darkcomet | e8f17fe148aacdc799ff3e3ae535c48b391b37e14d739e375793da1d50a1454f

General

Target

e8f17fe148aacdc799ff3e3ae535c48b391b37e14d739e375793da1d50a1454f.exe
Size

291KB
MD5

fdd2c8263c374973bc7cb9f0602b04ba
SHA1

8cc09844a1116b7f09d09160ae0743fbf2b39e35
SHA256

e8f17fe148aacdc799ff3e3ae535c48b391b37e14d739e375793da1d50a1454f
SHA512

a8faa425ac72dd205e1fa1aeb6c650e724e57469695b1b87679ea735c6e59096712580516f82b0681337e4eeec2cc0067018d85a6175b2cee943ee91299a2cb5
SSDEEP

6144:A2ckdGiHBX6ZZ7jdObvG4MbT5/x8utNK:HtnHBqZZAbPMP551NK

Score

10^/10

darkcomet persistence rat trojan upx

Malware Config

Signatures

Darkcomet
DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
trojan rat darkcomet
Executes dropped EXE 2 IoCs

Processes:

InteliTrace.exeSearchFillterHost.exe

pid process

948 InteliTrace.exe
768 SearchFillterHost.exe

pid	process
948	InteliTrace.exe
768	SearchFillterHost.exe

UPX packed file 8 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral1/memory/1420-58-0x0000000000400000-0x00000000004B8000-memory.dmp	upx
behavioral1/memory/1420-60-0x0000000000400000-0x00000000004B8000-memory.dmp	upx
behavioral1/memory/1420-61-0x0000000000400000-0x00000000004B8000-memory.dmp	upx
behavioral1/memory/1420-63-0x0000000000400000-0x00000000004B8000-memory.dmp	upx
behavioral1/memory/1420-65-0x0000000000400000-0x00000000004B8000-memory.dmp	upx
behavioral1/memory/1420-67-0x0000000000400000-0x00000000004B8000-memory.dmp	upx
behavioral1/memory/1420-68-0x0000000000400000-0x00000000004B8000-memory.dmp	upx
behavioral1/memory/1420-69-0x0000000000400000-0x00000000004B8000-memory.dmp	upx

Loads dropped DLL 3 IoCs

Processes:

e8f17fe148aacdc799ff3e3ae535c48b391b37e14d739e375793da1d50a1454f.exeInteliTrace.exe

pid	process
1760	e8f17fe148aacdc799ff3e3ae535c48b391b37e14d739e375793da1d50a1454f.exe
1760	e8f17fe148aacdc799ff3e3ae535c48b391b37e14d739e375793da1d50a1454f.exe
948	InteliTrace.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

InteliTrace.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft® Windows® Operating System = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Templates\\InteliTrace.exe"	InteliTrace.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

e8f17fe148aacdc799ff3e3ae535c48b391b37e14d739e375793da1d50a1454f.exe

description	pid	process	target process
PID 1760 set thread context of 1420	1760	e8f17fe148aacdc799ff3e3ae535c48b391b37e14d739e375793da1d50a1454f.exe	AppLaunch.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 27 IoCs

Processes:

e8f17fe148aacdc799ff3e3ae535c48b391b37e14d739e375793da1d50a1454f.exeInteliTrace.exe

pid	process
1760	e8f17fe148aacdc799ff3e3ae535c48b391b37e14d739e375793da1d50a1454f.exe
948	InteliTrace.exe
1760	e8f17fe148aacdc799ff3e3ae535c48b391b37e14d739e375793da1d50a1454f.exe
1760	e8f17fe148aacdc799ff3e3ae535c48b391b37e14d739e375793da1d50a1454f.exe
948	InteliTrace.exe
1760	e8f17fe148aacdc799ff3e3ae535c48b391b37e14d739e375793da1d50a1454f.exe
948	InteliTrace.exe
1760	e8f17fe148aacdc799ff3e3ae535c48b391b37e14d739e375793da1d50a1454f.exe
948	InteliTrace.exe
948	InteliTrace.exe
1760	e8f17fe148aacdc799ff3e3ae535c48b391b37e14d739e375793da1d50a1454f.exe
1760	e8f17fe148aacdc799ff3e3ae535c48b391b37e14d739e375793da1d50a1454f.exe
948	InteliTrace.exe
1760	e8f17fe148aacdc799ff3e3ae535c48b391b37e14d739e375793da1d50a1454f.exe
948	InteliTrace.exe
1760	e8f17fe148aacdc799ff3e3ae535c48b391b37e14d739e375793da1d50a1454f.exe
948	InteliTrace.exe
948	InteliTrace.exe
1760	e8f17fe148aacdc799ff3e3ae535c48b391b37e14d739e375793da1d50a1454f.exe
948	InteliTrace.exe
1760	e8f17fe148aacdc799ff3e3ae535c48b391b37e14d739e375793da1d50a1454f.exe
948	InteliTrace.exe
1760	e8f17fe148aacdc799ff3e3ae535c48b391b37e14d739e375793da1d50a1454f.exe
948	InteliTrace.exe
1760	e8f17fe148aacdc799ff3e3ae535c48b391b37e14d739e375793da1d50a1454f.exe
948	InteliTrace.exe
948	InteliTrace.exe

Suspicious use of AdjustPrivilegeToken 26 IoCs

Processes:

e8f17fe148aacdc799ff3e3ae535c48b391b37e14d739e375793da1d50a1454f.exeAppLaunch.exeInteliTrace.exeSearchFillterHost.exe

description	pid	process
Token: SeDebugPrivilege	1760	e8f17fe148aacdc799ff3e3ae535c48b391b37e14d739e375793da1d50a1454f.exe
Token: SeIncreaseQuotaPrivilege	1420	AppLaunch.exe
Token: SeSecurityPrivilege	1420	AppLaunch.exe
Token: SeTakeOwnershipPrivilege	1420	AppLaunch.exe
Token: SeLoadDriverPrivilege	1420	AppLaunch.exe
Token: SeSystemProfilePrivilege	1420	AppLaunch.exe
Token: SeSystemtimePrivilege	1420	AppLaunch.exe
Token: SeProfSingleProcessPrivilege	1420	AppLaunch.exe
Token: SeIncBasePriorityPrivilege	1420	AppLaunch.exe
Token: SeCreatePagefilePrivilege	1420	AppLaunch.exe
Token: SeBackupPrivilege	1420	AppLaunch.exe
Token: SeRestorePrivilege	1420	AppLaunch.exe
Token: SeShutdownPrivilege	1420	AppLaunch.exe
Token: SeDebugPrivilege	1420	AppLaunch.exe
Token: SeSystemEnvironmentPrivilege	1420	AppLaunch.exe
Token: SeChangeNotifyPrivilege	1420	AppLaunch.exe
Token: SeRemoteShutdownPrivilege	1420	AppLaunch.exe
Token: SeUndockPrivilege	1420	AppLaunch.exe
Token: SeManageVolumePrivilege	1420	AppLaunch.exe
Token: SeImpersonatePrivilege	1420	AppLaunch.exe
Token: SeCreateGlobalPrivilege	1420	AppLaunch.exe
Token: 33	1420	AppLaunch.exe
Token: 34	1420	AppLaunch.exe
Token: 35	1420	AppLaunch.exe
Token: SeDebugPrivilege	948	InteliTrace.exe
Token: SeDebugPrivilege	768	SearchFillterHost.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

AppLaunch.exe

pid process

1420 AppLaunch.exe

pid	process
1420	AppLaunch.exe

Suspicious use of WriteProcessMemory 19 IoCs

Processes:

e8f17fe148aacdc799ff3e3ae535c48b391b37e14d739e375793da1d50a1454f.exeInteliTrace.exe

description	pid	process	target process
PID 1760 wrote to memory of 1420	1760	e8f17fe148aacdc799ff3e3ae535c48b391b37e14d739e375793da1d50a1454f.exe	AppLaunch.exe
PID 1760 wrote to memory of 1420	1760	e8f17fe148aacdc799ff3e3ae535c48b391b37e14d739e375793da1d50a1454f.exe	AppLaunch.exe
PID 1760 wrote to memory of 1420	1760	e8f17fe148aacdc799ff3e3ae535c48b391b37e14d739e375793da1d50a1454f.exe	AppLaunch.exe
PID 1760 wrote to memory of 1420	1760	e8f17fe148aacdc799ff3e3ae535c48b391b37e14d739e375793da1d50a1454f.exe	AppLaunch.exe
PID 1760 wrote to memory of 1420	1760	e8f17fe148aacdc799ff3e3ae535c48b391b37e14d739e375793da1d50a1454f.exe	AppLaunch.exe
PID 1760 wrote to memory of 1420	1760	e8f17fe148aacdc799ff3e3ae535c48b391b37e14d739e375793da1d50a1454f.exe	AppLaunch.exe
PID 1760 wrote to memory of 1420	1760	e8f17fe148aacdc799ff3e3ae535c48b391b37e14d739e375793da1d50a1454f.exe	AppLaunch.exe
PID 1760 wrote to memory of 1420	1760	e8f17fe148aacdc799ff3e3ae535c48b391b37e14d739e375793da1d50a1454f.exe	AppLaunch.exe
PID 1760 wrote to memory of 1420	1760	e8f17fe148aacdc799ff3e3ae535c48b391b37e14d739e375793da1d50a1454f.exe	AppLaunch.exe
PID 1760 wrote to memory of 1420	1760	e8f17fe148aacdc799ff3e3ae535c48b391b37e14d739e375793da1d50a1454f.exe	AppLaunch.exe
PID 1760 wrote to memory of 1420	1760	e8f17fe148aacdc799ff3e3ae535c48b391b37e14d739e375793da1d50a1454f.exe	AppLaunch.exe
PID 1760 wrote to memory of 948	1760	e8f17fe148aacdc799ff3e3ae535c48b391b37e14d739e375793da1d50a1454f.exe	InteliTrace.exe
PID 1760 wrote to memory of 948	1760	e8f17fe148aacdc799ff3e3ae535c48b391b37e14d739e375793da1d50a1454f.exe	InteliTrace.exe
PID 1760 wrote to memory of 948	1760	e8f17fe148aacdc799ff3e3ae535c48b391b37e14d739e375793da1d50a1454f.exe	InteliTrace.exe
PID 1760 wrote to memory of 948	1760	e8f17fe148aacdc799ff3e3ae535c48b391b37e14d739e375793da1d50a1454f.exe	InteliTrace.exe
PID 948 wrote to memory of 768	948	InteliTrace.exe	SearchFillterHost.exe
PID 948 wrote to memory of 768	948	InteliTrace.exe	SearchFillterHost.exe
PID 948 wrote to memory of 768	948	InteliTrace.exe	SearchFillterHost.exe
PID 948 wrote to memory of 768	948	InteliTrace.exe	SearchFillterHost.exe

C:\Users\Admin\AppData\Local\Temp\e8f17fe148aacdc799ff3e3ae535c48b391b37e14d739e375793da1d50a1454f.exe
"C:\Users\Admin\AppData\Local\Temp\e8f17fe148aacdc799ff3e3ae535c48b391b37e14d739e375793da1d50a1454f.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1760

C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
2⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1420

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\InteliTrace.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\InteliTrace.exe"
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:948

C:\Users\Admin\AppData\Local\Temp\SearchFillterHost.exe
"C:\Users\Admin\AppData\Local\Temp\SearchFillterHost.exe"
3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:768

C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
4⤵
PID:1724

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\SearchFillterHost.exe
Filesize
291KB

MD5
fdd2c8263c374973bc7cb9f0602b04ba

SHA1
8cc09844a1116b7f09d09160ae0743fbf2b39e35

SHA256
e8f17fe148aacdc799ff3e3ae535c48b391b37e14d739e375793da1d50a1454f

SHA512
a8faa425ac72dd205e1fa1aeb6c650e724e57469695b1b87679ea735c6e59096712580516f82b0681337e4eeec2cc0067018d85a6175b2cee943ee91299a2cb5

Download Submit
C:\Users\Admin\AppData\Local\Temp\SearchFillterHost.exe
Filesize
291KB

MD5
fdd2c8263c374973bc7cb9f0602b04ba

SHA1
8cc09844a1116b7f09d09160ae0743fbf2b39e35

SHA256
e8f17fe148aacdc799ff3e3ae535c48b391b37e14d739e375793da1d50a1454f

SHA512
a8faa425ac72dd205e1fa1aeb6c650e724e57469695b1b87679ea735c6e59096712580516f82b0681337e4eeec2cc0067018d85a6175b2cee943ee91299a2cb5

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\InteliTrace.exe
Filesize
11KB

MD5
cdeded8ead5d39201de62c94384f7150

SHA1
d192015704227f395abe79a67cc35aaf28910774

SHA256
3e2eca577cfa3d8bcf583b5c6fb07e4e44f46cb95228b20e975d562b635c4031

SHA512
2fa02cda0c22208f947ff925396cd3f97db447e4fb5365ba61dfc0715d183fd36ad18d527b775beb5efcc03f07ae931d4be73531693d8050cf2b689a7f988e5f

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\InteliTrace.exe
Filesize
11KB

MD5
cdeded8ead5d39201de62c94384f7150

SHA1
d192015704227f395abe79a67cc35aaf28910774

SHA256
3e2eca577cfa3d8bcf583b5c6fb07e4e44f46cb95228b20e975d562b635c4031

SHA512
2fa02cda0c22208f947ff925396cd3f97db447e4fb5365ba61dfc0715d183fd36ad18d527b775beb5efcc03f07ae931d4be73531693d8050cf2b689a7f988e5f

Download Submit
\Users\Admin\AppData\Local\Temp\SearchFillterHost.exe
Filesize
291KB

MD5
fdd2c8263c374973bc7cb9f0602b04ba

SHA1
8cc09844a1116b7f09d09160ae0743fbf2b39e35

SHA256
e8f17fe148aacdc799ff3e3ae535c48b391b37e14d739e375793da1d50a1454f

SHA512
a8faa425ac72dd205e1fa1aeb6c650e724e57469695b1b87679ea735c6e59096712580516f82b0681337e4eeec2cc0067018d85a6175b2cee943ee91299a2cb5

Download Submit
\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\InteliTrace.exe
Filesize
11KB

MD5
cdeded8ead5d39201de62c94384f7150

SHA1
d192015704227f395abe79a67cc35aaf28910774

SHA256
3e2eca577cfa3d8bcf583b5c6fb07e4e44f46cb95228b20e975d562b635c4031

SHA512
2fa02cda0c22208f947ff925396cd3f97db447e4fb5365ba61dfc0715d183fd36ad18d527b775beb5efcc03f07ae931d4be73531693d8050cf2b689a7f988e5f

Download Submit
\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\InteliTrace.exe
Filesize
11KB

MD5
cdeded8ead5d39201de62c94384f7150

SHA1
d192015704227f395abe79a67cc35aaf28910774

SHA256
3e2eca577cfa3d8bcf583b5c6fb07e4e44f46cb95228b20e975d562b635c4031

SHA512
2fa02cda0c22208f947ff925396cd3f97db447e4fb5365ba61dfc0715d183fd36ad18d527b775beb5efcc03f07ae931d4be73531693d8050cf2b689a7f988e5f

Download Submit
memory/768-86-0x00000000741F0000-0x000000007479B000-memory.dmp

Filesize
5.7MB

Download
memory/768-83-0x00000000741F0000-0x000000007479B000-memory.dmp

Filesize
5.7MB

Download
memory/768-80-0x0000000000000000-mapping.dmp

Download
memory/948-72-0x0000000000000000-mapping.dmp

Download
memory/948-77-0x00000000741F0000-0x000000007479B000-memory.dmp

Filesize
5.7MB

Download
memory/948-85-0x00000000741F0000-0x000000007479B000-memory.dmp

Filesize
5.7MB

Download
memory/1420-65-0x0000000000400000-0x00000000004B8000-memory.dmp

Filesize
736KB

Download
memory/1420-58-0x0000000000400000-0x00000000004B8000-memory.dmp

Filesize
736KB

Download
memory/1420-68-0x0000000000400000-0x00000000004B8000-memory.dmp

Filesize
736KB

Download
memory/1420-63-0x0000000000400000-0x00000000004B8000-memory.dmp

Filesize
736KB

Download
memory/1420-62-0x00000000004B67F0-mapping.dmp

Download
memory/1420-76-0x000000000047C000-0x00000000004B7000-memory.dmp

Filesize
236KB

Download
memory/1420-67-0x0000000000400000-0x00000000004B8000-memory.dmp

Filesize
736KB

Download
memory/1420-61-0x0000000000400000-0x00000000004B8000-memory.dmp

Filesize
736KB

Download
memory/1420-60-0x0000000000400000-0x00000000004B8000-memory.dmp

Filesize
736KB

Download
memory/1420-69-0x0000000000400000-0x00000000004B8000-memory.dmp

Filesize
736KB

Download
memory/1420-57-0x0000000000400000-0x00000000004B8000-memory.dmp

Filesize
736KB

Download
memory/1420-84-0x000000000047C000-0x00000000004B7000-memory.dmp

Filesize
236KB

Download
memory/1724-92-0x00000000004B67F0-mapping.dmp

Download
memory/1724-100-0x000000000047C000-0x00000000004B7000-memory.dmp

Filesize
236KB

Download
memory/1760-56-0x00000000741F0000-0x000000007479B000-memory.dmp

Filesize
5.7MB

Download
memory/1760-54-0x0000000075C51000-0x0000000075C53000-memory.dmp

Filesize
8KB

Download
memory/1760-55-0x00000000741F0000-0x000000007479B000-memory.dmp

Filesize
5.7MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads