darkcomet | 4eb72e48cfb33c9acef07a2e751778c015017c596c853c457480fc4789ace93b

General

Target

4eb72e48cfb33c9acef07a2e751778c015017c596c853c457480fc4789ace93b.exe
Size

922KB
MD5

012318a76ded2c3f07bc87951161e230
SHA1

36b461903b381fd4c9d411dd9ba2de6f447f0c02
SHA256

4eb72e48cfb33c9acef07a2e751778c015017c596c853c457480fc4789ace93b
SHA512

7335849867e421fdf1ea669faeb36e6cbfe43eea369fbb494254634557c2a8c62dcc8e1d209d3b7ee7aa978b2aac2ec9bc7caab61bb290ab421d128fcf78f40c
SSDEEP

24576:FRmJkcoQricOIQxiZY1/a3c9gEsKvNyG/dT:KJZoQrbTFZY1/aMfvzFT

Score

10^/10

darkcomet zombie persistence rat trojan

Malware Config

Extracted

Family

darkcomet

Botnet

Zombie

C2

crypto.zapto.org:10000

Mutex

DC_MUTEX-17A0K8Q

Attributes

gencode
d1zglQGL3Wry
install
false
offline_keylogger
true
persistence
false

Signatures

Darkcomet
DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
trojan rat darkcomet
Executes dropped EXE 1 IoCs

Processes:

BitLocker.exe

pid process

1200 BitLocker.exe
Loads dropped DLL 1 IoCs

Processes:

4eb72e48cfb33c9acef07a2e751778c015017c596c853c457480fc4789ace93b.exe

pid process

1016 4eb72e48cfb33c9acef07a2e751778c015017c596c853c457480fc4789ace93b.exe

pid	process
1016	4eb72e48cfb33c9acef07a2e751778c015017c596c853c457480fc4789ace93b.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

BitLocker.exe4eb72e48cfb33c9acef07a2e751778c015017c596c853c457480fc4789ace93b.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\BitLocker Service = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\BitLocker\\BitLocker.exe"	BitLocker.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	4eb72e48cfb33c9acef07a2e751778c015017c596c853c457480fc4789ace93b.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\BitLocker Service = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\BitLocker\\BitLocker.exe"	4eb72e48cfb33c9acef07a2e751778c015017c596c853c457480fc4789ace93b.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	BitLocker.exe

AutoIT Executable 7 IoCs

AutoIT scripts compiled to PE executables.

Processes:

resource	yara_rule
behavioral1/memory/1016-55-0x0000000000400000-0x0000000000505000-memory.dmp	autoit_exe
\Users\Admin\AppData\Roaming\Microsoft\BitLocker\BitLocker.exe	autoit_exe
C:\Users\Admin\AppData\Roaming\Microsoft\BitLocker\BitLocker.exe	autoit_exe
behavioral1/memory/1016-60-0x0000000000400000-0x0000000000505000-memory.dmp	autoit_exe
C:\Users\Admin\AppData\Roaming\Microsoft\BitLocker\BitLocker.exe	autoit_exe
behavioral1/memory/1200-62-0x0000000000400000-0x0000000000505000-memory.dmp	autoit_exe
behavioral1/memory/1200-73-0x0000000000400000-0x0000000000505000-memory.dmp	autoit_exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

BitLocker.exe

description pid process target process

PID 1200 set thread context of 892 1200 BitLocker.exe svchost.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

description	pid	process	target process
PID 1200 set thread context of 892	1200	BitLocker.exe	svchost.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

BitLocker.exe

pid	process
1200	BitLocker.exe
1200	BitLocker.exe
1200	BitLocker.exe
1200	BitLocker.exe
1200	BitLocker.exe
1200	BitLocker.exe
1200	BitLocker.exe
1200	BitLocker.exe
1200	BitLocker.exe
1200	BitLocker.exe
1200	BitLocker.exe
1200	BitLocker.exe
1200	BitLocker.exe
1200	BitLocker.exe
1200	BitLocker.exe
1200	BitLocker.exe
1200	BitLocker.exe
1200	BitLocker.exe
1200	BitLocker.exe
1200	BitLocker.exe
1200	BitLocker.exe
1200	BitLocker.exe
1200	BitLocker.exe
1200	BitLocker.exe
1200	BitLocker.exe
1200	BitLocker.exe
1200	BitLocker.exe
1200	BitLocker.exe
1200	BitLocker.exe
1200	BitLocker.exe
1200	BitLocker.exe
1200	BitLocker.exe
1200	BitLocker.exe
1200	BitLocker.exe
1200	BitLocker.exe
1200	BitLocker.exe
1200	BitLocker.exe
1200	BitLocker.exe
1200	BitLocker.exe
1200	BitLocker.exe
1200	BitLocker.exe
1200	BitLocker.exe
1200	BitLocker.exe
1200	BitLocker.exe
1200	BitLocker.exe
1200	BitLocker.exe
1200	BitLocker.exe
1200	BitLocker.exe
1200	BitLocker.exe
1200	BitLocker.exe
1200	BitLocker.exe
1200	BitLocker.exe
1200	BitLocker.exe
1200	BitLocker.exe
1200	BitLocker.exe
1200	BitLocker.exe
1200	BitLocker.exe
1200	BitLocker.exe
1200	BitLocker.exe
1200	BitLocker.exe
1200	BitLocker.exe
1200	BitLocker.exe
1200	BitLocker.exe
1200	BitLocker.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

BitLocker.exe

pid process

1200 BitLocker.exe

Suspicious use of AdjustPrivilegeToken 23 IoCs

Processes:

svchost.exe

description	pid	process
Token: SeIncreaseQuotaPrivilege	892	svchost.exe
Token: SeSecurityPrivilege	892	svchost.exe
Token: SeTakeOwnershipPrivilege	892	svchost.exe
Token: SeLoadDriverPrivilege	892	svchost.exe
Token: SeSystemProfilePrivilege	892	svchost.exe
Token: SeSystemtimePrivilege	892	svchost.exe
Token: SeProfSingleProcessPrivilege	892	svchost.exe
Token: SeIncBasePriorityPrivilege	892	svchost.exe
Token: SeCreatePagefilePrivilege	892	svchost.exe
Token: SeBackupPrivilege	892	svchost.exe
Token: SeRestorePrivilege	892	svchost.exe
Token: SeShutdownPrivilege	892	svchost.exe
Token: SeDebugPrivilege	892	svchost.exe
Token: SeSystemEnvironmentPrivilege	892	svchost.exe
Token: SeChangeNotifyPrivilege	892	svchost.exe
Token: SeRemoteShutdownPrivilege	892	svchost.exe
Token: SeUndockPrivilege	892	svchost.exe
Token: SeManageVolumePrivilege	892	svchost.exe
Token: SeImpersonatePrivilege	892	svchost.exe
Token: SeCreateGlobalPrivilege	892	svchost.exe
Token: 33	892	svchost.exe
Token: 34	892	svchost.exe
Token: 35	892	svchost.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

svchost.exe

pid process

892 svchost.exe

pid	process
892	svchost.exe

Suspicious use of WriteProcessMemory 10 IoCs

Processes:

4eb72e48cfb33c9acef07a2e751778c015017c596c853c457480fc4789ace93b.exeBitLocker.exe

description	pid	process	target process
PID 1016 wrote to memory of 1200	1016	4eb72e48cfb33c9acef07a2e751778c015017c596c853c457480fc4789ace93b.exe	BitLocker.exe
PID 1016 wrote to memory of 1200	1016	4eb72e48cfb33c9acef07a2e751778c015017c596c853c457480fc4789ace93b.exe	BitLocker.exe
PID 1016 wrote to memory of 1200	1016	4eb72e48cfb33c9acef07a2e751778c015017c596c853c457480fc4789ace93b.exe	BitLocker.exe
PID 1016 wrote to memory of 1200	1016	4eb72e48cfb33c9acef07a2e751778c015017c596c853c457480fc4789ace93b.exe	BitLocker.exe
PID 1200 wrote to memory of 892	1200	BitLocker.exe	svchost.exe
PID 1200 wrote to memory of 892	1200	BitLocker.exe	svchost.exe
PID 1200 wrote to memory of 892	1200	BitLocker.exe	svchost.exe
PID 1200 wrote to memory of 892	1200	BitLocker.exe	svchost.exe
PID 1200 wrote to memory of 892	1200	BitLocker.exe	svchost.exe
PID 1200 wrote to memory of 892	1200	BitLocker.exe	svchost.exe

C:\Users\Admin\AppData\Local\Temp\4eb72e48cfb33c9acef07a2e751778c015017c596c853c457480fc4789ace93b.exe
"C:\Users\Admin\AppData\Local\Temp\4eb72e48cfb33c9acef07a2e751778c015017c596c853c457480fc4789ace93b.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1016

C:\Users\Admin\AppData\Roaming\Microsoft\BitLocker\BitLocker.exe
C:\Users\Admin\AppData\Roaming\Microsoft\BitLocker\BitLocker.exe
2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
PID:1200

C:\Windows\SysWOW64\svchost.exe
"C:\Windows\SysWOW64\svchost.exe"
3⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:892

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\BitLocker\BitLocker.exe
Filesize
922KB

MD5
012318a76ded2c3f07bc87951161e230

SHA1
36b461903b381fd4c9d411dd9ba2de6f447f0c02

SHA256
4eb72e48cfb33c9acef07a2e751778c015017c596c853c457480fc4789ace93b

SHA512
7335849867e421fdf1ea669faeb36e6cbfe43eea369fbb494254634557c2a8c62dcc8e1d209d3b7ee7aa978b2aac2ec9bc7caab61bb290ab421d128fcf78f40c

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\BitLocker\BitLocker.exe
Filesize
922KB

MD5
012318a76ded2c3f07bc87951161e230

SHA1
36b461903b381fd4c9d411dd9ba2de6f447f0c02

SHA256
4eb72e48cfb33c9acef07a2e751778c015017c596c853c457480fc4789ace93b

SHA512
7335849867e421fdf1ea669faeb36e6cbfe43eea369fbb494254634557c2a8c62dcc8e1d209d3b7ee7aa978b2aac2ec9bc7caab61bb290ab421d128fcf78f40c

Download Submit
\Users\Admin\AppData\Roaming\Microsoft\BitLocker\BitLocker.exe
Filesize
922KB

MD5
012318a76ded2c3f07bc87951161e230

SHA1
36b461903b381fd4c9d411dd9ba2de6f447f0c02

SHA256
4eb72e48cfb33c9acef07a2e751778c015017c596c853c457480fc4789ace93b

SHA512
7335849867e421fdf1ea669faeb36e6cbfe43eea369fbb494254634557c2a8c62dcc8e1d209d3b7ee7aa978b2aac2ec9bc7caab61bb290ab421d128fcf78f40c

Download Submit
memory/892-63-0x0000000000400000-0x00000000004B1000-memory.dmp

Filesize
708KB

Download
memory/892-65-0x0000000000400000-0x00000000004B1000-memory.dmp

Filesize
708KB

Download
memory/892-66-0x00000000004AF1F6-mapping.dmp

Download
memory/892-69-0x0000000000400000-0x00000000004B1000-memory.dmp

Filesize
708KB

Download
memory/892-70-0x0000000000400000-0x00000000004B1000-memory.dmp

Filesize
708KB

Download
memory/892-71-0x0000000000400000-0x00000000004B1000-memory.dmp

Filesize
708KB

Download
memory/892-72-0x0000000000400000-0x00000000004B1000-memory.dmp

Filesize
708KB

Download
memory/1016-60-0x0000000000400000-0x0000000000505000-memory.dmp

Filesize
1.0MB

Download
memory/1016-55-0x0000000000400000-0x0000000000505000-memory.dmp

Filesize
1.0MB

Download
memory/1016-54-0x00000000756B1000-0x00000000756B3000-memory.dmp

Filesize
8KB

Download
memory/1200-57-0x0000000000000000-mapping.dmp

Download
memory/1200-62-0x0000000000400000-0x0000000000505000-memory.dmp

Filesize
1.0MB

Download
memory/1200-73-0x0000000000400000-0x0000000000505000-memory.dmp

Filesize
1.0MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads