f6e87712903349f3803b5682b948ffc9fbad13f3ee2eb59f5125efc4f01ee1742babf36c89
SSDEEP

12288:ENktTWDAyUNh/lMQo1cr/Ihi2TOsfKJcZLTsEJqPKe:dAO/ML10IhiCOsKJcZLgnPKe

Score

10^/10

darkcomet evasion rat trojan upx

Malware Config

Signatures

Darkcomet
DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
trojan rat darkcomet

Windows security bypass 2 TTPs 1 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

Processes:

89cdf7c759ac447bde00fccbd576398f8e81805e91ac960d9c8186043e01319c.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	89cdf7c759ac447bde00fccbd576398f8e81805e91ac960d9c8186043e01319c.exe

Disables RegEdit via registry modification 1 IoCs

evasion

Processes:

89cdf7c759ac447bde00fccbd576398f8e81805e91ac960d9c8186043e01319c.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	89cdf7c759ac447bde00fccbd576398f8e81805e91ac960d9c8186043e01319c.exe

UPX packed file 6 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral2/memory/3740-137-0x0000000013140000-0x00000000131FB000-memory.dmp	upx
behavioral2/memory/3740-138-0x0000000013140000-0x00000000131FB000-memory.dmp	upx
behavioral2/memory/3740-140-0x0000000013140000-0x00000000131FB000-memory.dmp	upx
behavioral2/memory/3740-141-0x0000000013140000-0x00000000131FB000-memory.dmp	upx
behavioral2/memory/3740-142-0x0000000013140000-0x00000000131FB000-memory.dmp	upx
behavioral2/memory/3740-145-0x0000000013140000-0x00000000131FB000-memory.dmp	upx

Checks BIOS information in registry 2 TTPs 1 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

89cdf7c759ac447bde00fccbd576398f8e81805e91ac960d9c8186043e01319c.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate	89cdf7c759ac447bde00fccbd576398f8e81805e91ac960d9c8186043e01319c.exe

Windows security modification 2 TTPs 1 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

Processes:

89cdf7c759ac447bde00fccbd576398f8e81805e91ac960d9c8186043e01319c.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	89cdf7c759ac447bde00fccbd576398f8e81805e91ac960d9c8186043e01319c.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

89cdf7c759ac447bde00fccbd576398f8e81805e91ac960d9c8186043e01319c.exe

description	pid	process	target process
PID 4660 set thread context of 3740	4660	89cdf7c759ac447bde00fccbd576398f8e81805e91ac960d9c8186043e01319c.exe	89cdf7c759ac447bde00fccbd576398f8e81805e91ac960d9c8186043e01319c.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

89cdf7c759ac447bde00fccbd576398f8e81805e91ac960d9c8186043e01319c.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	89cdf7c759ac447bde00fccbd576398f8e81805e91ac960d9c8186043e01319c.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	89cdf7c759ac447bde00fccbd576398f8e81805e91ac960d9c8186043e01319c.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	89cdf7c759ac447bde00fccbd576398f8e81805e91ac960d9c8186043e01319c.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	89cdf7c759ac447bde00fccbd576398f8e81805e91ac960d9c8186043e01319c.exe

Enumerates system info in registry 2 TTPs 1 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

89cdf7c759ac447bde00fccbd576398f8e81805e91ac960d9c8186043e01319c.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	89cdf7c759ac447bde00fccbd576398f8e81805e91ac960d9c8186043e01319c.exe

Suspicious use of AdjustPrivilegeToken 24 IoCs

Processes:

89cdf7c759ac447bde00fccbd576398f8e81805e91ac960d9c8186043e01319c.exe

description	pid	process
Token: SeIncreaseQuotaPrivilege	3740	89cdf7c759ac447bde00fccbd576398f8e81805e91ac960d9c8186043e01319c.exe
Token: SeSecurityPrivilege	3740	89cdf7c759ac447bde00fccbd576398f8e81805e91ac960d9c8186043e01319c.exe
Token: SeTakeOwnershipPrivilege	3740	89cdf7c759ac447bde00fccbd576398f8e81805e91ac960d9c8186043e01319c.exe
Token: SeLoadDriverPrivilege	3740	89cdf7c759ac447bde00fccbd576398f8e81805e91ac960d9c8186043e01319c.exe
Token: SeSystemProfilePrivilege	3740	89cdf7c759ac447bde00fccbd576398f8e81805e91ac960d9c8186043e01319c.exe
Token: SeSystemtimePrivilege	3740	89cdf7c759ac447bde00fccbd576398f8e81805e91ac960d9c8186043e01319c.exe
Token: SeProfSingleProcessPrivilege	3740	89cdf7c759ac447bde00fccbd576398f8e81805e91ac960d9c8186043e01319c.exe
Token: SeIncBasePriorityPrivilege	3740	89cdf7c759ac447bde00fccbd576398f8e81805e91ac960d9c8186043e01319c.exe
Token: SeCreatePagefilePrivilege	3740	89cdf7c759ac447bde00fccbd576398f8e81805e91ac960d9c8186043e01319c.exe
Token: SeBackupPrivilege	3740	89cdf7c759ac447bde00fccbd576398f8e81805e91ac960d9c8186043e01319c.exe
Token: SeRestorePrivilege	3740	89cdf7c759ac447bde00fccbd576398f8e81805e91ac960d9c8186043e01319c.exe
Token: SeShutdownPrivilege	3740	89cdf7c759ac447bde00fccbd576398f8e81805e91ac960d9c8186043e01319c.exe
Token: SeDebugPrivilege	3740	89cdf7c759ac447bde00fccbd576398f8e81805e91ac960d9c8186043e01319c.exe
Token: SeSystemEnvironmentPrivilege	3740	89cdf7c759ac447bde00fccbd576398f8e81805e91ac960d9c8186043e01319c.exe
Token: SeChangeNotifyPrivilege	3740	89cdf7c759ac447bde00fccbd576398f8e81805e91ac960d9c8186043e01319c.exe
Token: SeRemoteShutdownPrivilege	3740	89cdf7c759ac447bde00fccbd576398f8e81805e91ac960d9c8186043e01319c.exe
Token: SeUndockPrivilege	3740	89cdf7c759ac447bde00fccbd576398f8e81805e91ac960d9c8186043e01319c.exe
Token: SeManageVolumePrivilege	3740	89cdf7c759ac447bde00fccbd576398f8e81805e91ac960d9c8186043e01319c.exe
Token: SeImpersonatePrivilege	3740	89cdf7c759ac447bde00fccbd576398f8e81805e91ac960d9c8186043e01319c.exe
Token: SeCreateGlobalPrivilege	3740	89cdf7c759ac447bde00fccbd576398f8e81805e91ac960d9c8186043e01319c.exe
Token: 33	3740	89cdf7c759ac447bde00fccbd576398f8e81805e91ac960d9c8186043e01319c.exe
Token: 34	3740	89cdf7c759ac447bde00fccbd576398f8e81805e91ac960d9c8186043e01319c.exe
Token: 35	3740	89cdf7c759ac447bde00fccbd576398f8e81805e91ac960d9c8186043e01319c.exe
Token: 36	3740	89cdf7c759ac447bde00fccbd576398f8e81805e91ac960d9c8186043e01319c.exe

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

89cdf7c759ac447bde00fccbd576398f8e81805e91ac960d9c8186043e01319c.exe89cdf7c759ac447bde00fccbd576398f8e81805e91ac960d9c8186043e01319c.exe

pid	process
4660	89cdf7c759ac447bde00fccbd576398f8e81805e91ac960d9c8186043e01319c.exe
3740	89cdf7c759ac447bde00fccbd576398f8e81805e91ac960d9c8186043e01319c.exe

Suspicious use of WriteProcessMemory 33 IoCs

Processes:

89cdf7c759ac447bde00fccbd576398f8e81805e91ac960d9c8186043e01319c.exe89cdf7c759ac447bde00fccbd576398f8e81805e91ac960d9c8186043e01319c.exe

description	pid	process	target process
PID 4660 wrote to memory of 3740	4660	89cdf7c759ac447bde00fccbd576398f8e81805e91ac960d9c8186043e01319c.exe	89cdf7c759ac447bde00fccbd576398f8e81805e91ac960d9c8186043e01319c.exe
PID 4660 wrote to memory of 3740	4660	89cdf7c759ac447bde00fccbd576398f8e81805e91ac960d9c8186043e01319c.exe	89cdf7c759ac447bde00fccbd576398f8e81805e91ac960d9c8186043e01319c.exe
PID 4660 wrote to memory of 3740	4660	89cdf7c759ac447bde00fccbd576398f8e81805e91ac960d9c8186043e01319c.exe	89cdf7c759ac447bde00fccbd576398f8e81805e91ac960d9c8186043e01319c.exe
PID 4660 wrote to memory of 3740	4660	89cdf7c759ac447bde00fccbd576398f8e81805e91ac960d9c8186043e01319c.exe	89cdf7c759ac447bde00fccbd576398f8e81805e91ac960d9c8186043e01319c.exe
PID 4660 wrote to memory of 3740	4660	89cdf7c759ac447bde00fccbd576398f8e81805e91ac960d9c8186043e01319c.exe	89cdf7c759ac447bde00fccbd576398f8e81805e91ac960d9c8186043e01319c.exe
PID 4660 wrote to memory of 3740	4660	89cdf7c759ac447bde00fccbd576398f8e81805e91ac960d9c8186043e01319c.exe	89cdf7c759ac447bde00fccbd576398f8e81805e91ac960d9c8186043e01319c.exe
PID 4660 wrote to memory of 3740	4660	89cdf7c759ac447bde00fccbd576398f8e81805e91ac960d9c8186043e01319c.exe	89cdf7c759ac447bde00fccbd576398f8e81805e91ac960d9c8186043e01319c.exe
PID 4660 wrote to memory of 3740	4660	89cdf7c759ac447bde00fccbd576398f8e81805e91ac960d9c8186043e01319c.exe	89cdf7c759ac447bde00fccbd576398f8e81805e91ac960d9c8186043e01319c.exe
PID 3740 wrote to memory of 4964	3740	89cdf7c759ac447bde00fccbd576398f8e81805e91ac960d9c8186043e01319c.exe	explorer.exe
PID 3740 wrote to memory of 4964	3740	89cdf7c759ac447bde00fccbd576398f8e81805e91ac960d9c8186043e01319c.exe	explorer.exe
PID 3740 wrote to memory of 4964	3740	89cdf7c759ac447bde00fccbd576398f8e81805e91ac960d9c8186043e01319c.exe	explorer.exe
PID 3740 wrote to memory of 4952	3740	89cdf7c759ac447bde00fccbd576398f8e81805e91ac960d9c8186043e01319c.exe	notepad.exe
PID 3740 wrote to memory of 4952	3740	89cdf7c759ac447bde00fccbd576398f8e81805e91ac960d9c8186043e01319c.exe	notepad.exe
PID 3740 wrote to memory of 4952	3740	89cdf7c759ac447bde00fccbd576398f8e81805e91ac960d9c8186043e01319c.exe	notepad.exe
PID 3740 wrote to memory of 4952	3740	89cdf7c759ac447bde00fccbd576398f8e81805e91ac960d9c8186043e01319c.exe	notepad.exe
PID 3740 wrote to memory of 4952	3740	89cdf7c759ac447bde00fccbd576398f8e81805e91ac960d9c8186043e01319c.exe	notepad.exe
PID 3740 wrote to memory of 4952	3740	89cdf7c759ac447bde00fccbd576398f8e81805e91ac960d9c8186043e01319c.exe	notepad.exe
PID 3740 wrote to memory of 4952	3740	89cdf7c759ac447bde00fccbd576398f8e81805e91ac960d9c8186043e01319c.exe	notepad.exe
PID 3740 wrote to memory of 4952	3740	89cdf7c759ac447bde00fccbd576398f8e81805e91ac960d9c8186043e01319c.exe	notepad.exe
PID 3740 wrote to memory of 4952	3740	89cdf7c759ac447bde00fccbd576398f8e81805e91ac960d9c8186043e01319c.exe	notepad.exe
PID 3740 wrote to memory of 4952	3740	89cdf7c759ac447bde00fccbd576398f8e81805e91ac960d9c8186043e01319c.exe	notepad.exe
PID 3740 wrote to memory of 4952	3740	89cdf7c759ac447bde00fccbd576398f8e81805e91ac960d9c8186043e01319c.exe	notepad.exe
PID 3740 wrote to memory of 4952	3740	89cdf7c759ac447bde00fccbd576398f8e81805e91ac960d9c8186043e01319c.exe	notepad.exe
PID 3740 wrote to memory of 4952	3740	89cdf7c759ac447bde00fccbd576398f8e81805e91ac960d9c8186043e01319c.exe	notepad.exe
PID 3740 wrote to memory of 4952	3740	89cdf7c759ac447bde00fccbd576398f8e81805e91ac960d9c8186043e01319c.exe	notepad.exe
PID 3740 wrote to memory of 4952	3740	89cdf7c759ac447bde00fccbd576398f8e81805e91ac960d9c8186043e01319c.exe	notepad.exe
PID 3740 wrote to memory of 4952	3740	89cdf7c759ac447bde00fccbd576398f8e81805e91ac960d9c8186043e01319c.exe	notepad.exe
PID 3740 wrote to memory of 4952	3740	89cdf7c759ac447bde00fccbd576398f8e81805e91ac960d9c8186043e01319c.exe	notepad.exe
PID 3740 wrote to memory of 4952	3740	89cdf7c759ac447bde00fccbd576398f8e81805e91ac960d9c8186043e01319c.exe	notepad.exe
PID 3740 wrote to memory of 4952	3740	89cdf7c759ac447bde00fccbd576398f8e81805e91ac960d9c8186043e01319c.exe	notepad.exe
PID 3740 wrote to memory of 4952	3740	89cdf7c759ac447bde00fccbd576398f8e81805e91ac960d9c8186043e01319c.exe	notepad.exe
PID 3740 wrote to memory of 4952	3740	89cdf7c759ac447bde00fccbd576398f8e81805e91ac960d9c8186043e01319c.exe	notepad.exe
PID 3740 wrote to memory of 4952	3740	89cdf7c759ac447bde00fccbd576398f8e81805e91ac960d9c8186043e01319c.exe	notepad.exe

C:\Users\Admin\AppData\Local\Temp\89cdf7c759ac447bde00fccbd576398f8e81805e91ac960d9c8186043e01319c.exe
"C:\Users\Admin\AppData\Local\Temp\89cdf7c759ac447bde00fccbd576398f8e81805e91ac960d9c8186043e01319c.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4660

C:\Users\Admin\AppData\Local\Temp\89cdf7c759ac447bde00fccbd576398f8e81805e91ac960d9c8186043e01319c.exe
"C:\Users\Admin\AppData\Local\Temp\89cdf7c759ac447bde00fccbd576398f8e81805e91ac960d9c8186043e01319c.exe"
2⤵
- Windows security bypass
- Disables RegEdit via registry modification
- Checks BIOS information in registry
- Windows security modification
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3740

C:\Windows\SysWOW64\explorer.exe
"C:\Windows\SysWOW64\explorer.exe"
3⤵
PID:4964

C:\Windows\SysWOW64\notepad.exe
C:\Windows\SysWOW64\notepad.exe
3⤵
PID:4952

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Disabling Security Tools

2

T1089

Modify Registry

2

T1112

Credential Access

Discovery

Query Registry

3

T1012

System Information Discovery

3

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3740-136-0x0000000000000000-mapping.dmp

Download
memory/3740-137-0x0000000013140000-0x00000000131FB000-memory.dmp

Filesize
748KB

Download
memory/3740-138-0x0000000013140000-0x00000000131FB000-memory.dmp

Filesize
748KB

Download
memory/3740-140-0x0000000013140000-0x00000000131FB000-memory.dmp

Filesize
748KB

Download
memory/3740-141-0x0000000013140000-0x00000000131FB000-memory.dmp

Filesize
748KB

Download
memory/3740-142-0x0000000013140000-0x00000000131FB000-memory.dmp

Filesize
748KB

Download
memory/3740-145-0x0000000013140000-0x00000000131FB000-memory.dmp

Filesize
748KB

Download
memory/4660-132-0x0000000000400000-0x0000000000527000-memory.dmp

Filesize
1.2MB

Download
memory/4660-133-0x0000000000400000-0x0000000000527000-memory.dmp

Filesize
1.2MB

Download
memory/4660-139-0x0000000000400000-0x0000000000527000-memory.dmp

Filesize
1.2MB

Download
memory/4952-144-0x0000000000000000-mapping.dmp

Download
memory/4964-143-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads