darkcomet | e301cc5de70d8cc55ac87de0f7f974860090b20bf895f7440515e0d6ed65024e

General

Target

e301cc5de70d8cc55ac87de0f7f974860090b20bf895f7440515e0d6ed65024e.exe
Size

1.1MB
MD5

16c166c342b404f53ae55d2cd94c77d8
SHA1

737724c13d73370cdb59a8212df05086a7695c2f
SHA256

e301cc5de70d8cc55ac87de0f7f974860090b20bf895f7440515e0d6ed65024e
SHA512

0a42ac58f0ac200eafa01d766bce952e846d0d3f4a6b13cec561d34e1dbd91dfd883c5f453b3651ea8659956d473e798f8ec2a89e02c33ad655ed0a56df68477
SSDEEP

12288:e4qEIfvSlllU+PybF1vnamsSyhMkJ4/xBK3q5Dbcc3TeUTfMvS+dCzYB4Pu/VudO:LdhphChyUD/VoFnVmH5fg

Score

10^/10

darkcomet zombie persistence rat trojan upx

Malware Config

Extracted

Family

darkcomet

Botnet

Zombie

C2

dylberts.no-ip.org:1604

Mutex

DC_MUTEX-42UDWEK

Attributes

gencode
jSplwxG3dXQW
install
false
offline_keylogger
true
password
hooch5
persistence
false

Signatures

Darkcomet
DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
trojan rat darkcomet

UPX packed file 6 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral2/memory/5048-134-0x0000000000400000-0x000000000050E000-memory.dmp	upx
behavioral2/memory/5048-135-0x0000000000400000-0x000000000050E000-memory.dmp	upx
behavioral2/memory/5048-137-0x0000000000400000-0x000000000050E000-memory.dmp	upx
behavioral2/memory/5048-138-0x0000000000400000-0x000000000050E000-memory.dmp	upx
behavioral2/memory/5048-139-0x0000000000400000-0x000000000050E000-memory.dmp	upx
behavioral2/memory/5048-140-0x0000000000400000-0x000000000050E000-memory.dmp	upx

Uses the VBS compiler for execution 1 TTPs

Scripting
T1064

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

e301cc5de70d8cc55ac87de0f7f974860090b20bf895f7440515e0d6ed65024e.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\System32 = "C:\\Users\\Admin\\AppData\\Roaming\\Blah.exe"	e301cc5de70d8cc55ac87de0f7f974860090b20bf895f7440515e0d6ed65024e.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

e301cc5de70d8cc55ac87de0f7f974860090b20bf895f7440515e0d6ed65024e.exe

description	pid	process	target process
PID 4612 set thread context of 5048	4612	e301cc5de70d8cc55ac87de0f7f974860090b20bf895f7440515e0d6ed65024e.exe	vbc.exe

Suspicious use of AdjustPrivilegeToken 24 IoCs

Processes:

vbc.exe

description	pid	process
Token: SeIncreaseQuotaPrivilege	5048	vbc.exe
Token: SeSecurityPrivilege	5048	vbc.exe
Token: SeTakeOwnershipPrivilege	5048	vbc.exe
Token: SeLoadDriverPrivilege	5048	vbc.exe
Token: SeSystemProfilePrivilege	5048	vbc.exe
Token: SeSystemtimePrivilege	5048	vbc.exe
Token: SeProfSingleProcessPrivilege	5048	vbc.exe
Token: SeIncBasePriorityPrivilege	5048	vbc.exe
Token: SeCreatePagefilePrivilege	5048	vbc.exe
Token: SeBackupPrivilege	5048	vbc.exe
Token: SeRestorePrivilege	5048	vbc.exe
Token: SeShutdownPrivilege	5048	vbc.exe
Token: SeDebugPrivilege	5048	vbc.exe
Token: SeSystemEnvironmentPrivilege	5048	vbc.exe
Token: SeChangeNotifyPrivilege	5048	vbc.exe
Token: SeRemoteShutdownPrivilege	5048	vbc.exe
Token: SeUndockPrivilege	5048	vbc.exe
Token: SeManageVolumePrivilege	5048	vbc.exe
Token: SeImpersonatePrivilege	5048	vbc.exe
Token: SeCreateGlobalPrivilege	5048	vbc.exe
Token: 33	5048	vbc.exe
Token: 34	5048	vbc.exe
Token: 35	5048	vbc.exe
Token: 36	5048	vbc.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

vbc.exe

pid process

5048 vbc.exe

pid	process
5048	vbc.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

e301cc5de70d8cc55ac87de0f7f974860090b20bf895f7440515e0d6ed65024e.exe

description	pid	process	target process
PID 4612 wrote to memory of 5048	4612	e301cc5de70d8cc55ac87de0f7f974860090b20bf895f7440515e0d6ed65024e.exe	vbc.exe
PID 4612 wrote to memory of 5048	4612	e301cc5de70d8cc55ac87de0f7f974860090b20bf895f7440515e0d6ed65024e.exe	vbc.exe
PID 4612 wrote to memory of 5048	4612	e301cc5de70d8cc55ac87de0f7f974860090b20bf895f7440515e0d6ed65024e.exe	vbc.exe
PID 4612 wrote to memory of 5048	4612	e301cc5de70d8cc55ac87de0f7f974860090b20bf895f7440515e0d6ed65024e.exe	vbc.exe
PID 4612 wrote to memory of 5048	4612	e301cc5de70d8cc55ac87de0f7f974860090b20bf895f7440515e0d6ed65024e.exe	vbc.exe
PID 4612 wrote to memory of 5048	4612	e301cc5de70d8cc55ac87de0f7f974860090b20bf895f7440515e0d6ed65024e.exe	vbc.exe
PID 4612 wrote to memory of 5048	4612	e301cc5de70d8cc55ac87de0f7f974860090b20bf895f7440515e0d6ed65024e.exe	vbc.exe
PID 4612 wrote to memory of 5048	4612	e301cc5de70d8cc55ac87de0f7f974860090b20bf895f7440515e0d6ed65024e.exe	vbc.exe

C:\Users\Admin\AppData\Local\Temp\e301cc5de70d8cc55ac87de0f7f974860090b20bf895f7440515e0d6ed65024e.exe
"C:\Users\Admin\AppData\Local\Temp\e301cc5de70d8cc55ac87de0f7f974860090b20bf895f7440515e0d6ed65024e.exe"
1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4612

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
2⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:5048

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scripting

1

T1064

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Scripting

1

T1064

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4612-132-0x0000000074870000-0x0000000074E21000-memory.dmp

Filesize
5.7MB

Download
memory/4612-136-0x0000000074870000-0x0000000074E21000-memory.dmp

Filesize
5.7MB

Download
memory/5048-133-0x0000000000000000-mapping.dmp

Download
memory/5048-134-0x0000000000400000-0x000000000050E000-memory.dmp

Filesize
1.1MB

Download
memory/5048-135-0x0000000000400000-0x000000000050E000-memory.dmp

Filesize
1.1MB

Download
memory/5048-137-0x0000000000400000-0x000000000050E000-memory.dmp

Filesize
1.1MB

Download
memory/5048-138-0x0000000000400000-0x000000000050E000-memory.dmp

Filesize
1.1MB

Download
memory/5048-139-0x0000000000400000-0x000000000050E000-memory.dmp

Filesize
1.1MB

Download
memory/5048-140-0x0000000000400000-0x000000000050E000-memory.dmp

Filesize
1.1MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads