darkcomet | ba27ee9e692a97b1d58f6aa006072349040cc3fc39aed79bc8998c3c524d5c2d

General

Target

ba27ee9e692a97b1d58f6aa006072349040cc3fc39aed79bc8998c3c524d5c2d.exe
Size

1.5MB
MD5

1d06209309e0b8f18e3d769d21728591
SHA1

e02024506c73a4487cfa4cd209c7f07346ce2c58
SHA256

ba27ee9e692a97b1d58f6aa006072349040cc3fc39aed79bc8998c3c524d5c2d
SHA512

575e02ba1633b5ba30a9387dd63d0e7737ec41a6f619a4d5fb7794e85660f522e2867d1ca6ec790eb7fdaed3ee9fcde7ce68931fd01011ce12051ce11747cfa3
SSDEEP

24576:YRmYkcoQricOIrxiZY1iapYfP7wKaHnCMjORymu7Xmg7FT2b8:dYZoQrbT8ZY1iapMP16zt2g7FaY

Score

10^/10

darkcomet hb persistence rat trojan

Malware Config

Extracted

Family

darkcomet

Botnet

HB

C2

ridingdark.no-ip.biz:1337

Mutex

DC_MUTEX-L7FRRW9

Attributes

gencode
5BpKzfGArBf6
install
false
offline_keylogger
true
persistence
false

Signatures

Darkcomet
DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
trojan rat darkcomet

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\839011 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\839011\\svhost.exe"	ba27ee9e692a97b1d58f6aa006072349040cc3fc39aed79bc8998c3c524d5c2d.exe
Key created	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run	ba27ee9e692a97b1d58f6aa006072349040cc3fc39aed79bc8998c3c524d5c2d.exe

Enumerates connected drives 3 TTPs 24 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\e:	ba27ee9e692a97b1d58f6aa006072349040cc3fc39aed79bc8998c3c524d5c2d.exe
File opened (read-only)	\??\g:	ba27ee9e692a97b1d58f6aa006072349040cc3fc39aed79bc8998c3c524d5c2d.exe
File opened (read-only)	\??\r:	ba27ee9e692a97b1d58f6aa006072349040cc3fc39aed79bc8998c3c524d5c2d.exe
File opened (read-only)	\??\v:	ba27ee9e692a97b1d58f6aa006072349040cc3fc39aed79bc8998c3c524d5c2d.exe
File opened (read-only)	\??\w:	ba27ee9e692a97b1d58f6aa006072349040cc3fc39aed79bc8998c3c524d5c2d.exe
File opened (read-only)	\??\s:	ba27ee9e692a97b1d58f6aa006072349040cc3fc39aed79bc8998c3c524d5c2d.exe
File opened (read-only)	\??\u:	ba27ee9e692a97b1d58f6aa006072349040cc3fc39aed79bc8998c3c524d5c2d.exe
File opened (read-only)	\??\a:	ba27ee9e692a97b1d58f6aa006072349040cc3fc39aed79bc8998c3c524d5c2d.exe
File opened (read-only)	\??\f:	ba27ee9e692a97b1d58f6aa006072349040cc3fc39aed79bc8998c3c524d5c2d.exe
File opened (read-only)	\??\h:	ba27ee9e692a97b1d58f6aa006072349040cc3fc39aed79bc8998c3c524d5c2d.exe
File opened (read-only)	\??\i:	ba27ee9e692a97b1d58f6aa006072349040cc3fc39aed79bc8998c3c524d5c2d.exe
File opened (read-only)	\??\j:	ba27ee9e692a97b1d58f6aa006072349040cc3fc39aed79bc8998c3c524d5c2d.exe
File opened (read-only)	\??\q:	ba27ee9e692a97b1d58f6aa006072349040cc3fc39aed79bc8998c3c524d5c2d.exe
File opened (read-only)	\??\y:	ba27ee9e692a97b1d58f6aa006072349040cc3fc39aed79bc8998c3c524d5c2d.exe
File opened (read-only)	\??\k:	ba27ee9e692a97b1d58f6aa006072349040cc3fc39aed79bc8998c3c524d5c2d.exe
File opened (read-only)	\??\p:	ba27ee9e692a97b1d58f6aa006072349040cc3fc39aed79bc8998c3c524d5c2d.exe
File opened (read-only)	\??\z:	ba27ee9e692a97b1d58f6aa006072349040cc3fc39aed79bc8998c3c524d5c2d.exe
File opened (read-only)	\??\x:	ba27ee9e692a97b1d58f6aa006072349040cc3fc39aed79bc8998c3c524d5c2d.exe
File opened (read-only)	\??\b:	ba27ee9e692a97b1d58f6aa006072349040cc3fc39aed79bc8998c3c524d5c2d.exe
File opened (read-only)	\??\l:	ba27ee9e692a97b1d58f6aa006072349040cc3fc39aed79bc8998c3c524d5c2d.exe
File opened (read-only)	\??\m:	ba27ee9e692a97b1d58f6aa006072349040cc3fc39aed79bc8998c3c524d5c2d.exe
File opened (read-only)	\??\n:	ba27ee9e692a97b1d58f6aa006072349040cc3fc39aed79bc8998c3c524d5c2d.exe
File opened (read-only)	\??\o:	ba27ee9e692a97b1d58f6aa006072349040cc3fc39aed79bc8998c3c524d5c2d.exe
File opened (read-only)	\??\t:	ba27ee9e692a97b1d58f6aa006072349040cc3fc39aed79bc8998c3c524d5c2d.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 848 set thread context of 668	848	ba27ee9e692a97b1d58f6aa006072349040cc3fc39aed79bc8998c3c524d5c2d.exe	29

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 23 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	668	ba27ee9e692a97b1d58f6aa006072349040cc3fc39aed79bc8998c3c524d5c2d.exe
Token: SeSecurityPrivilege	668	ba27ee9e692a97b1d58f6aa006072349040cc3fc39aed79bc8998c3c524d5c2d.exe
Token: SeTakeOwnershipPrivilege	668	ba27ee9e692a97b1d58f6aa006072349040cc3fc39aed79bc8998c3c524d5c2d.exe
Token: SeLoadDriverPrivilege	668	ba27ee9e692a97b1d58f6aa006072349040cc3fc39aed79bc8998c3c524d5c2d.exe
Token: SeSystemProfilePrivilege	668	ba27ee9e692a97b1d58f6aa006072349040cc3fc39aed79bc8998c3c524d5c2d.exe
Token: SeSystemtimePrivilege	668	ba27ee9e692a97b1d58f6aa006072349040cc3fc39aed79bc8998c3c524d5c2d.exe
Token: SeProfSingleProcessPrivilege	668	ba27ee9e692a97b1d58f6aa006072349040cc3fc39aed79bc8998c3c524d5c2d.exe
Token: SeIncBasePriorityPrivilege	668	ba27ee9e692a97b1d58f6aa006072349040cc3fc39aed79bc8998c3c524d5c2d.exe
Token: SeCreatePagefilePrivilege	668	ba27ee9e692a97b1d58f6aa006072349040cc3fc39aed79bc8998c3c524d5c2d.exe
Token: SeBackupPrivilege	668	ba27ee9e692a97b1d58f6aa006072349040cc3fc39aed79bc8998c3c524d5c2d.exe
Token: SeRestorePrivilege	668	ba27ee9e692a97b1d58f6aa006072349040cc3fc39aed79bc8998c3c524d5c2d.exe
Token: SeShutdownPrivilege	668	ba27ee9e692a97b1d58f6aa006072349040cc3fc39aed79bc8998c3c524d5c2d.exe
Token: SeDebugPrivilege	668	ba27ee9e692a97b1d58f6aa006072349040cc3fc39aed79bc8998c3c524d5c2d.exe
Token: SeSystemEnvironmentPrivilege	668	ba27ee9e692a97b1d58f6aa006072349040cc3fc39aed79bc8998c3c524d5c2d.exe
Token: SeChangeNotifyPrivilege	668	ba27ee9e692a97b1d58f6aa006072349040cc3fc39aed79bc8998c3c524d5c2d.exe
Token: SeRemoteShutdownPrivilege	668	ba27ee9e692a97b1d58f6aa006072349040cc3fc39aed79bc8998c3c524d5c2d.exe
Token: SeUndockPrivilege	668	ba27ee9e692a97b1d58f6aa006072349040cc3fc39aed79bc8998c3c524d5c2d.exe
Token: SeManageVolumePrivilege	668	ba27ee9e692a97b1d58f6aa006072349040cc3fc39aed79bc8998c3c524d5c2d.exe
Token: SeImpersonatePrivilege	668	ba27ee9e692a97b1d58f6aa006072349040cc3fc39aed79bc8998c3c524d5c2d.exe
Token: SeCreateGlobalPrivilege	668	ba27ee9e692a97b1d58f6aa006072349040cc3fc39aed79bc8998c3c524d5c2d.exe
Token: 33	668	ba27ee9e692a97b1d58f6aa006072349040cc3fc39aed79bc8998c3c524d5c2d.exe
Token: 34	668	ba27ee9e692a97b1d58f6aa006072349040cc3fc39aed79bc8998c3c524d5c2d.exe
Token: 35	668	ba27ee9e692a97b1d58f6aa006072349040cc3fc39aed79bc8998c3c524d5c2d.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
668	ba27ee9e692a97b1d58f6aa006072349040cc3fc39aed79bc8998c3c524d5c2d.exe

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 848 wrote to memory of 668	848	ba27ee9e692a97b1d58f6aa006072349040cc3fc39aed79bc8998c3c524d5c2d.exe	29
PID 848 wrote to memory of 668	848	ba27ee9e692a97b1d58f6aa006072349040cc3fc39aed79bc8998c3c524d5c2d.exe	29
PID 848 wrote to memory of 668	848	ba27ee9e692a97b1d58f6aa006072349040cc3fc39aed79bc8998c3c524d5c2d.exe	29
PID 848 wrote to memory of 668	848	ba27ee9e692a97b1d58f6aa006072349040cc3fc39aed79bc8998c3c524d5c2d.exe	29
PID 848 wrote to memory of 668	848	ba27ee9e692a97b1d58f6aa006072349040cc3fc39aed79bc8998c3c524d5c2d.exe	29
PID 848 wrote to memory of 668	848	ba27ee9e692a97b1d58f6aa006072349040cc3fc39aed79bc8998c3c524d5c2d.exe	29
PID 848 wrote to memory of 668	848	ba27ee9e692a97b1d58f6aa006072349040cc3fc39aed79bc8998c3c524d5c2d.exe	29
PID 848 wrote to memory of 668	848	ba27ee9e692a97b1d58f6aa006072349040cc3fc39aed79bc8998c3c524d5c2d.exe	29
PID 848 wrote to memory of 668	848	ba27ee9e692a97b1d58f6aa006072349040cc3fc39aed79bc8998c3c524d5c2d.exe	29
PID 848 wrote to memory of 668	848	ba27ee9e692a97b1d58f6aa006072349040cc3fc39aed79bc8998c3c524d5c2d.exe	29
PID 848 wrote to memory of 668	848	ba27ee9e692a97b1d58f6aa006072349040cc3fc39aed79bc8998c3c524d5c2d.exe	29
PID 848 wrote to memory of 668	848	ba27ee9e692a97b1d58f6aa006072349040cc3fc39aed79bc8998c3c524d5c2d.exe	29
PID 848 wrote to memory of 668	848	ba27ee9e692a97b1d58f6aa006072349040cc3fc39aed79bc8998c3c524d5c2d.exe	29

C:\Users\Admin\AppData\Local\Temp\ba27ee9e692a97b1d58f6aa006072349040cc3fc39aed79bc8998c3c524d5c2d.exe
"C:\Users\Admin\AppData\Local\Temp\ba27ee9e692a97b1d58f6aa006072349040cc3fc39aed79bc8998c3c524d5c2d.exe"
1⤵
- Adds Run key to start application
- Enumerates connected drives
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:848
- C:\Users\Admin\AppData\Local\Temp\ba27ee9e692a97b1d58f6aa006072349040cc3fc39aed79bc8998c3c524d5c2d.exe
  "C:\Users\Admin\AppData\Local\Temp\ba27ee9e692a97b1d58f6aa006072349040cc3fc39aed79bc8998c3c524d5c2d.exe"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:668

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/668-65-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/668-56-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/668-58-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/668-60-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/668-62-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/668-55-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/668-67-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/668-75-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/668-69-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/668-64-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/668-71-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/668-73-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/668-74-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/848-54-0x00000000766F1000-0x00000000766F3000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing