darkcomet | f285d4bb56b1a4e14579d749e5d6b3d722840a56710e8967a643f3db6545b25e

Analysis

max time kernel
186s
max time network
48s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
03/12/2022, 02:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f285d4bb56b1a4e14579d749e5d6b3d722840a56710e8967a643f3db6545b25e.exe
Size

1024KB
MD5

039543b29918a1800c8e0e8c9d9ba7d0
SHA1

145769085294b822ff2c805428246795878bbc62
SHA256

f285d4bb56b1a4e14579d749e5d6b3d722840a56710e8967a643f3db6545b25e
SHA512

d3328f9cd60dcbd029371b56d4b98002a624d3d2ba56b9e707d7a101b8dce81e2761159ecaa8ed51b6ced60ab832522ac6bdb8a197f3fa79797d9aa70f5b5df7
SSDEEP

24576:NdlX2joBPourq9FcX59bowZVuybDjpc/UGR/eGKuYmVUdYb6HRUf:tmFu29Fcp9bowbuy/S/71QuVhOM

Score

10^/10

darkcomet s4ndy rat trojan

Malware Config

Extracted

Family

darkcomet

Botnet

S4NDY

kissmyarse.no-ip.biz:5466

Mutex

RLG3J8R6JRP0QA

Attributes

gencode
qYEmNxplwd2o
install
false
offline_keylogger
true
password
9845619822
persistence
false

Signatures

Darkcomet
DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
trojan rat darkcomet
Uses the VBS compiler for execution 1 TTPs

Scripting
T1064

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1980 set thread context of 1240	1980	f285d4bb56b1a4e14579d749e5d6b3d722840a56710e8967a643f3db6545b25e.exe	27

Suspicious use of AdjustPrivilegeToken 24 IoCs

description	pid	Process
Token: SeDebugPrivilege	1980	f285d4bb56b1a4e14579d749e5d6b3d722840a56710e8967a643f3db6545b25e.exe
Token: SeIncreaseQuotaPrivilege	1240	vbc.exe
Token: SeSecurityPrivilege	1240	vbc.exe
Token: SeTakeOwnershipPrivilege	1240	vbc.exe
Token: SeLoadDriverPrivilege	1240	vbc.exe
Token: SeSystemProfilePrivilege	1240	vbc.exe
Token: SeSystemtimePrivilege	1240	vbc.exe
Token: SeProfSingleProcessPrivilege	1240	vbc.exe
Token: SeIncBasePriorityPrivilege	1240	vbc.exe
Token: SeCreatePagefilePrivilege	1240	vbc.exe
Token: SeBackupPrivilege	1240	vbc.exe
Token: SeRestorePrivilege	1240	vbc.exe
Token: SeShutdownPrivilege	1240	vbc.exe
Token: SeDebugPrivilege	1240	vbc.exe
Token: SeSystemEnvironmentPrivilege	1240	vbc.exe
Token: SeChangeNotifyPrivilege	1240	vbc.exe
Token: SeRemoteShutdownPrivilege	1240	vbc.exe
Token: SeUndockPrivilege	1240	vbc.exe
Token: SeManageVolumePrivilege	1240	vbc.exe
Token: SeImpersonatePrivilege	1240	vbc.exe
Token: SeCreateGlobalPrivilege	1240	vbc.exe
Token: 33	1240	vbc.exe
Token: 34	1240	vbc.exe
Token: 35	1240	vbc.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1240	vbc.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1980 wrote to memory of 1240	1980	f285d4bb56b1a4e14579d749e5d6b3d722840a56710e8967a643f3db6545b25e.exe	27
PID 1980 wrote to memory of 1240	1980	f285d4bb56b1a4e14579d749e5d6b3d722840a56710e8967a643f3db6545b25e.exe	27
PID 1980 wrote to memory of 1240	1980	f285d4bb56b1a4e14579d749e5d6b3d722840a56710e8967a643f3db6545b25e.exe	27
PID 1980 wrote to memory of 1240	1980	f285d4bb56b1a4e14579d749e5d6b3d722840a56710e8967a643f3db6545b25e.exe	27
PID 1980 wrote to memory of 1240	1980	f285d4bb56b1a4e14579d749e5d6b3d722840a56710e8967a643f3db6545b25e.exe	27
PID 1980 wrote to memory of 1240	1980	f285d4bb56b1a4e14579d749e5d6b3d722840a56710e8967a643f3db6545b25e.exe	27

C:\Users\Admin\AppData\Local\Temp\f285d4bb56b1a4e14579d749e5d6b3d722840a56710e8967a643f3db6545b25e.exe
"C:\Users\Admin\AppData\Local\Temp\f285d4bb56b1a4e14579d749e5d6b3d722840a56710e8967a643f3db6545b25e.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1980
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
  "C:\Windows\Microsoft.NET\Framework\v2.0.50727\\vbc.exe"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:1240

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scripting

T1064

Persistence

Privilege Escalation

Defense Evasion

Scripting

T1064

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1240-56-0x0000000000400000-0x00000000004B5000-memory.dmp

Filesize
724KB

Download
memory/1240-58-0x0000000000400000-0x00000000004B5000-memory.dmp

Filesize
724KB

Download
memory/1240-61-0x0000000000400000-0x00000000004B5000-memory.dmp

Filesize
724KB

Download
memory/1240-62-0x0000000000400000-0x00000000004B5000-memory.dmp

Filesize
724KB

Download
memory/1240-63-0x0000000000400000-0x00000000004B5000-memory.dmp

Filesize
724KB

Download
memory/1980-54-0x00000000764D1000-0x00000000764D3000-memory.dmp

Filesize
8KB

Download
memory/1980-55-0x0000000074590000-0x0000000074B3B000-memory.dmp

Filesize
5.7MB

Download
memory/1980-59-0x0000000074590000-0x0000000074B3B000-memory.dmp

Filesize
5.7MB

Download