darkcomet | cb52e03ba2b9c50027bb82a2f634503475daeb72de895d4a11ba3fcf7134b04e

General

Target

cb52e03ba2b9c50027bb82a2f634503475daeb72de895d4a11ba3fcf7134b04e.exe
Size

677KB
MD5

8e005c2cfc3587fa3e58654830eecf71
SHA1

e3aae32ec4b90c8081028a84e59c66dce6da6256
SHA256

cb52e03ba2b9c50027bb82a2f634503475daeb72de895d4a11ba3fcf7134b04e
SHA512

a488df5f89a548ac33345b2d56873c1df1a6b5f5aef7759f62f685523621a0582a64cf726abb057203b542099b84cb928417845d46872ab0be18d391568f97b1
SSDEEP

12288:cE37EefSqPHVvHm0FPNPtrc4usQ59S+B+i9X6nLXv:fEehPFHHPNJcuQ/f9X2

Score

10^/10

darkcomet guest16_min rat trojan

Malware Config

Extracted

Family

darkcomet

Botnet

Guest16_min

C2

tast.no-ip.biz:82

Mutex

DCMIN_MUTEX-F9J9EBC

Attributes

gencode
1jx38nt7Eeyk
install
false
offline_keylogger
true
persistence
false

Signatures

Darkcomet
DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
trojan rat darkcomet

Executes dropped EXE 1 IoCs

pid	Process
4968	winlogon.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation	cb52e03ba2b9c50027bb82a2f634503475daeb72de895d4a11ba3fcf7134b04e.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
2540	cb52e03ba2b9c50027bb82a2f634503475daeb72de895d4a11ba3fcf7134b04e.exe
2540	cb52e03ba2b9c50027bb82a2f634503475daeb72de895d4a11ba3fcf7134b04e.exe
2540	cb52e03ba2b9c50027bb82a2f634503475daeb72de895d4a11ba3fcf7134b04e.exe
2540	cb52e03ba2b9c50027bb82a2f634503475daeb72de895d4a11ba3fcf7134b04e.exe
2540	cb52e03ba2b9c50027bb82a2f634503475daeb72de895d4a11ba3fcf7134b04e.exe
2540	cb52e03ba2b9c50027bb82a2f634503475daeb72de895d4a11ba3fcf7134b04e.exe
2540	cb52e03ba2b9c50027bb82a2f634503475daeb72de895d4a11ba3fcf7134b04e.exe
2540	cb52e03ba2b9c50027bb82a2f634503475daeb72de895d4a11ba3fcf7134b04e.exe

Suspicious use of AdjustPrivilegeToken 25 IoCs

description	pid	Process
Token: SeDebugPrivilege	2540	cb52e03ba2b9c50027bb82a2f634503475daeb72de895d4a11ba3fcf7134b04e.exe
Token: SeIncreaseQuotaPrivilege	4968	winlogon.exe
Token: SeSecurityPrivilege	4968	winlogon.exe
Token: SeTakeOwnershipPrivilege	4968	winlogon.exe
Token: SeLoadDriverPrivilege	4968	winlogon.exe
Token: SeSystemProfilePrivilege	4968	winlogon.exe
Token: SeSystemtimePrivilege	4968	winlogon.exe
Token: SeProfSingleProcessPrivilege	4968	winlogon.exe
Token: SeIncBasePriorityPrivilege	4968	winlogon.exe
Token: SeCreatePagefilePrivilege	4968	winlogon.exe
Token: SeBackupPrivilege	4968	winlogon.exe
Token: SeRestorePrivilege	4968	winlogon.exe
Token: SeShutdownPrivilege	4968	winlogon.exe
Token: SeDebugPrivilege	4968	winlogon.exe
Token: SeSystemEnvironmentPrivilege	4968	winlogon.exe
Token: SeChangeNotifyPrivilege	4968	winlogon.exe
Token: SeRemoteShutdownPrivilege	4968	winlogon.exe
Token: SeUndockPrivilege	4968	winlogon.exe
Token: SeManageVolumePrivilege	4968	winlogon.exe
Token: SeImpersonatePrivilege	4968	winlogon.exe
Token: SeCreateGlobalPrivilege	4968	winlogon.exe
Token: 33	4968	winlogon.exe
Token: 34	4968	winlogon.exe
Token: 35	4968	winlogon.exe
Token: 36	4968	winlogon.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4968	winlogon.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2540 wrote to memory of 4968	2540	cb52e03ba2b9c50027bb82a2f634503475daeb72de895d4a11ba3fcf7134b04e.exe	80
PID 2540 wrote to memory of 4968	2540	cb52e03ba2b9c50027bb82a2f634503475daeb72de895d4a11ba3fcf7134b04e.exe	80
PID 2540 wrote to memory of 4968	2540	cb52e03ba2b9c50027bb82a2f634503475daeb72de895d4a11ba3fcf7134b04e.exe	80

C:\Users\Admin\AppData\Local\Temp\cb52e03ba2b9c50027bb82a2f634503475daeb72de895d4a11ba3fcf7134b04e.exe
"C:\Users\Admin\AppData\Local\Temp\cb52e03ba2b9c50027bb82a2f634503475daeb72de895d4a11ba3fcf7134b04e.exe"
1⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2540
- C:\Users\Admin\AppData\Roaming\winlogon.exe
  "C:\Users\Admin\AppData\Roaming\winlogon.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:4968

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\winlogon.exe

Filesize
660KB

MD5
92ed56df4ce7ea8de458da9552fb4c37

SHA1
c6aeb88e5d9eced46113a4520fea4c8971fb68f6

SHA256
816114882f3cb9575203687f5177ec3254d6906291f9eb8610728279610c70e5

SHA512
dafec46acac98f082ca99023c2279fadb09a6d787a518c62881458a8f3eea2eef845a7155dee4481e51ab723b1e9ac80865dba05a5d0a1b76294e086bad6aae1

Download Submit
C:\Users\Admin\AppData\Roaming\winlogon.exe

Filesize
660KB

MD5
92ed56df4ce7ea8de458da9552fb4c37

SHA1
c6aeb88e5d9eced46113a4520fea4c8971fb68f6

SHA256
816114882f3cb9575203687f5177ec3254d6906291f9eb8610728279610c70e5

SHA512
dafec46acac98f082ca99023c2279fadb09a6d787a518c62881458a8f3eea2eef845a7155dee4481e51ab723b1e9ac80865dba05a5d0a1b76294e086bad6aae1

Download Submit
memory/2540-132-0x0000000000090000-0x0000000000140000-memory.dmp

Filesize
704KB

Download
memory/2540-133-0x00007FFF39CB0000-0x00007FFF3A771000-memory.dmp

Filesize
10.8MB

Download
memory/2540-136-0x00007FFF39CB0000-0x00007FFF3A771000-memory.dmp

Filesize
10.8MB

Download

Analysis

Sharing