darkcomet | e770e0c3d4ceed1562df98de7eb4a72728be2e71d8935a55ebe531bffd57c552

General

Target

e770e0c3d4ceed1562df98de7eb4a72728be2e71d8935a55ebe531bffd57c552.exe
Size

1.4MB
MD5

e5aaaac2fcd910193e0e68491a549308
SHA1

41a38a84a97599310e5cdacf04b16da6aded7697
SHA256

e770e0c3d4ceed1562df98de7eb4a72728be2e71d8935a55ebe531bffd57c552
SHA512

cd39febbfed12dda594cd057c21c88f0a2834fed9c5efeac6b0066dd39a4111c1b10343c23bfa8bb317fbf9d22e700cbd3ebefc31ebb56dcbe12be02983b58f0
SSDEEP

24576:6iC8pRuPliuuYmjBgtojHLJR533s4GoBg80IaKqVrS7i0ZESx3Y:6YpUPliuuYYutoTLJR533SoBg8bqxSJG

Score

10^/10

darkcomet rat trojan

Malware Config

Signatures

Darkcomet
DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
trojan rat darkcomet

Executes dropped EXE 2 IoCs

pid	Process
3340	37220480ea4d438894b4623fabdfa72c.exe
1520	255dbe18a8a1481cb9a535bb5df58088.exe

Checks BIOS information in registry 2 TTPs 1 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate	vbc.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation	e770e0c3d4ceed1562df98de7eb4a72728be2e71d8935a55ebe531bffd57c552.exe

Uses the VBS compiler for execution 1 TTPs

Scripting
T1064

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3340 set thread context of 2288	3340	37220480ea4d438894b4623fabdfa72c.exe	83

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	vbc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	vbc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	vbc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	vbc.exe

Enumerates system info in registry 2 TTPs 1 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	vbc.exe

Suspicious use of AdjustPrivilegeToken 24 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	2288	vbc.exe
Token: SeSecurityPrivilege	2288	vbc.exe
Token: SeTakeOwnershipPrivilege	2288	vbc.exe
Token: SeLoadDriverPrivilege	2288	vbc.exe
Token: SeSystemProfilePrivilege	2288	vbc.exe
Token: SeSystemtimePrivilege	2288	vbc.exe
Token: SeProfSingleProcessPrivilege	2288	vbc.exe
Token: SeIncBasePriorityPrivilege	2288	vbc.exe
Token: SeCreatePagefilePrivilege	2288	vbc.exe
Token: SeBackupPrivilege	2288	vbc.exe
Token: SeRestorePrivilege	2288	vbc.exe
Token: SeShutdownPrivilege	2288	vbc.exe
Token: SeDebugPrivilege	2288	vbc.exe
Token: SeSystemEnvironmentPrivilege	2288	vbc.exe
Token: SeChangeNotifyPrivilege	2288	vbc.exe
Token: SeRemoteShutdownPrivilege	2288	vbc.exe
Token: SeUndockPrivilege	2288	vbc.exe
Token: SeManageVolumePrivilege	2288	vbc.exe
Token: SeImpersonatePrivilege	2288	vbc.exe
Token: SeCreateGlobalPrivilege	2288	vbc.exe
Token: 33	2288	vbc.exe
Token: 34	2288	vbc.exe
Token: 35	2288	vbc.exe
Token: 36	2288	vbc.exe

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 5052 wrote to memory of 3340	5052	e770e0c3d4ceed1562df98de7eb4a72728be2e71d8935a55ebe531bffd57c552.exe	81
PID 5052 wrote to memory of 3340	5052	e770e0c3d4ceed1562df98de7eb4a72728be2e71d8935a55ebe531bffd57c552.exe	81
PID 5052 wrote to memory of 3340	5052	e770e0c3d4ceed1562df98de7eb4a72728be2e71d8935a55ebe531bffd57c552.exe	81
PID 5052 wrote to memory of 1520	5052	e770e0c3d4ceed1562df98de7eb4a72728be2e71d8935a55ebe531bffd57c552.exe	82
PID 5052 wrote to memory of 1520	5052	e770e0c3d4ceed1562df98de7eb4a72728be2e71d8935a55ebe531bffd57c552.exe	82
PID 5052 wrote to memory of 1520	5052	e770e0c3d4ceed1562df98de7eb4a72728be2e71d8935a55ebe531bffd57c552.exe	82
PID 3340 wrote to memory of 2288	3340	37220480ea4d438894b4623fabdfa72c.exe	83
PID 3340 wrote to memory of 2288	3340	37220480ea4d438894b4623fabdfa72c.exe	83
PID 3340 wrote to memory of 2288	3340	37220480ea4d438894b4623fabdfa72c.exe	83
PID 3340 wrote to memory of 2288	3340	37220480ea4d438894b4623fabdfa72c.exe	83
PID 3340 wrote to memory of 2288	3340	37220480ea4d438894b4623fabdfa72c.exe	83
PID 3340 wrote to memory of 2288	3340	37220480ea4d438894b4623fabdfa72c.exe	83
PID 3340 wrote to memory of 2288	3340	37220480ea4d438894b4623fabdfa72c.exe	83
PID 3340 wrote to memory of 2288	3340	37220480ea4d438894b4623fabdfa72c.exe	83
PID 3340 wrote to memory of 2288	3340	37220480ea4d438894b4623fabdfa72c.exe	83
PID 3340 wrote to memory of 2288	3340	37220480ea4d438894b4623fabdfa72c.exe	83
PID 3340 wrote to memory of 2288	3340	37220480ea4d438894b4623fabdfa72c.exe	83
PID 3340 wrote to memory of 2288	3340	37220480ea4d438894b4623fabdfa72c.exe	83
PID 3340 wrote to memory of 2288	3340	37220480ea4d438894b4623fabdfa72c.exe	83
PID 3340 wrote to memory of 2288	3340	37220480ea4d438894b4623fabdfa72c.exe	83

C:\Users\Admin\AppData\Local\Temp\e770e0c3d4ceed1562df98de7eb4a72728be2e71d8935a55ebe531bffd57c552.exe
"C:\Users\Admin\AppData\Local\Temp\e770e0c3d4ceed1562df98de7eb4a72728be2e71d8935a55ebe531bffd57c552.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:5052
- C:\Users\Admin\AppData\Local\Temp\37220480ea4d438894b4623fabdfa72c.exe
  "C:\Users\Admin\AppData\Local\Temp\37220480ea4d438894b4623fabdfa72c.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:3340
- - C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
    C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
    3⤵
    - Checks BIOS information in registry
    - Checks processor information in registry
    - Enumerates system info in registry
    - Suspicious use of AdjustPrivilegeToken
    PID:2288
- C:\Users\Admin\AppData\Local\Temp\255dbe18a8a1481cb9a535bb5df58088.exe
  "C:\Users\Admin\AppData\Local\Temp\255dbe18a8a1481cb9a535bb5df58088.exe"
  2⤵
  - Executes dropped EXE
  PID:1520

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scripting

1

T1064

Persistence

Privilege Escalation

Defense Evasion

Scripting

1

T1064

Credential Access

Discovery

Query Registry

4

T1012

System Information Discovery

5

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\255dbe18a8a1481cb9a535bb5df58088.exe

Filesize
188KB

MD5
67fc3caef08bd36a362bafc15d7a363b

SHA1
797f9e84a63b2d18656a6a9bd8794d25ffe1921b

SHA256
dddc5b4f3b43ec0aad7c36d97df3d6206356e1eae709644db014a5d4a26cd495

SHA512
31075cbbf21f1f4b4f3f5c52434e7856ea3c789760d793e982e31c0262d81ba00afc7bc7e17ab285ae2251d4848d9c6f77f9b8d981555006b7bc8d13628a3cce

Download Submit
C:\Users\Admin\AppData\Local\Temp\255dbe18a8a1481cb9a535bb5df58088.exe

Filesize
188KB

MD5
67fc3caef08bd36a362bafc15d7a363b

SHA1
797f9e84a63b2d18656a6a9bd8794d25ffe1921b

SHA256
dddc5b4f3b43ec0aad7c36d97df3d6206356e1eae709644db014a5d4a26cd495

SHA512
31075cbbf21f1f4b4f3f5c52434e7856ea3c789760d793e982e31c0262d81ba00afc7bc7e17ab285ae2251d4848d9c6f77f9b8d981555006b7bc8d13628a3cce

Download Submit
C:\Users\Admin\AppData\Local\Temp\37220480ea4d438894b4623fabdfa72c.exe

Filesize
947KB

MD5
4765736a08a7eb356a47b46b296089a3

SHA1
a9b7293c9c976fb7b63b0b194742779df8bd9c26

SHA256
fe6dc4d190ee5fd064e80b35391706fbe7dbf262c4e4bd5ec1f1d43206d788df

SHA512
9f32c4f06fc1e85303ba5c041dd434933945afa66c205d662d1ca406ffb8dfb42ebc08fee696f9c2521dbd85143f1de559afa4a7dbfddf33330de4bf00a9d0d8

Download Submit
C:\Users\Admin\AppData\Local\Temp\37220480ea4d438894b4623fabdfa72c.exe

Filesize
947KB

MD5
4765736a08a7eb356a47b46b296089a3

SHA1
a9b7293c9c976fb7b63b0b194742779df8bd9c26

SHA256
fe6dc4d190ee5fd064e80b35391706fbe7dbf262c4e4bd5ec1f1d43206d788df

SHA512
9f32c4f06fc1e85303ba5c041dd434933945afa66c205d662d1ca406ffb8dfb42ebc08fee696f9c2521dbd85143f1de559afa4a7dbfddf33330de4bf00a9d0d8

Download Submit
memory/1520-142-0x0000000005580000-0x0000000005B24000-memory.dmp

Filesize
5.6MB

Download
memory/1520-143-0x0000000005070000-0x0000000005102000-memory.dmp

Filesize
584KB

Download
memory/1520-148-0x0000000005260000-0x00000000052B6000-memory.dmp

Filesize
344KB

Download
memory/1520-146-0x0000000005060000-0x000000000506A000-memory.dmp

Filesize
40KB

Download
memory/1520-139-0x0000000000700000-0x0000000000736000-memory.dmp

Filesize
216KB

Download
memory/1520-141-0x0000000004F20000-0x0000000004FBC000-memory.dmp

Filesize
624KB

Download
memory/2288-145-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/2288-147-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/2288-149-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/2288-151-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/2288-152-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/3340-140-0x0000000074CD0000-0x0000000075281000-memory.dmp

Filesize
5.7MB

Download
memory/3340-150-0x0000000074CD0000-0x0000000075281000-memory.dmp

Filesize
5.7MB

Download
memory/5052-132-0x00007FFFDD650000-0x00007FFFDE086000-memory.dmp

Filesize
10.2MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads