darkcomet | f078ebeb80cabc5bc6448d58a42f9314f4c8893a0436415d49e5520eb67ff2ed

General

Target

f078ebeb80cabc5bc6448d58a42f9314f4c8893a0436415d49e5520eb67ff2ed.exe
Size

788KB
MD5

2e75ad08a9b982515f53f852ad744a76
SHA1

4f4a61300ef5df02edbbdbcbeb22b2995ebf5898
SHA256

f078ebeb80cabc5bc6448d58a42f9314f4c8893a0436415d49e5520eb67ff2ed
SHA512

479237b20cee15a9cea055404cdc8d2be1f2642a905e843411a5bdfa2b86011cdacd4e34aa1a1ac995a30f78a266246634644747357050298576c135fa91734b
SSDEEP

24576:zFoXBnpw8bzRhObDkvEbSDKC2UmKaHZz/mt/E:pYBny0zD0DkvG8mKQKt/E

Score

10^/10

darkcomet guest56 rat trojan

Malware Config

Extracted

Family

darkcomet

Botnet

Guest56

C2

demonza001.no-ip.org:82

192.168.1.20:82

Mutex

DC_MUTEX-G11EJLX

Attributes

gencode
rt0CHvdzwbUk
install
false
offline_keylogger
true
persistence
false

Signatures

Darkcomet
DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
trojan rat darkcomet

Suspicious use of SetThreadContext 1 IoCs

Processes:

f078ebeb80cabc5bc6448d58a42f9314f4c8893a0436415d49e5520eb67ff2ed.exe

description	pid	process	target process
PID 1736 set thread context of 4328	1736	f078ebeb80cabc5bc6448d58a42f9314f4c8893a0436415d49e5520eb67ff2ed.exe	f078ebeb80cabc5bc6448d58a42f9314f4c8893a0436415d49e5520eb67ff2ed.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 24 IoCs

Processes:

f078ebeb80cabc5bc6448d58a42f9314f4c8893a0436415d49e5520eb67ff2ed.exe

description	pid	process
Token: SeIncreaseQuotaPrivilege	4328	f078ebeb80cabc5bc6448d58a42f9314f4c8893a0436415d49e5520eb67ff2ed.exe
Token: SeSecurityPrivilege	4328	f078ebeb80cabc5bc6448d58a42f9314f4c8893a0436415d49e5520eb67ff2ed.exe
Token: SeTakeOwnershipPrivilege	4328	f078ebeb80cabc5bc6448d58a42f9314f4c8893a0436415d49e5520eb67ff2ed.exe
Token: SeLoadDriverPrivilege	4328	f078ebeb80cabc5bc6448d58a42f9314f4c8893a0436415d49e5520eb67ff2ed.exe
Token: SeSystemProfilePrivilege	4328	f078ebeb80cabc5bc6448d58a42f9314f4c8893a0436415d49e5520eb67ff2ed.exe
Token: SeSystemtimePrivilege	4328	f078ebeb80cabc5bc6448d58a42f9314f4c8893a0436415d49e5520eb67ff2ed.exe
Token: SeProfSingleProcessPrivilege	4328	f078ebeb80cabc5bc6448d58a42f9314f4c8893a0436415d49e5520eb67ff2ed.exe
Token: SeIncBasePriorityPrivilege	4328	f078ebeb80cabc5bc6448d58a42f9314f4c8893a0436415d49e5520eb67ff2ed.exe
Token: SeCreatePagefilePrivilege	4328	f078ebeb80cabc5bc6448d58a42f9314f4c8893a0436415d49e5520eb67ff2ed.exe
Token: SeBackupPrivilege	4328	f078ebeb80cabc5bc6448d58a42f9314f4c8893a0436415d49e5520eb67ff2ed.exe
Token: SeRestorePrivilege	4328	f078ebeb80cabc5bc6448d58a42f9314f4c8893a0436415d49e5520eb67ff2ed.exe
Token: SeShutdownPrivilege	4328	f078ebeb80cabc5bc6448d58a42f9314f4c8893a0436415d49e5520eb67ff2ed.exe
Token: SeDebugPrivilege	4328	f078ebeb80cabc5bc6448d58a42f9314f4c8893a0436415d49e5520eb67ff2ed.exe
Token: SeSystemEnvironmentPrivilege	4328	f078ebeb80cabc5bc6448d58a42f9314f4c8893a0436415d49e5520eb67ff2ed.exe
Token: SeChangeNotifyPrivilege	4328	f078ebeb80cabc5bc6448d58a42f9314f4c8893a0436415d49e5520eb67ff2ed.exe
Token: SeRemoteShutdownPrivilege	4328	f078ebeb80cabc5bc6448d58a42f9314f4c8893a0436415d49e5520eb67ff2ed.exe
Token: SeUndockPrivilege	4328	f078ebeb80cabc5bc6448d58a42f9314f4c8893a0436415d49e5520eb67ff2ed.exe
Token: SeManageVolumePrivilege	4328	f078ebeb80cabc5bc6448d58a42f9314f4c8893a0436415d49e5520eb67ff2ed.exe
Token: SeImpersonatePrivilege	4328	f078ebeb80cabc5bc6448d58a42f9314f4c8893a0436415d49e5520eb67ff2ed.exe
Token: SeCreateGlobalPrivilege	4328	f078ebeb80cabc5bc6448d58a42f9314f4c8893a0436415d49e5520eb67ff2ed.exe
Token: 33	4328	f078ebeb80cabc5bc6448d58a42f9314f4c8893a0436415d49e5520eb67ff2ed.exe
Token: 34	4328	f078ebeb80cabc5bc6448d58a42f9314f4c8893a0436415d49e5520eb67ff2ed.exe
Token: 35	4328	f078ebeb80cabc5bc6448d58a42f9314f4c8893a0436415d49e5520eb67ff2ed.exe
Token: 36	4328	f078ebeb80cabc5bc6448d58a42f9314f4c8893a0436415d49e5520eb67ff2ed.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

f078ebeb80cabc5bc6448d58a42f9314f4c8893a0436415d49e5520eb67ff2ed.exe

pid process

4328 f078ebeb80cabc5bc6448d58a42f9314f4c8893a0436415d49e5520eb67ff2ed.exe

pid	process
4328	f078ebeb80cabc5bc6448d58a42f9314f4c8893a0436415d49e5520eb67ff2ed.exe

Suspicious use of WriteProcessMemory 13 IoCs

Processes:

f078ebeb80cabc5bc6448d58a42f9314f4c8893a0436415d49e5520eb67ff2ed.exe

description	pid	process	target process
PID 1736 wrote to memory of 4328	1736	f078ebeb80cabc5bc6448d58a42f9314f4c8893a0436415d49e5520eb67ff2ed.exe	f078ebeb80cabc5bc6448d58a42f9314f4c8893a0436415d49e5520eb67ff2ed.exe
PID 1736 wrote to memory of 4328	1736	f078ebeb80cabc5bc6448d58a42f9314f4c8893a0436415d49e5520eb67ff2ed.exe	f078ebeb80cabc5bc6448d58a42f9314f4c8893a0436415d49e5520eb67ff2ed.exe
PID 1736 wrote to memory of 4328	1736	f078ebeb80cabc5bc6448d58a42f9314f4c8893a0436415d49e5520eb67ff2ed.exe	f078ebeb80cabc5bc6448d58a42f9314f4c8893a0436415d49e5520eb67ff2ed.exe
PID 1736 wrote to memory of 4328	1736	f078ebeb80cabc5bc6448d58a42f9314f4c8893a0436415d49e5520eb67ff2ed.exe	f078ebeb80cabc5bc6448d58a42f9314f4c8893a0436415d49e5520eb67ff2ed.exe
PID 1736 wrote to memory of 4328	1736	f078ebeb80cabc5bc6448d58a42f9314f4c8893a0436415d49e5520eb67ff2ed.exe	f078ebeb80cabc5bc6448d58a42f9314f4c8893a0436415d49e5520eb67ff2ed.exe
PID 1736 wrote to memory of 4328	1736	f078ebeb80cabc5bc6448d58a42f9314f4c8893a0436415d49e5520eb67ff2ed.exe	f078ebeb80cabc5bc6448d58a42f9314f4c8893a0436415d49e5520eb67ff2ed.exe
PID 1736 wrote to memory of 4328	1736	f078ebeb80cabc5bc6448d58a42f9314f4c8893a0436415d49e5520eb67ff2ed.exe	f078ebeb80cabc5bc6448d58a42f9314f4c8893a0436415d49e5520eb67ff2ed.exe
PID 1736 wrote to memory of 4328	1736	f078ebeb80cabc5bc6448d58a42f9314f4c8893a0436415d49e5520eb67ff2ed.exe	f078ebeb80cabc5bc6448d58a42f9314f4c8893a0436415d49e5520eb67ff2ed.exe
PID 1736 wrote to memory of 4328	1736	f078ebeb80cabc5bc6448d58a42f9314f4c8893a0436415d49e5520eb67ff2ed.exe	f078ebeb80cabc5bc6448d58a42f9314f4c8893a0436415d49e5520eb67ff2ed.exe
PID 1736 wrote to memory of 4328	1736	f078ebeb80cabc5bc6448d58a42f9314f4c8893a0436415d49e5520eb67ff2ed.exe	f078ebeb80cabc5bc6448d58a42f9314f4c8893a0436415d49e5520eb67ff2ed.exe
PID 1736 wrote to memory of 4328	1736	f078ebeb80cabc5bc6448d58a42f9314f4c8893a0436415d49e5520eb67ff2ed.exe	f078ebeb80cabc5bc6448d58a42f9314f4c8893a0436415d49e5520eb67ff2ed.exe
PID 1736 wrote to memory of 4328	1736	f078ebeb80cabc5bc6448d58a42f9314f4c8893a0436415d49e5520eb67ff2ed.exe	f078ebeb80cabc5bc6448d58a42f9314f4c8893a0436415d49e5520eb67ff2ed.exe
PID 1736 wrote to memory of 4328	1736	f078ebeb80cabc5bc6448d58a42f9314f4c8893a0436415d49e5520eb67ff2ed.exe	f078ebeb80cabc5bc6448d58a42f9314f4c8893a0436415d49e5520eb67ff2ed.exe

C:\Users\Admin\AppData\Local\Temp\f078ebeb80cabc5bc6448d58a42f9314f4c8893a0436415d49e5520eb67ff2ed.exe
"C:\Users\Admin\AppData\Local\Temp\f078ebeb80cabc5bc6448d58a42f9314f4c8893a0436415d49e5520eb67ff2ed.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1736

C:\Users\Admin\AppData\Local\Temp\f078ebeb80cabc5bc6448d58a42f9314f4c8893a0436415d49e5520eb67ff2ed.exe
C:\Users\Admin\AppData\Local\Temp\f078ebeb80cabc5bc6448d58a42f9314f4c8893a0436415d49e5520eb67ff2ed.exe
2⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:4328

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4328-132-0x0000000000000000-mapping.dmp

Download
memory/4328-133-0x0000000000400000-0x00000000004CA000-memory.dmp

Filesize
808KB

Download
memory/4328-134-0x0000000000400000-0x00000000004CA000-memory.dmp

Filesize
808KB

Download
memory/4328-135-0x0000000000400000-0x00000000004CA000-memory.dmp

Filesize
808KB

Download
memory/4328-136-0x0000000000400000-0x00000000004CA000-memory.dmp

Filesize
808KB

Download
memory/4328-137-0x0000000000400000-0x00000000004CA000-memory.dmp

Filesize
808KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads