darkcomet | 99b16a22c316bd2f273510542290e76f322a09d917a0688a9c4538a1a5c27641

Analysis

max time kernel
152s
max time network
42s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
05-12-2022 11:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

99b16a22c316bd2f273510542290e76f322a09d917a0688a9c4538a1a5c27641.exe
Size

344KB
MD5

1c8fd5121bc3be40fbaf54179ef10ba0
SHA1

410db480c52b5579215d711194c4345c90b6549e
SHA256

99b16a22c316bd2f273510542290e76f322a09d917a0688a9c4538a1a5c27641
SHA512

e6a2eafbc1184a1d4548839782cac2f7608d69d97bf48c29927a847b822fb5533d7eeb7bb57f14bf95e417d2df928dbcd8203997d9f9feecffeb6c5480814e90
SSDEEP

6144:JW+FfD4Vn0JXVsdkZoop2hJ8j1A4mLDGN7DDx6P4W3ViBnIQpclkaOkch9ZsTcI2:k+ZG0xVwSo7UR5mLDgDlhW3ViBIQpsk1

Score

10^/10

darkcomet persistence rat trojan upx

Malware Config

Signatures

Darkcomet
DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
trojan rat darkcomet

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/852-56-0x0000000013140000-0x00000000131FD000-memory.dmp	upx
behavioral1/memory/852-67-0x0000000013140000-0x00000000131FD000-memory.dmp	upx

Uses the VBS compiler for execution 1 TTPs

Scripting
T1064

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\messenger = "C:\\Users\\Admin\\AppData\\Roaming\\inid.exe"	99b16a22c316bd2f273510542290e76f322a09d917a0688a9c4538a1a5c27641.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 1976 set thread context of 852	1976	99b16a22c316bd2f273510542290e76f322a09d917a0688a9c4538a1a5c27641.exe	26
PID 1228 set thread context of 1544	1228	99b16a22c316bd2f273510542290e76f322a09d917a0688a9c4538a1a5c27641.exe	30

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe	99b16a22c316bd2f273510542290e76f322a09d917a0688a9c4538a1a5c27641.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe	99b16a22c316bd2f273510542290e76f322a09d917a0688a9c4538a1a5c27641.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 2 IoCs

pid	pid_target	Process	procid_target
1296	852	WerFault.exe	26
268	1544	WerFault.exe	30

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1976	99b16a22c316bd2f273510542290e76f322a09d917a0688a9c4538a1a5c27641.exe
1976	99b16a22c316bd2f273510542290e76f322a09d917a0688a9c4538a1a5c27641.exe
1976	99b16a22c316bd2f273510542290e76f322a09d917a0688a9c4538a1a5c27641.exe
1228	99b16a22c316bd2f273510542290e76f322a09d917a0688a9c4538a1a5c27641.exe
1228	99b16a22c316bd2f273510542290e76f322a09d917a0688a9c4538a1a5c27641.exe
1228	99b16a22c316bd2f273510542290e76f322a09d917a0688a9c4538a1a5c27641.exe
1228	99b16a22c316bd2f273510542290e76f322a09d917a0688a9c4538a1a5c27641.exe
1976	99b16a22c316bd2f273510542290e76f322a09d917a0688a9c4538a1a5c27641.exe
1976	99b16a22c316bd2f273510542290e76f322a09d917a0688a9c4538a1a5c27641.exe
1228	99b16a22c316bd2f273510542290e76f322a09d917a0688a9c4538a1a5c27641.exe
1228	99b16a22c316bd2f273510542290e76f322a09d917a0688a9c4538a1a5c27641.exe
1976	99b16a22c316bd2f273510542290e76f322a09d917a0688a9c4538a1a5c27641.exe
1976	99b16a22c316bd2f273510542290e76f322a09d917a0688a9c4538a1a5c27641.exe
1228	99b16a22c316bd2f273510542290e76f322a09d917a0688a9c4538a1a5c27641.exe
1228	99b16a22c316bd2f273510542290e76f322a09d917a0688a9c4538a1a5c27641.exe
1976	99b16a22c316bd2f273510542290e76f322a09d917a0688a9c4538a1a5c27641.exe
1976	99b16a22c316bd2f273510542290e76f322a09d917a0688a9c4538a1a5c27641.exe
1228	99b16a22c316bd2f273510542290e76f322a09d917a0688a9c4538a1a5c27641.exe
1228	99b16a22c316bd2f273510542290e76f322a09d917a0688a9c4538a1a5c27641.exe
1976	99b16a22c316bd2f273510542290e76f322a09d917a0688a9c4538a1a5c27641.exe
1976	99b16a22c316bd2f273510542290e76f322a09d917a0688a9c4538a1a5c27641.exe
1228	99b16a22c316bd2f273510542290e76f322a09d917a0688a9c4538a1a5c27641.exe
1228	99b16a22c316bd2f273510542290e76f322a09d917a0688a9c4538a1a5c27641.exe
1976	99b16a22c316bd2f273510542290e76f322a09d917a0688a9c4538a1a5c27641.exe
1976	99b16a22c316bd2f273510542290e76f322a09d917a0688a9c4538a1a5c27641.exe
1228	99b16a22c316bd2f273510542290e76f322a09d917a0688a9c4538a1a5c27641.exe
1228	99b16a22c316bd2f273510542290e76f322a09d917a0688a9c4538a1a5c27641.exe
1976	99b16a22c316bd2f273510542290e76f322a09d917a0688a9c4538a1a5c27641.exe
1976	99b16a22c316bd2f273510542290e76f322a09d917a0688a9c4538a1a5c27641.exe
1228	99b16a22c316bd2f273510542290e76f322a09d917a0688a9c4538a1a5c27641.exe
1228	99b16a22c316bd2f273510542290e76f322a09d917a0688a9c4538a1a5c27641.exe
1976	99b16a22c316bd2f273510542290e76f322a09d917a0688a9c4538a1a5c27641.exe
1976	99b16a22c316bd2f273510542290e76f322a09d917a0688a9c4538a1a5c27641.exe
1228	99b16a22c316bd2f273510542290e76f322a09d917a0688a9c4538a1a5c27641.exe
1228	99b16a22c316bd2f273510542290e76f322a09d917a0688a9c4538a1a5c27641.exe
1976	99b16a22c316bd2f273510542290e76f322a09d917a0688a9c4538a1a5c27641.exe
1976	99b16a22c316bd2f273510542290e76f322a09d917a0688a9c4538a1a5c27641.exe
1228	99b16a22c316bd2f273510542290e76f322a09d917a0688a9c4538a1a5c27641.exe
1228	99b16a22c316bd2f273510542290e76f322a09d917a0688a9c4538a1a5c27641.exe
1976	99b16a22c316bd2f273510542290e76f322a09d917a0688a9c4538a1a5c27641.exe
1976	99b16a22c316bd2f273510542290e76f322a09d917a0688a9c4538a1a5c27641.exe
1228	99b16a22c316bd2f273510542290e76f322a09d917a0688a9c4538a1a5c27641.exe
1228	99b16a22c316bd2f273510542290e76f322a09d917a0688a9c4538a1a5c27641.exe
1976	99b16a22c316bd2f273510542290e76f322a09d917a0688a9c4538a1a5c27641.exe
1976	99b16a22c316bd2f273510542290e76f322a09d917a0688a9c4538a1a5c27641.exe
1228	99b16a22c316bd2f273510542290e76f322a09d917a0688a9c4538a1a5c27641.exe
1228	99b16a22c316bd2f273510542290e76f322a09d917a0688a9c4538a1a5c27641.exe
1976	99b16a22c316bd2f273510542290e76f322a09d917a0688a9c4538a1a5c27641.exe
1976	99b16a22c316bd2f273510542290e76f322a09d917a0688a9c4538a1a5c27641.exe
1228	99b16a22c316bd2f273510542290e76f322a09d917a0688a9c4538a1a5c27641.exe
1228	99b16a22c316bd2f273510542290e76f322a09d917a0688a9c4538a1a5c27641.exe
1976	99b16a22c316bd2f273510542290e76f322a09d917a0688a9c4538a1a5c27641.exe
1976	99b16a22c316bd2f273510542290e76f322a09d917a0688a9c4538a1a5c27641.exe
1228	99b16a22c316bd2f273510542290e76f322a09d917a0688a9c4538a1a5c27641.exe
1228	99b16a22c316bd2f273510542290e76f322a09d917a0688a9c4538a1a5c27641.exe
1976	99b16a22c316bd2f273510542290e76f322a09d917a0688a9c4538a1a5c27641.exe
1976	99b16a22c316bd2f273510542290e76f322a09d917a0688a9c4538a1a5c27641.exe
1228	99b16a22c316bd2f273510542290e76f322a09d917a0688a9c4538a1a5c27641.exe
1228	99b16a22c316bd2f273510542290e76f322a09d917a0688a9c4538a1a5c27641.exe
1976	99b16a22c316bd2f273510542290e76f322a09d917a0688a9c4538a1a5c27641.exe
1976	99b16a22c316bd2f273510542290e76f322a09d917a0688a9c4538a1a5c27641.exe
1228	99b16a22c316bd2f273510542290e76f322a09d917a0688a9c4538a1a5c27641.exe
1228	99b16a22c316bd2f273510542290e76f322a09d917a0688a9c4538a1a5c27641.exe
1976	99b16a22c316bd2f273510542290e76f322a09d917a0688a9c4538a1a5c27641.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1976	99b16a22c316bd2f273510542290e76f322a09d917a0688a9c4538a1a5c27641.exe
Token: SeDebugPrivilege	1228	99b16a22c316bd2f273510542290e76f322a09d917a0688a9c4538a1a5c27641.exe

Suspicious use of WriteProcessMemory 38 IoCs

description	pid	Process	procid_target
PID 1976 wrote to memory of 852	1976	99b16a22c316bd2f273510542290e76f322a09d917a0688a9c4538a1a5c27641.exe	26
PID 1976 wrote to memory of 852	1976	99b16a22c316bd2f273510542290e76f322a09d917a0688a9c4538a1a5c27641.exe	26
PID 1976 wrote to memory of 852	1976	99b16a22c316bd2f273510542290e76f322a09d917a0688a9c4538a1a5c27641.exe	26
PID 1976 wrote to memory of 852	1976	99b16a22c316bd2f273510542290e76f322a09d917a0688a9c4538a1a5c27641.exe	26
PID 1976 wrote to memory of 852	1976	99b16a22c316bd2f273510542290e76f322a09d917a0688a9c4538a1a5c27641.exe	26
PID 1976 wrote to memory of 852	1976	99b16a22c316bd2f273510542290e76f322a09d917a0688a9c4538a1a5c27641.exe	26
PID 1976 wrote to memory of 852	1976	99b16a22c316bd2f273510542290e76f322a09d917a0688a9c4538a1a5c27641.exe	26
PID 1976 wrote to memory of 852	1976	99b16a22c316bd2f273510542290e76f322a09d917a0688a9c4538a1a5c27641.exe	26
PID 1976 wrote to memory of 852	1976	99b16a22c316bd2f273510542290e76f322a09d917a0688a9c4538a1a5c27641.exe	26
PID 852 wrote to memory of 1296	852	vbc.exe	28
PID 852 wrote to memory of 1296	852	vbc.exe	28
PID 852 wrote to memory of 1296	852	vbc.exe	28
PID 852 wrote to memory of 1296	852	vbc.exe	28
PID 1976 wrote to memory of 1228	1976	99b16a22c316bd2f273510542290e76f322a09d917a0688a9c4538a1a5c27641.exe	29
PID 1976 wrote to memory of 1228	1976	99b16a22c316bd2f273510542290e76f322a09d917a0688a9c4538a1a5c27641.exe	29
PID 1976 wrote to memory of 1228	1976	99b16a22c316bd2f273510542290e76f322a09d917a0688a9c4538a1a5c27641.exe	29
PID 1976 wrote to memory of 1228	1976	99b16a22c316bd2f273510542290e76f322a09d917a0688a9c4538a1a5c27641.exe	29
PID 1228 wrote to memory of 1544	1228	99b16a22c316bd2f273510542290e76f322a09d917a0688a9c4538a1a5c27641.exe	30
PID 1228 wrote to memory of 1544	1228	99b16a22c316bd2f273510542290e76f322a09d917a0688a9c4538a1a5c27641.exe	30
PID 1228 wrote to memory of 1544	1228	99b16a22c316bd2f273510542290e76f322a09d917a0688a9c4538a1a5c27641.exe	30
PID 1228 wrote to memory of 1544	1228	99b16a22c316bd2f273510542290e76f322a09d917a0688a9c4538a1a5c27641.exe	30
PID 1228 wrote to memory of 1544	1228	99b16a22c316bd2f273510542290e76f322a09d917a0688a9c4538a1a5c27641.exe	30
PID 1228 wrote to memory of 1544	1228	99b16a22c316bd2f273510542290e76f322a09d917a0688a9c4538a1a5c27641.exe	30
PID 1228 wrote to memory of 1544	1228	99b16a22c316bd2f273510542290e76f322a09d917a0688a9c4538a1a5c27641.exe	30
PID 1228 wrote to memory of 1544	1228	99b16a22c316bd2f273510542290e76f322a09d917a0688a9c4538a1a5c27641.exe	30
PID 1228 wrote to memory of 1544	1228	99b16a22c316bd2f273510542290e76f322a09d917a0688a9c4538a1a5c27641.exe	30
PID 1544 wrote to memory of 268	1544	vbc.exe	32
PID 1544 wrote to memory of 268	1544	vbc.exe	32
PID 1544 wrote to memory of 268	1544	vbc.exe	32
PID 1544 wrote to memory of 268	1544	vbc.exe	32
PID 1228 wrote to memory of 1748	1228	99b16a22c316bd2f273510542290e76f322a09d917a0688a9c4538a1a5c27641.exe	33
PID 1228 wrote to memory of 1748	1228	99b16a22c316bd2f273510542290e76f322a09d917a0688a9c4538a1a5c27641.exe	33
PID 1228 wrote to memory of 1748	1228	99b16a22c316bd2f273510542290e76f322a09d917a0688a9c4538a1a5c27641.exe	33
PID 1228 wrote to memory of 1748	1228	99b16a22c316bd2f273510542290e76f322a09d917a0688a9c4538a1a5c27641.exe	33
PID 1976 wrote to memory of 656	1976	99b16a22c316bd2f273510542290e76f322a09d917a0688a9c4538a1a5c27641.exe	34
PID 1976 wrote to memory of 656	1976	99b16a22c316bd2f273510542290e76f322a09d917a0688a9c4538a1a5c27641.exe	34
PID 1976 wrote to memory of 656	1976	99b16a22c316bd2f273510542290e76f322a09d917a0688a9c4538a1a5c27641.exe	34
PID 1976 wrote to memory of 656	1976	99b16a22c316bd2f273510542290e76f322a09d917a0688a9c4538a1a5c27641.exe	34

C:\Users\Admin\AppData\Local\Temp\99b16a22c316bd2f273510542290e76f322a09d917a0688a9c4538a1a5c27641.exe
"C:\Users\Admin\AppData\Local\Temp\99b16a22c316bd2f273510542290e76f322a09d917a0688a9c4538a1a5c27641.exe"
1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1976
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
  C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:852
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 852 -s 148
    3⤵
    - Program crash
    PID:1296
- C:\Users\Admin\AppData\Local\Temp\99b16a22c316bd2f273510542290e76f322a09d917a0688a9c4538a1a5c27641.exe
  "C:\Users\Admin\AppData\Local\Temp\99b16a22c316bd2f273510542290e76f322a09d917a0688a9c4538a1a5c27641.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1228
- - C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
    C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1544
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1544 -s 148
      4⤵
      Program crash
      PID:268
- - C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
    dw20.exe -x -s 552
    3⤵
    PID:1748
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
  dw20.exe -x -s 564
  2⤵
  PID:656

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scripting

T1064

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Scripting

T1064

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\inid.exe

Filesize
344KB

MD5
1c8fd5121bc3be40fbaf54179ef10ba0

SHA1
410db480c52b5579215d711194c4345c90b6549e

SHA256
99b16a22c316bd2f273510542290e76f322a09d917a0688a9c4538a1a5c27641

SHA512
e6a2eafbc1184a1d4548839782cac2f7608d69d97bf48c29927a847b822fb5533d7eeb7bb57f14bf95e417d2df928dbcd8203997d9f9feecffeb6c5480814e90

Download Submit
memory/268-64-0x0000000000000000-mapping.dmp

Download
memory/656-66-0x0000000000000000-mapping.dmp

Download
memory/852-56-0x0000000013140000-0x00000000131FD000-memory.dmp

Filesize
756KB

Download
memory/852-57-0x00000000131FA100-mapping.dmp

Download
memory/852-67-0x0000000013140000-0x00000000131FD000-memory.dmp

Filesize
756KB

Download
memory/1228-59-0x0000000000000000-mapping.dmp

Download
memory/1228-68-0x0000000074120000-0x00000000746CB000-memory.dmp

Filesize
5.7MB

Download
memory/1228-72-0x0000000074120000-0x00000000746CB000-memory.dmp

Filesize
5.7MB

Download
memory/1296-58-0x0000000000000000-mapping.dmp

Download
memory/1544-63-0x00000000131FA100-mapping.dmp

Download
memory/1748-65-0x0000000000000000-mapping.dmp

Download
memory/1976-54-0x00000000754E1000-0x00000000754E3000-memory.dmp

Filesize
8KB

Download
memory/1976-55-0x0000000074120000-0x00000000746CB000-memory.dmp

Filesize
5.7MB

Download
memory/1976-71-0x0000000074120000-0x00000000746CB000-memory.dmp

Filesize
5.7MB

Download