darkcomet | d05fe560a6792e7670d3c364aca662404419987da09053677fd82ec22e3d6b81

General

Target

d05fe560a6792e7670d3c364aca662404419987da09053677fd82ec22e3d6b81.exe
Size

360KB
MD5

e9315ceafef7f09fbbb52d99ef06cc32
SHA1

390d24ca5949883294ef10585ca1fce11016ce9c
SHA256

d05fe560a6792e7670d3c364aca662404419987da09053677fd82ec22e3d6b81
SHA512

7f8f21337f6cd8024d257efc8c92c7fda03f72a4b9b2aa9647df65171aaeaf5a427953043a19f44660d9b10ab1d6b2f368178f6e0c738fbce7ee9aedec745625
SSDEEP

6144:ljXmPZ3/BL3LuJ5Toj6ZbpgsU1spq/0BHKRVSPndFGzv2dHkUZ8uqL+Dpi2+x:lih3NuJ5ToYRUCHKLSmzedHpZCL+Ox

Score

10^/10

darkcomet guest16 rat trojan

Malware Config

Extracted

Family

darkcomet

Botnet

Guest16

C2

sattam.no-ip.biz:1604

Mutex

DC_MUTEX-TELC5DX

Attributes

gencode
0AZVTE47t6Fe
install
false
offline_keylogger
true
persistence
false

Signatures

Darkcomet
DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
trojan rat darkcomet

Suspicious use of SetThreadContext 1 IoCs

Processes:

d05fe560a6792e7670d3c364aca662404419987da09053677fd82ec22e3d6b81.exe

description	pid	process	target process
PID 1788 set thread context of 4964	1788	d05fe560a6792e7670d3c364aca662404419987da09053677fd82ec22e3d6b81.exe	d05fe560a6792e7670d3c364aca662404419987da09053677fd82ec22e3d6b81.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

d05fe560a6792e7670d3c364aca662404419987da09053677fd82ec22e3d6b81.exe

pid process

4964 d05fe560a6792e7670d3c364aca662404419987da09053677fd82ec22e3d6b81.exe

pid	process
4964	d05fe560a6792e7670d3c364aca662404419987da09053677fd82ec22e3d6b81.exe

Suspicious use of AdjustPrivilegeToken 26 IoCs

Processes:

d05fe560a6792e7670d3c364aca662404419987da09053677fd82ec22e3d6b81.exed05fe560a6792e7670d3c364aca662404419987da09053677fd82ec22e3d6b81.exe

description	pid	process
Token: 33	1788	d05fe560a6792e7670d3c364aca662404419987da09053677fd82ec22e3d6b81.exe
Token: SeIncBasePriorityPrivilege	1788	d05fe560a6792e7670d3c364aca662404419987da09053677fd82ec22e3d6b81.exe
Token: SeIncreaseQuotaPrivilege	4964	d05fe560a6792e7670d3c364aca662404419987da09053677fd82ec22e3d6b81.exe
Token: SeSecurityPrivilege	4964	d05fe560a6792e7670d3c364aca662404419987da09053677fd82ec22e3d6b81.exe
Token: SeTakeOwnershipPrivilege	4964	d05fe560a6792e7670d3c364aca662404419987da09053677fd82ec22e3d6b81.exe
Token: SeLoadDriverPrivilege	4964	d05fe560a6792e7670d3c364aca662404419987da09053677fd82ec22e3d6b81.exe
Token: SeSystemProfilePrivilege	4964	d05fe560a6792e7670d3c364aca662404419987da09053677fd82ec22e3d6b81.exe
Token: SeSystemtimePrivilege	4964	d05fe560a6792e7670d3c364aca662404419987da09053677fd82ec22e3d6b81.exe
Token: SeProfSingleProcessPrivilege	4964	d05fe560a6792e7670d3c364aca662404419987da09053677fd82ec22e3d6b81.exe
Token: SeIncBasePriorityPrivilege	4964	d05fe560a6792e7670d3c364aca662404419987da09053677fd82ec22e3d6b81.exe
Token: SeCreatePagefilePrivilege	4964	d05fe560a6792e7670d3c364aca662404419987da09053677fd82ec22e3d6b81.exe
Token: SeBackupPrivilege	4964	d05fe560a6792e7670d3c364aca662404419987da09053677fd82ec22e3d6b81.exe
Token: SeRestorePrivilege	4964	d05fe560a6792e7670d3c364aca662404419987da09053677fd82ec22e3d6b81.exe
Token: SeShutdownPrivilege	4964	d05fe560a6792e7670d3c364aca662404419987da09053677fd82ec22e3d6b81.exe
Token: SeDebugPrivilege	4964	d05fe560a6792e7670d3c364aca662404419987da09053677fd82ec22e3d6b81.exe
Token: SeSystemEnvironmentPrivilege	4964	d05fe560a6792e7670d3c364aca662404419987da09053677fd82ec22e3d6b81.exe
Token: SeChangeNotifyPrivilege	4964	d05fe560a6792e7670d3c364aca662404419987da09053677fd82ec22e3d6b81.exe
Token: SeRemoteShutdownPrivilege	4964	d05fe560a6792e7670d3c364aca662404419987da09053677fd82ec22e3d6b81.exe
Token: SeUndockPrivilege	4964	d05fe560a6792e7670d3c364aca662404419987da09053677fd82ec22e3d6b81.exe
Token: SeManageVolumePrivilege	4964	d05fe560a6792e7670d3c364aca662404419987da09053677fd82ec22e3d6b81.exe
Token: SeImpersonatePrivilege	4964	d05fe560a6792e7670d3c364aca662404419987da09053677fd82ec22e3d6b81.exe
Token: SeCreateGlobalPrivilege	4964	d05fe560a6792e7670d3c364aca662404419987da09053677fd82ec22e3d6b81.exe
Token: 33	4964	d05fe560a6792e7670d3c364aca662404419987da09053677fd82ec22e3d6b81.exe
Token: 34	4964	d05fe560a6792e7670d3c364aca662404419987da09053677fd82ec22e3d6b81.exe
Token: 35	4964	d05fe560a6792e7670d3c364aca662404419987da09053677fd82ec22e3d6b81.exe
Token: 36	4964	d05fe560a6792e7670d3c364aca662404419987da09053677fd82ec22e3d6b81.exe

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

d05fe560a6792e7670d3c364aca662404419987da09053677fd82ec22e3d6b81.exed05fe560a6792e7670d3c364aca662404419987da09053677fd82ec22e3d6b81.exe

pid	process
1788	d05fe560a6792e7670d3c364aca662404419987da09053677fd82ec22e3d6b81.exe
4964	d05fe560a6792e7670d3c364aca662404419987da09053677fd82ec22e3d6b81.exe

Suspicious use of WriteProcessMemory 14 IoCs

Processes:

d05fe560a6792e7670d3c364aca662404419987da09053677fd82ec22e3d6b81.exe

description	pid	process	target process
PID 1788 wrote to memory of 4964	1788	d05fe560a6792e7670d3c364aca662404419987da09053677fd82ec22e3d6b81.exe	d05fe560a6792e7670d3c364aca662404419987da09053677fd82ec22e3d6b81.exe
PID 1788 wrote to memory of 4964	1788	d05fe560a6792e7670d3c364aca662404419987da09053677fd82ec22e3d6b81.exe	d05fe560a6792e7670d3c364aca662404419987da09053677fd82ec22e3d6b81.exe
PID 1788 wrote to memory of 4964	1788	d05fe560a6792e7670d3c364aca662404419987da09053677fd82ec22e3d6b81.exe	d05fe560a6792e7670d3c364aca662404419987da09053677fd82ec22e3d6b81.exe
PID 1788 wrote to memory of 4964	1788	d05fe560a6792e7670d3c364aca662404419987da09053677fd82ec22e3d6b81.exe	d05fe560a6792e7670d3c364aca662404419987da09053677fd82ec22e3d6b81.exe
PID 1788 wrote to memory of 4964	1788	d05fe560a6792e7670d3c364aca662404419987da09053677fd82ec22e3d6b81.exe	d05fe560a6792e7670d3c364aca662404419987da09053677fd82ec22e3d6b81.exe
PID 1788 wrote to memory of 4964	1788	d05fe560a6792e7670d3c364aca662404419987da09053677fd82ec22e3d6b81.exe	d05fe560a6792e7670d3c364aca662404419987da09053677fd82ec22e3d6b81.exe
PID 1788 wrote to memory of 4964	1788	d05fe560a6792e7670d3c364aca662404419987da09053677fd82ec22e3d6b81.exe	d05fe560a6792e7670d3c364aca662404419987da09053677fd82ec22e3d6b81.exe
PID 1788 wrote to memory of 4964	1788	d05fe560a6792e7670d3c364aca662404419987da09053677fd82ec22e3d6b81.exe	d05fe560a6792e7670d3c364aca662404419987da09053677fd82ec22e3d6b81.exe
PID 1788 wrote to memory of 4964	1788	d05fe560a6792e7670d3c364aca662404419987da09053677fd82ec22e3d6b81.exe	d05fe560a6792e7670d3c364aca662404419987da09053677fd82ec22e3d6b81.exe
PID 1788 wrote to memory of 4964	1788	d05fe560a6792e7670d3c364aca662404419987da09053677fd82ec22e3d6b81.exe	d05fe560a6792e7670d3c364aca662404419987da09053677fd82ec22e3d6b81.exe
PID 1788 wrote to memory of 4964	1788	d05fe560a6792e7670d3c364aca662404419987da09053677fd82ec22e3d6b81.exe	d05fe560a6792e7670d3c364aca662404419987da09053677fd82ec22e3d6b81.exe
PID 1788 wrote to memory of 4964	1788	d05fe560a6792e7670d3c364aca662404419987da09053677fd82ec22e3d6b81.exe	d05fe560a6792e7670d3c364aca662404419987da09053677fd82ec22e3d6b81.exe
PID 1788 wrote to memory of 4964	1788	d05fe560a6792e7670d3c364aca662404419987da09053677fd82ec22e3d6b81.exe	d05fe560a6792e7670d3c364aca662404419987da09053677fd82ec22e3d6b81.exe
PID 1788 wrote to memory of 4964	1788	d05fe560a6792e7670d3c364aca662404419987da09053677fd82ec22e3d6b81.exe	d05fe560a6792e7670d3c364aca662404419987da09053677fd82ec22e3d6b81.exe

C:\Users\Admin\AppData\Local\Temp\d05fe560a6792e7670d3c364aca662404419987da09053677fd82ec22e3d6b81.exe
"C:\Users\Admin\AppData\Local\Temp\d05fe560a6792e7670d3c364aca662404419987da09053677fd82ec22e3d6b81.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1788

C:\Users\Admin\AppData\Local\Temp\d05fe560a6792e7670d3c364aca662404419987da09053677fd82ec22e3d6b81.exe
2⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:4964

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1788-132-0x0000000000400000-0x00000000006F1000-memory.dmp

Filesize
2.9MB

Download
memory/1788-133-0x0000000000400000-0x00000000006F1000-memory.dmp

Filesize
2.9MB

Download
memory/1788-134-0x0000000000790000-0x0000000000793000-memory.dmp

Filesize
12KB

Download
memory/1788-135-0x0000000000400000-0x00000000006F1000-memory.dmp

Filesize
2.9MB

Download
memory/1788-141-0x0000000000400000-0x00000000006F1000-memory.dmp

Filesize
2.9MB

Download
memory/4964-138-0x0000000000000000-mapping.dmp

Download
memory/4964-139-0x0000000000400000-0x00000000004C8000-memory.dmp

Filesize
800KB

Download
memory/4964-140-0x0000000000400000-0x00000000004C8000-memory.dmp

Filesize
800KB

Download
memory/4964-142-0x0000000000400000-0x00000000004C8000-memory.dmp

Filesize
800KB

Download
memory/4964-143-0x0000000000400000-0x00000000004C8000-memory.dmp

Filesize
800KB

Download
memory/4964-144-0x0000000000400000-0x00000000004C8000-memory.dmp

Filesize
800KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads