darkcomet | 4123a31a7bc25e6a62bc2a0b63a09f123c8e357bdfd5c4e7f183e7f010149f5f

General

Target

4123a31a7bc25e6a62bc2a0b63a09f123c8e357bdfd5c4e7f183e7f010149f5f.exe
Size

772KB
MD5

68e8582308a2f05401ef6d076facd012
SHA1

2b2c9ed47453a7b8ef988da3d74af01e6d4340e6
SHA256

4123a31a7bc25e6a62bc2a0b63a09f123c8e357bdfd5c4e7f183e7f010149f5f
SHA512

14bd663c9c9ee8f4ac12774a14fd7a33108cf1fe7fed7afc8730719585e00521c4b12f03c5aba993f0ce98b6532794163b69c5a8bed84f71965c2d3f6e4fdcbc
SSDEEP

12288:7CuQHZyt8xPBhU2BNt1tBPOVsoaDWal2fdFP/Jh+xD6ikf:7CBxZjBl2DaOfTnbYW5f

Score

10^/10

darkcomet giriamo evasion rat trojan

Malware Config

Extracted

Family

darkcomet

Botnet

giriamo

C2

178.239.178.177:200

Mutex

DC_MUTEX-MBX97KS

Attributes

gencode
RTdAVRUtBLYH
install
false
offline_keylogger
true
persistence
false

Signatures

Darkcomet
DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
trojan rat darkcomet
Executes dropped EXE 1 IoCs

Processes:

WinUpdate.exe

pid process

4516 WinUpdate.exe
Sets file to hidden 1 TTPs 2 IoCs
Modifies file attributes to stop it showing in Explorer etc.
evasion

Hidden Files and Directories
T1158

Processes:

attrib.exeattrib.exe

pid process

4072 attrib.exe
3424 attrib.exe

pid	process
4516	WinUpdate.exe

pid	process
4072	attrib.exe
3424	attrib.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

WinUpdate.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Control Panel\International\Geo\Nation	WinUpdate.exe

Drops desktop.ini file(s) 2 IoCs

Processes:

4123a31a7bc25e6a62bc2a0b63a09f123c8e357bdfd5c4e7f183e7f010149f5f.exe

description	ioc	process
File created	C:\Windows\assembly\Desktop.ini	4123a31a7bc25e6a62bc2a0b63a09f123c8e357bdfd5c4e7f183e7f010149f5f.exe
File opened for modification	C:\Windows\assembly\Desktop.ini	4123a31a7bc25e6a62bc2a0b63a09f123c8e357bdfd5c4e7f183e7f010149f5f.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

4123a31a7bc25e6a62bc2a0b63a09f123c8e357bdfd5c4e7f183e7f010149f5f.exe

description	pid	process	target process
PID 448 set thread context of 4516	448	4123a31a7bc25e6a62bc2a0b63a09f123c8e357bdfd5c4e7f183e7f010149f5f.exe	WinUpdate.exe

Drops file in Windows directory 3 IoCs

Processes:

4123a31a7bc25e6a62bc2a0b63a09f123c8e357bdfd5c4e7f183e7f010149f5f.exe

description	ioc	process
File opened for modification	C:\Windows\assembly	4123a31a7bc25e6a62bc2a0b63a09f123c8e357bdfd5c4e7f183e7f010149f5f.exe
File created	C:\Windows\assembly\Desktop.ini	4123a31a7bc25e6a62bc2a0b63a09f123c8e357bdfd5c4e7f183e7f010149f5f.exe
File opened for modification	C:\Windows\assembly\Desktop.ini	4123a31a7bc25e6a62bc2a0b63a09f123c8e357bdfd5c4e7f183e7f010149f5f.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

4123a31a7bc25e6a62bc2a0b63a09f123c8e357bdfd5c4e7f183e7f010149f5f.exe

pid process

448 4123a31a7bc25e6a62bc2a0b63a09f123c8e357bdfd5c4e7f183e7f010149f5f.exe

pid	process
448	4123a31a7bc25e6a62bc2a0b63a09f123c8e357bdfd5c4e7f183e7f010149f5f.exe

Suspicious use of AdjustPrivilegeToken 25 IoCs

Processes:

4123a31a7bc25e6a62bc2a0b63a09f123c8e357bdfd5c4e7f183e7f010149f5f.exeWinUpdate.exe

description	pid	process
Token: SeDebugPrivilege	448	4123a31a7bc25e6a62bc2a0b63a09f123c8e357bdfd5c4e7f183e7f010149f5f.exe
Token: SeIncreaseQuotaPrivilege	4516	WinUpdate.exe
Token: SeSecurityPrivilege	4516	WinUpdate.exe
Token: SeTakeOwnershipPrivilege	4516	WinUpdate.exe
Token: SeLoadDriverPrivilege	4516	WinUpdate.exe
Token: SeSystemProfilePrivilege	4516	WinUpdate.exe
Token: SeSystemtimePrivilege	4516	WinUpdate.exe
Token: SeProfSingleProcessPrivilege	4516	WinUpdate.exe
Token: SeIncBasePriorityPrivilege	4516	WinUpdate.exe
Token: SeCreatePagefilePrivilege	4516	WinUpdate.exe
Token: SeBackupPrivilege	4516	WinUpdate.exe
Token: SeRestorePrivilege	4516	WinUpdate.exe
Token: SeShutdownPrivilege	4516	WinUpdate.exe
Token: SeDebugPrivilege	4516	WinUpdate.exe
Token: SeSystemEnvironmentPrivilege	4516	WinUpdate.exe
Token: SeChangeNotifyPrivilege	4516	WinUpdate.exe
Token: SeRemoteShutdownPrivilege	4516	WinUpdate.exe
Token: SeUndockPrivilege	4516	WinUpdate.exe
Token: SeManageVolumePrivilege	4516	WinUpdate.exe
Token: SeImpersonatePrivilege	4516	WinUpdate.exe
Token: SeCreateGlobalPrivilege	4516	WinUpdate.exe
Token: 33	4516	WinUpdate.exe
Token: 34	4516	WinUpdate.exe
Token: 35	4516	WinUpdate.exe
Token: 36	4516	WinUpdate.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

WinUpdate.exe

pid process

4516 WinUpdate.exe

pid	process
4516	WinUpdate.exe

Suspicious use of WriteProcessMemory 48 IoCs

Processes:

4123a31a7bc25e6a62bc2a0b63a09f123c8e357bdfd5c4e7f183e7f010149f5f.exeWinUpdate.execmd.execmd.exe

description	pid	process	target process
PID 448 wrote to memory of 4516	448	4123a31a7bc25e6a62bc2a0b63a09f123c8e357bdfd5c4e7f183e7f010149f5f.exe	WinUpdate.exe
PID 448 wrote to memory of 4516	448	4123a31a7bc25e6a62bc2a0b63a09f123c8e357bdfd5c4e7f183e7f010149f5f.exe	WinUpdate.exe
PID 448 wrote to memory of 4516	448	4123a31a7bc25e6a62bc2a0b63a09f123c8e357bdfd5c4e7f183e7f010149f5f.exe	WinUpdate.exe
PID 448 wrote to memory of 4516	448	4123a31a7bc25e6a62bc2a0b63a09f123c8e357bdfd5c4e7f183e7f010149f5f.exe	WinUpdate.exe
PID 448 wrote to memory of 4516	448	4123a31a7bc25e6a62bc2a0b63a09f123c8e357bdfd5c4e7f183e7f010149f5f.exe	WinUpdate.exe
PID 448 wrote to memory of 4516	448	4123a31a7bc25e6a62bc2a0b63a09f123c8e357bdfd5c4e7f183e7f010149f5f.exe	WinUpdate.exe
PID 448 wrote to memory of 4516	448	4123a31a7bc25e6a62bc2a0b63a09f123c8e357bdfd5c4e7f183e7f010149f5f.exe	WinUpdate.exe
PID 448 wrote to memory of 4516	448	4123a31a7bc25e6a62bc2a0b63a09f123c8e357bdfd5c4e7f183e7f010149f5f.exe	WinUpdate.exe
PID 448 wrote to memory of 4516	448	4123a31a7bc25e6a62bc2a0b63a09f123c8e357bdfd5c4e7f183e7f010149f5f.exe	WinUpdate.exe
PID 448 wrote to memory of 4516	448	4123a31a7bc25e6a62bc2a0b63a09f123c8e357bdfd5c4e7f183e7f010149f5f.exe	WinUpdate.exe
PID 448 wrote to memory of 4516	448	4123a31a7bc25e6a62bc2a0b63a09f123c8e357bdfd5c4e7f183e7f010149f5f.exe	WinUpdate.exe
PID 448 wrote to memory of 4516	448	4123a31a7bc25e6a62bc2a0b63a09f123c8e357bdfd5c4e7f183e7f010149f5f.exe	WinUpdate.exe
PID 448 wrote to memory of 4516	448	4123a31a7bc25e6a62bc2a0b63a09f123c8e357bdfd5c4e7f183e7f010149f5f.exe	WinUpdate.exe
PID 448 wrote to memory of 4516	448	4123a31a7bc25e6a62bc2a0b63a09f123c8e357bdfd5c4e7f183e7f010149f5f.exe	WinUpdate.exe
PID 4516 wrote to memory of 4984	4516	WinUpdate.exe	cmd.exe
PID 4516 wrote to memory of 4984	4516	WinUpdate.exe	cmd.exe
PID 4516 wrote to memory of 4984	4516	WinUpdate.exe	cmd.exe
PID 4516 wrote to memory of 3888	4516	WinUpdate.exe	cmd.exe
PID 4516 wrote to memory of 3888	4516	WinUpdate.exe	cmd.exe
PID 4516 wrote to memory of 3888	4516	WinUpdate.exe	cmd.exe
PID 4984 wrote to memory of 4072	4984	cmd.exe	attrib.exe
PID 4984 wrote to memory of 4072	4984	cmd.exe	attrib.exe
PID 4984 wrote to memory of 4072	4984	cmd.exe	attrib.exe
PID 3888 wrote to memory of 3424	3888	cmd.exe	attrib.exe
PID 3888 wrote to memory of 3424	3888	cmd.exe	attrib.exe
PID 3888 wrote to memory of 3424	3888	cmd.exe	attrib.exe
PID 4516 wrote to memory of 3440	4516	WinUpdate.exe	notepad.exe
PID 4516 wrote to memory of 3440	4516	WinUpdate.exe	notepad.exe
PID 4516 wrote to memory of 3440	4516	WinUpdate.exe	notepad.exe
PID 4516 wrote to memory of 3440	4516	WinUpdate.exe	notepad.exe
PID 4516 wrote to memory of 3440	4516	WinUpdate.exe	notepad.exe
PID 4516 wrote to memory of 3440	4516	WinUpdate.exe	notepad.exe
PID 4516 wrote to memory of 3440	4516	WinUpdate.exe	notepad.exe
PID 4516 wrote to memory of 3440	4516	WinUpdate.exe	notepad.exe
PID 4516 wrote to memory of 3440	4516	WinUpdate.exe	notepad.exe
PID 4516 wrote to memory of 3440	4516	WinUpdate.exe	notepad.exe
PID 4516 wrote to memory of 3440	4516	WinUpdate.exe	notepad.exe
PID 4516 wrote to memory of 3440	4516	WinUpdate.exe	notepad.exe
PID 4516 wrote to memory of 3440	4516	WinUpdate.exe	notepad.exe
PID 4516 wrote to memory of 3440	4516	WinUpdate.exe	notepad.exe
PID 4516 wrote to memory of 3440	4516	WinUpdate.exe	notepad.exe
PID 4516 wrote to memory of 3440	4516	WinUpdate.exe	notepad.exe
PID 4516 wrote to memory of 3440	4516	WinUpdate.exe	notepad.exe
PID 4516 wrote to memory of 3440	4516	WinUpdate.exe	notepad.exe
PID 4516 wrote to memory of 3440	4516	WinUpdate.exe	notepad.exe
PID 4516 wrote to memory of 3440	4516	WinUpdate.exe	notepad.exe
PID 4516 wrote to memory of 3440	4516	WinUpdate.exe	notepad.exe
PID 4516 wrote to memory of 3440	4516	WinUpdate.exe	notepad.exe

Views/modifies file attributes 1 TTPs 2 IoCs
evasion

Hidden Files and Directories
T1158

Processes:

attrib.exeattrib.exe

pid process

4072 attrib.exe
3424 attrib.exe

pid	process
4072	attrib.exe
3424	attrib.exe

C:\Users\Admin\AppData\Local\Temp\4123a31a7bc25e6a62bc2a0b63a09f123c8e357bdfd5c4e7f183e7f010149f5f.exe
"C:\Users\Admin\AppData\Local\Temp\4123a31a7bc25e6a62bc2a0b63a09f123c8e357bdfd5c4e7f183e7f010149f5f.exe"
1⤵
- Drops desktop.ini file(s)
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:448

C:\Users\Admin\AppData\Local\Temp\AppLunch\WinUpdate.exe
C:\Users\Admin\AppData\Local\Temp\\AppLunch\WinUpdate.exe
2⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4516

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp\AppLunch\WinUpdate.exe" +s +h
3⤵
- Suspicious use of WriteProcessMemory
PID:4984

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Users\Admin\AppData\Local\Temp\AppLunch\WinUpdate.exe" +s +h
4⤵
- Sets file to hidden
- Views/modifies file attributes
PID:4072

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp\AppLunch" +s +h
3⤵
- Suspicious use of WriteProcessMemory
PID:3888

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Users\Admin\AppData\Local\Temp\AppLunch" +s +h
4⤵
- Sets file to hidden
- Views/modifies file attributes
PID:3424

C:\Windows\SysWOW64\notepad.exe
notepad
3⤵
PID:3440

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Hidden Files and Directories

2

T1158

Privilege Escalation

Defense Evasion

Hidden Files and Directories

2

T1158

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\AppLunch\WinUpdate.exe
Filesize
1.1MB

MD5
d881de17aa8f2e2c08cbb7b265f928f9

SHA1
08936aebc87decf0af6e8eada191062b5e65ac2a

SHA256
b3a37093609f9a20ad60b85a9fa9de2ba674cba9b5bd687729440c70ba619ca0

SHA512
5f23bfb1b8740247b36ed0ab741738c7d4c949736129e767213e321607d1ccd3e3a8428e4ba44bd28a275b5e3f6206285b1a522514b7ef7ea5e698d90a713d34

Download Submit
C:\Users\Admin\AppData\Local\Temp\AppLunch\WinUpdate.exe
Filesize
1.1MB

MD5
d881de17aa8f2e2c08cbb7b265f928f9

SHA1
08936aebc87decf0af6e8eada191062b5e65ac2a

SHA256
b3a37093609f9a20ad60b85a9fa9de2ba674cba9b5bd687729440c70ba619ca0

SHA512
5f23bfb1b8740247b36ed0ab741738c7d4c949736129e767213e321607d1ccd3e3a8428e4ba44bd28a275b5e3f6206285b1a522514b7ef7ea5e698d90a713d34

Download Submit
memory/448-133-0x0000000075190000-0x0000000075741000-memory.dmp

Filesize
5.7MB

Download
memory/448-132-0x0000000075190000-0x0000000075741000-memory.dmp

Filesize
5.7MB

Download
memory/3424-147-0x0000000000000000-mapping.dmp

Download
memory/3440-148-0x0000000000000000-mapping.dmp

Download
memory/3888-145-0x0000000000000000-mapping.dmp

Download
memory/4072-146-0x0000000000000000-mapping.dmp

Download
memory/4516-139-0x0000000000400000-0x00000000004B6000-memory.dmp

Filesize
728KB

Download
memory/4516-141-0x0000000000400000-0x00000000004B6000-memory.dmp

Filesize
728KB

Download
memory/4516-142-0x0000000000400000-0x00000000004B6000-memory.dmp

Filesize
728KB

Download
memory/4516-143-0x0000000000400000-0x00000000004B6000-memory.dmp

Filesize
728KB

Download
memory/4516-138-0x0000000000400000-0x00000000004B6000-memory.dmp

Filesize
728KB

Download
memory/4516-135-0x0000000000400000-0x00000000004B6000-memory.dmp

Filesize
728KB

Download
memory/4516-134-0x0000000000000000-mapping.dmp

Download
memory/4984-144-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads