darkcomet | f285d4bb56b1a4e14579d749e5d6b3d722840a56710e8967a643f3db6545b25e

Analysis

max time kernel
186s
max time network
48s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
03-12-2022 02:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f285d4bb56b1a4e14579d749e5d6b3d722840a56710e8967a643f3db6545b25e.exe
Size

1024KB
MD5

039543b29918a1800c8e0e8c9d9ba7d0
SHA1

145769085294b822ff2c805428246795878bbc62
SHA256

f285d4bb56b1a4e14579d749e5d6b3d722840a56710e8967a643f3db6545b25e
SHA512

d3328f9cd60dcbd029371b56d4b98002a624d3d2ba56b9e707d7a101b8dce81e2761159ecaa8ed51b6ced60ab832522ac6bdb8a197f3fa79797d9aa70f5b5df7
SSDEEP

24576:NdlX2joBPourq9FcX59bowZVuybDjpc/UGR/eGKuYmVUdYb6HRUf:tmFu29Fcp9bowbuy/S/71QuVhOM

Score

10^/10

darkcomet s4ndy rat trojan

Malware Config

Extracted

Family

darkcomet

Botnet

S4NDY

kissmyarse.no-ip.biz:5466

Mutex

RLG3J8R6JRP0QA

Attributes

gencode
qYEmNxplwd2o
install
false
offline_keylogger
true
password
9845619822
persistence
false

Signatures

Darkcomet
DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
trojan rat darkcomet
Uses the VBS compiler for execution 1 TTPs

Scripting
T1064

Suspicious use of SetThreadContext 1 IoCs

Processes:

f285d4bb56b1a4e14579d749e5d6b3d722840a56710e8967a643f3db6545b25e.exe

description	pid	process	target process
PID 1980 set thread context of 1240	1980	f285d4bb56b1a4e14579d749e5d6b3d722840a56710e8967a643f3db6545b25e.exe	vbc.exe

Suspicious use of AdjustPrivilegeToken 24 IoCs

Processes:

f285d4bb56b1a4e14579d749e5d6b3d722840a56710e8967a643f3db6545b25e.exevbc.exe

description	pid	process
Token: SeDebugPrivilege	1980	f285d4bb56b1a4e14579d749e5d6b3d722840a56710e8967a643f3db6545b25e.exe
Token: SeIncreaseQuotaPrivilege	1240	vbc.exe
Token: SeSecurityPrivilege	1240	vbc.exe
Token: SeTakeOwnershipPrivilege	1240	vbc.exe
Token: SeLoadDriverPrivilege	1240	vbc.exe
Token: SeSystemProfilePrivilege	1240	vbc.exe
Token: SeSystemtimePrivilege	1240	vbc.exe
Token: SeProfSingleProcessPrivilege	1240	vbc.exe
Token: SeIncBasePriorityPrivilege	1240	vbc.exe
Token: SeCreatePagefilePrivilege	1240	vbc.exe
Token: SeBackupPrivilege	1240	vbc.exe
Token: SeRestorePrivilege	1240	vbc.exe
Token: SeShutdownPrivilege	1240	vbc.exe
Token: SeDebugPrivilege	1240	vbc.exe
Token: SeSystemEnvironmentPrivilege	1240	vbc.exe
Token: SeChangeNotifyPrivilege	1240	vbc.exe
Token: SeRemoteShutdownPrivilege	1240	vbc.exe
Token: SeUndockPrivilege	1240	vbc.exe
Token: SeManageVolumePrivilege	1240	vbc.exe
Token: SeImpersonatePrivilege	1240	vbc.exe
Token: SeCreateGlobalPrivilege	1240	vbc.exe
Token: 33	1240	vbc.exe
Token: 34	1240	vbc.exe
Token: 35	1240	vbc.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

vbc.exe

pid process

1240 vbc.exe

pid	process
1240	vbc.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

f285d4bb56b1a4e14579d749e5d6b3d722840a56710e8967a643f3db6545b25e.exe

description	pid	process	target process
PID 1980 wrote to memory of 1240	1980	f285d4bb56b1a4e14579d749e5d6b3d722840a56710e8967a643f3db6545b25e.exe	vbc.exe
PID 1980 wrote to memory of 1240	1980	f285d4bb56b1a4e14579d749e5d6b3d722840a56710e8967a643f3db6545b25e.exe	vbc.exe
PID 1980 wrote to memory of 1240	1980	f285d4bb56b1a4e14579d749e5d6b3d722840a56710e8967a643f3db6545b25e.exe	vbc.exe
PID 1980 wrote to memory of 1240	1980	f285d4bb56b1a4e14579d749e5d6b3d722840a56710e8967a643f3db6545b25e.exe	vbc.exe
PID 1980 wrote to memory of 1240	1980	f285d4bb56b1a4e14579d749e5d6b3d722840a56710e8967a643f3db6545b25e.exe	vbc.exe
PID 1980 wrote to memory of 1240	1980	f285d4bb56b1a4e14579d749e5d6b3d722840a56710e8967a643f3db6545b25e.exe	vbc.exe

C:\Users\Admin\AppData\Local\Temp\f285d4bb56b1a4e14579d749e5d6b3d722840a56710e8967a643f3db6545b25e.exe
"C:\Users\Admin\AppData\Local\Temp\f285d4bb56b1a4e14579d749e5d6b3d722840a56710e8967a643f3db6545b25e.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1980

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\\vbc.exe"
2⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1240

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scripting

T1064

Persistence

Privilege Escalation

Defense Evasion

Scripting

T1064

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1240-56-0x0000000000400000-0x00000000004B5000-memory.dmp

Filesize
724KB

Download
memory/1240-57-0x0000000000490888-mapping.dmp

Download
memory/1240-58-0x0000000000400000-0x00000000004B5000-memory.dmp

Filesize
724KB

Download
memory/1240-61-0x0000000000400000-0x00000000004B5000-memory.dmp

Filesize
724KB

Download
memory/1240-62-0x0000000000400000-0x00000000004B5000-memory.dmp

Filesize
724KB

Download
memory/1240-63-0x0000000000400000-0x00000000004B5000-memory.dmp

Filesize
724KB

Download
memory/1980-54-0x00000000764D1000-0x00000000764D3000-memory.dmp

Filesize
8KB

Download
memory/1980-55-0x0000000074590000-0x0000000074B3B000-memory.dmp

Filesize
5.7MB

Download
memory/1980-59-0x0000000074590000-0x0000000074B3B000-memory.dmp

Filesize
5.7MB

Download