darkcomet | e301cc5de70d8cc55ac87de0f7f974860090b20bf895f7440515e0d6ed65024e

General

Target

e301cc5de70d8cc55ac87de0f7f974860090b20bf895f7440515e0d6ed65024e.exe
Size

1.1MB
MD5

16c166c342b404f53ae55d2cd94c77d8
SHA1

737724c13d73370cdb59a8212df05086a7695c2f
SHA256

e301cc5de70d8cc55ac87de0f7f974860090b20bf895f7440515e0d6ed65024e
SHA512

0a42ac58f0ac200eafa01d766bce952e846d0d3f4a6b13cec561d34e1dbd91dfd883c5f453b3651ea8659956d473e798f8ec2a89e02c33ad655ed0a56df68477
SSDEEP

12288:e4qEIfvSlllU+PybF1vnamsSyhMkJ4/xBK3q5Dbcc3TeUTfMvS+dCzYB4Pu/VudO:LdhphChyUD/VoFnVmH5fg

Score

10^/10

darkcomet zombie persistence rat trojan upx

Malware Config

Extracted

Family

darkcomet

Botnet

Zombie

C2

dylberts.no-ip.org:1604

Mutex

DC_MUTEX-42UDWEK

Attributes

gencode
jSplwxG3dXQW
install
false
offline_keylogger
true
password
hooch5
persistence
false

Signatures

Darkcomet
DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
trojan rat darkcomet

UPX packed file 6 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral1/memory/848-55-0x0000000000400000-0x000000000050E000-memory.dmp	upx
behavioral1/memory/848-57-0x0000000000400000-0x000000000050E000-memory.dmp	upx
behavioral1/memory/848-60-0x0000000000400000-0x000000000050E000-memory.dmp	upx
behavioral1/memory/848-61-0x0000000000400000-0x000000000050E000-memory.dmp	upx
behavioral1/memory/848-63-0x0000000000400000-0x000000000050E000-memory.dmp	upx
behavioral1/memory/848-65-0x0000000000400000-0x000000000050E000-memory.dmp	upx

Uses the VBS compiler for execution 1 TTPs

Scripting
T1064

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

e301cc5de70d8cc55ac87de0f7f974860090b20bf895f7440515e0d6ed65024e.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\System32 = "C:\\Users\\Admin\\AppData\\Roaming\\Blah.exe"	e301cc5de70d8cc55ac87de0f7f974860090b20bf895f7440515e0d6ed65024e.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

e301cc5de70d8cc55ac87de0f7f974860090b20bf895f7440515e0d6ed65024e.exe

description pid process target process

PID 912 set thread context of 848 912 e301cc5de70d8cc55ac87de0f7f974860090b20bf895f7440515e0d6ed65024e.exe vbc.exe

description	pid	process	target process
PID 912 set thread context of 848	912	e301cc5de70d8cc55ac87de0f7f974860090b20bf895f7440515e0d6ed65024e.exe	vbc.exe

Suspicious use of AdjustPrivilegeToken 23 IoCs

Processes:

vbc.exe

description	pid	process
Token: SeIncreaseQuotaPrivilege	848	vbc.exe
Token: SeSecurityPrivilege	848	vbc.exe
Token: SeTakeOwnershipPrivilege	848	vbc.exe
Token: SeLoadDriverPrivilege	848	vbc.exe
Token: SeSystemProfilePrivilege	848	vbc.exe
Token: SeSystemtimePrivilege	848	vbc.exe
Token: SeProfSingleProcessPrivilege	848	vbc.exe
Token: SeIncBasePriorityPrivilege	848	vbc.exe
Token: SeCreatePagefilePrivilege	848	vbc.exe
Token: SeBackupPrivilege	848	vbc.exe
Token: SeRestorePrivilege	848	vbc.exe
Token: SeShutdownPrivilege	848	vbc.exe
Token: SeDebugPrivilege	848	vbc.exe
Token: SeSystemEnvironmentPrivilege	848	vbc.exe
Token: SeChangeNotifyPrivilege	848	vbc.exe
Token: SeRemoteShutdownPrivilege	848	vbc.exe
Token: SeUndockPrivilege	848	vbc.exe
Token: SeManageVolumePrivilege	848	vbc.exe
Token: SeImpersonatePrivilege	848	vbc.exe
Token: SeCreateGlobalPrivilege	848	vbc.exe
Token: 33	848	vbc.exe
Token: 34	848	vbc.exe
Token: 35	848	vbc.exe

Suspicious use of FindShellTrayWindow 2 IoCs

Processes:

DllHost.exe

pid process

852 DllHost.exe
852 DllHost.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

vbc.exe

pid process

848 vbc.exe

pid	process
852	DllHost.exe
852	DllHost.exe

pid	process
848	vbc.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

e301cc5de70d8cc55ac87de0f7f974860090b20bf895f7440515e0d6ed65024e.exe

description	pid	process	target process
PID 912 wrote to memory of 848	912	e301cc5de70d8cc55ac87de0f7f974860090b20bf895f7440515e0d6ed65024e.exe	vbc.exe
PID 912 wrote to memory of 848	912	e301cc5de70d8cc55ac87de0f7f974860090b20bf895f7440515e0d6ed65024e.exe	vbc.exe
PID 912 wrote to memory of 848	912	e301cc5de70d8cc55ac87de0f7f974860090b20bf895f7440515e0d6ed65024e.exe	vbc.exe
PID 912 wrote to memory of 848	912	e301cc5de70d8cc55ac87de0f7f974860090b20bf895f7440515e0d6ed65024e.exe	vbc.exe
PID 912 wrote to memory of 848	912	e301cc5de70d8cc55ac87de0f7f974860090b20bf895f7440515e0d6ed65024e.exe	vbc.exe
PID 912 wrote to memory of 848	912	e301cc5de70d8cc55ac87de0f7f974860090b20bf895f7440515e0d6ed65024e.exe	vbc.exe
PID 912 wrote to memory of 848	912	e301cc5de70d8cc55ac87de0f7f974860090b20bf895f7440515e0d6ed65024e.exe	vbc.exe
PID 912 wrote to memory of 848	912	e301cc5de70d8cc55ac87de0f7f974860090b20bf895f7440515e0d6ed65024e.exe	vbc.exe
PID 912 wrote to memory of 848	912	e301cc5de70d8cc55ac87de0f7f974860090b20bf895f7440515e0d6ed65024e.exe	vbc.exe

C:\Users\Admin\AppData\Local\Temp\e301cc5de70d8cc55ac87de0f7f974860090b20bf895f7440515e0d6ed65024e.exe
"C:\Users\Admin\AppData\Local\Temp\e301cc5de70d8cc55ac87de0f7f974860090b20bf895f7440515e0d6ed65024e.exe"
1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:912

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
2⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:848

C:\Windows\SysWOW64\DllHost.exe
C:\Windows\SysWOW64\DllHost.exe /Processid:{76D0CB12-7604-4048-B83C-1005C7DDC503}
1⤵
- Suspicious use of FindShellTrayWindow
PID:852

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scripting

1

T1064

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Scripting

1

T1064

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IMG_18032012_193054.PNG
Filesize
187KB

MD5
464fa22445f9a122e7c3981c16f1c87e

SHA1
53c746749a286276dfebaafaa6bb7c59f94ac484

SHA256
881eaeb1742bcba6d1d5d466acd77e413f05051208fcd06f5a4ed43b92736a12

SHA512
a46d17e393ca7ea706364b6f98df8d780879d3177e49142816bdf061abee0403731f84a234fe0638315df8d0e0ceac51e679ab5d5bc39a46a435b94513877f50

Download Submit
memory/848-55-0x0000000000400000-0x000000000050E000-memory.dmp

Filesize
1.1MB

Download
memory/848-56-0x00000000004F6E80-mapping.dmp

Download
memory/848-57-0x0000000000400000-0x000000000050E000-memory.dmp

Filesize
1.1MB

Download
memory/848-60-0x0000000000400000-0x000000000050E000-memory.dmp

Filesize
1.1MB

Download
memory/848-61-0x0000000000400000-0x000000000050E000-memory.dmp

Filesize
1.1MB

Download
memory/848-63-0x0000000000400000-0x000000000050E000-memory.dmp

Filesize
1.1MB

Download
memory/848-65-0x0000000000400000-0x000000000050E000-memory.dmp

Filesize
1.1MB

Download
memory/912-54-0x0000000075661000-0x0000000075663000-memory.dmp

Filesize
8KB

Download
memory/912-58-0x0000000074420000-0x00000000749CB000-memory.dmp

Filesize
5.7MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads