darkcomet | 4eb72e48cfb33c9acef07a2e751778c015017c596c853c457480fc4789ace93b

General

Target

4eb72e48cfb33c9acef07a2e751778c015017c596c853c457480fc4789ace93b.exe
Size

922KB
MD5

012318a76ded2c3f07bc87951161e230
SHA1

36b461903b381fd4c9d411dd9ba2de6f447f0c02
SHA256

4eb72e48cfb33c9acef07a2e751778c015017c596c853c457480fc4789ace93b
SHA512

7335849867e421fdf1ea669faeb36e6cbfe43eea369fbb494254634557c2a8c62dcc8e1d209d3b7ee7aa978b2aac2ec9bc7caab61bb290ab421d128fcf78f40c
SSDEEP

24576:FRmJkcoQricOIQxiZY1/a3c9gEsKvNyG/dT:KJZoQrbTFZY1/aMfvzFT

Score

10^/10

darkcomet zombie persistence rat trojan

Malware Config

Extracted

Family

darkcomet

Botnet

Zombie

C2

crypto.zapto.org:10000

Mutex

DC_MUTEX-17A0K8Q

Attributes

gencode
d1zglQGL3Wry
install
false
offline_keylogger
true
persistence
false

Signatures

Darkcomet
DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
trojan rat darkcomet
Executes dropped EXE 1 IoCs

Processes:

BitLocker.exe

pid process

3612 BitLocker.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

4eb72e48cfb33c9acef07a2e751778c015017c596c853c457480fc4789ace93b.exeBitLocker.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	4eb72e48cfb33c9acef07a2e751778c015017c596c853c457480fc4789ace93b.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\BitLocker Service = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\BitLocker\\BitLocker.exe"	4eb72e48cfb33c9acef07a2e751778c015017c596c853c457480fc4789ace93b.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	BitLocker.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\BitLocker Service = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\BitLocker\\BitLocker.exe"	BitLocker.exe

AutoIT Executable 6 IoCs

AutoIT scripts compiled to PE executables.

Processes:

resource	yara_rule
behavioral2/memory/5000-132-0x0000000000400000-0x0000000000505000-memory.dmp	autoit_exe
C:\Users\Admin\AppData\Roaming\Microsoft\BitLocker\BitLocker.exe	autoit_exe
behavioral2/memory/5000-136-0x0000000000400000-0x0000000000505000-memory.dmp	autoit_exe
C:\Users\Admin\AppData\Roaming\Microsoft\BitLocker\BitLocker.exe	autoit_exe
behavioral2/memory/3612-137-0x0000000000400000-0x0000000000505000-memory.dmp	autoit_exe
behavioral2/memory/3612-145-0x0000000000400000-0x0000000000505000-memory.dmp	autoit_exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

BitLocker.exe

description pid process target process

PID 3612 set thread context of 3068 3612 BitLocker.exe svchost.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

description	pid	process	target process
PID 3612 set thread context of 3068	3612	BitLocker.exe	svchost.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

BitLocker.exe

pid	process
3612	BitLocker.exe
3612	BitLocker.exe
3612	BitLocker.exe
3612	BitLocker.exe
3612	BitLocker.exe
3612	BitLocker.exe
3612	BitLocker.exe
3612	BitLocker.exe
3612	BitLocker.exe
3612	BitLocker.exe
3612	BitLocker.exe
3612	BitLocker.exe
3612	BitLocker.exe
3612	BitLocker.exe
3612	BitLocker.exe
3612	BitLocker.exe
3612	BitLocker.exe
3612	BitLocker.exe
3612	BitLocker.exe
3612	BitLocker.exe
3612	BitLocker.exe
3612	BitLocker.exe
3612	BitLocker.exe
3612	BitLocker.exe
3612	BitLocker.exe
3612	BitLocker.exe
3612	BitLocker.exe
3612	BitLocker.exe
3612	BitLocker.exe
3612	BitLocker.exe
3612	BitLocker.exe
3612	BitLocker.exe
3612	BitLocker.exe
3612	BitLocker.exe
3612	BitLocker.exe
3612	BitLocker.exe
3612	BitLocker.exe
3612	BitLocker.exe
3612	BitLocker.exe
3612	BitLocker.exe
3612	BitLocker.exe
3612	BitLocker.exe
3612	BitLocker.exe
3612	BitLocker.exe
3612	BitLocker.exe
3612	BitLocker.exe
3612	BitLocker.exe
3612	BitLocker.exe
3612	BitLocker.exe
3612	BitLocker.exe
3612	BitLocker.exe
3612	BitLocker.exe
3612	BitLocker.exe
3612	BitLocker.exe
3612	BitLocker.exe
3612	BitLocker.exe
3612	BitLocker.exe
3612	BitLocker.exe
3612	BitLocker.exe
3612	BitLocker.exe
3612	BitLocker.exe
3612	BitLocker.exe
3612	BitLocker.exe
3612	BitLocker.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

BitLocker.exe

pid process

3612 BitLocker.exe

Suspicious use of AdjustPrivilegeToken 24 IoCs

Processes:

svchost.exe

description	pid	process
Token: SeIncreaseQuotaPrivilege	3068	svchost.exe
Token: SeSecurityPrivilege	3068	svchost.exe
Token: SeTakeOwnershipPrivilege	3068	svchost.exe
Token: SeLoadDriverPrivilege	3068	svchost.exe
Token: SeSystemProfilePrivilege	3068	svchost.exe
Token: SeSystemtimePrivilege	3068	svchost.exe
Token: SeProfSingleProcessPrivilege	3068	svchost.exe
Token: SeIncBasePriorityPrivilege	3068	svchost.exe
Token: SeCreatePagefilePrivilege	3068	svchost.exe
Token: SeBackupPrivilege	3068	svchost.exe
Token: SeRestorePrivilege	3068	svchost.exe
Token: SeShutdownPrivilege	3068	svchost.exe
Token: SeDebugPrivilege	3068	svchost.exe
Token: SeSystemEnvironmentPrivilege	3068	svchost.exe
Token: SeChangeNotifyPrivilege	3068	svchost.exe
Token: SeRemoteShutdownPrivilege	3068	svchost.exe
Token: SeUndockPrivilege	3068	svchost.exe
Token: SeManageVolumePrivilege	3068	svchost.exe
Token: SeImpersonatePrivilege	3068	svchost.exe
Token: SeCreateGlobalPrivilege	3068	svchost.exe
Token: 33	3068	svchost.exe
Token: 34	3068	svchost.exe
Token: 35	3068	svchost.exe
Token: 36	3068	svchost.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

svchost.exe

pid process

3068 svchost.exe

pid	process
3068	svchost.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

4eb72e48cfb33c9acef07a2e751778c015017c596c853c457480fc4789ace93b.exeBitLocker.exe

description	pid	process	target process
PID 5000 wrote to memory of 3612	5000	4eb72e48cfb33c9acef07a2e751778c015017c596c853c457480fc4789ace93b.exe	BitLocker.exe
PID 5000 wrote to memory of 3612	5000	4eb72e48cfb33c9acef07a2e751778c015017c596c853c457480fc4789ace93b.exe	BitLocker.exe
PID 5000 wrote to memory of 3612	5000	4eb72e48cfb33c9acef07a2e751778c015017c596c853c457480fc4789ace93b.exe	BitLocker.exe
PID 3612 wrote to memory of 3068	3612	BitLocker.exe	svchost.exe
PID 3612 wrote to memory of 3068	3612	BitLocker.exe	svchost.exe
PID 3612 wrote to memory of 3068	3612	BitLocker.exe	svchost.exe
PID 3612 wrote to memory of 3068	3612	BitLocker.exe	svchost.exe
PID 3612 wrote to memory of 3068	3612	BitLocker.exe	svchost.exe

C:\Users\Admin\AppData\Local\Temp\4eb72e48cfb33c9acef07a2e751778c015017c596c853c457480fc4789ace93b.exe
"C:\Users\Admin\AppData\Local\Temp\4eb72e48cfb33c9acef07a2e751778c015017c596c853c457480fc4789ace93b.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:5000

C:\Users\Admin\AppData\Roaming\Microsoft\BitLocker\BitLocker.exe
C:\Users\Admin\AppData\Roaming\Microsoft\BitLocker\BitLocker.exe
2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
PID:3612

C:\Windows\SysWOW64\svchost.exe
"C:\Windows\SysWOW64\svchost.exe"
3⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:3068

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\BitLocker\BitLocker.exe
Filesize
922KB

MD5
012318a76ded2c3f07bc87951161e230

SHA1
36b461903b381fd4c9d411dd9ba2de6f447f0c02

SHA256
4eb72e48cfb33c9acef07a2e751778c015017c596c853c457480fc4789ace93b

SHA512
7335849867e421fdf1ea669faeb36e6cbfe43eea369fbb494254634557c2a8c62dcc8e1d209d3b7ee7aa978b2aac2ec9bc7caab61bb290ab421d128fcf78f40c

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\BitLocker\BitLocker.exe
Filesize
922KB

MD5
012318a76ded2c3f07bc87951161e230

SHA1
36b461903b381fd4c9d411dd9ba2de6f447f0c02

SHA256
4eb72e48cfb33c9acef07a2e751778c015017c596c853c457480fc4789ace93b

SHA512
7335849867e421fdf1ea669faeb36e6cbfe43eea369fbb494254634557c2a8c62dcc8e1d209d3b7ee7aa978b2aac2ec9bc7caab61bb290ab421d128fcf78f40c

Download Submit
memory/3068-142-0x0000000000400000-0x00000000004B1000-memory.dmp

Filesize
708KB

Download
memory/3068-138-0x0000000000000000-mapping.dmp

Download
memory/3068-139-0x0000000000400000-0x00000000004B1000-memory.dmp

Filesize
708KB

Download
memory/3068-141-0x0000000000400000-0x00000000004B1000-memory.dmp

Filesize
708KB

Download
memory/3068-143-0x0000000000400000-0x00000000004B1000-memory.dmp

Filesize
708KB

Download
memory/3068-144-0x0000000000400000-0x00000000004B1000-memory.dmp

Filesize
708KB

Download
memory/3612-133-0x0000000000000000-mapping.dmp

Download
memory/3612-137-0x0000000000400000-0x0000000000505000-memory.dmp

Filesize
1.0MB

Download
memory/3612-145-0x0000000000400000-0x0000000000505000-memory.dmp

Filesize
1.0MB

Download
memory/5000-136-0x0000000000400000-0x0000000000505000-memory.dmp

Filesize
1.0MB

Download
memory/5000-132-0x0000000000400000-0x0000000000505000-memory.dmp

Filesize
1.0MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads