darkcomet | ae4fa42de7213a4504a26549a101a884708328987618b4d63725d4504471cddc

General

Target

easy_Malicious_18002e1b1d29f91ca895ea6ed641bda48f9d8f7b596e4642122dfca1b7a6c34c.exe
Size

658KB
MD5

4929db096defe721914b1faf417aab61
SHA1

f8da6a23e153f40c8a89f20c5ea857ffbebf1fab
SHA256

ae4fa42de7213a4504a26549a101a884708328987618b4d63725d4504471cddc
SHA512

347e073cb104aa90e8662dd54ca373d8020975206ed36426f822d95efce3846319435155268d4821cc4f6cbba1248657154780593623771cc65ba1a66f38f0b0
SSDEEP

12288:29HMeUmcufrvA3kb445UEJ2jsWiD4EvFuu4cNgZhCiZKD/XdyFF:SiBIGkbxqEcjsWiDxguehC2SW

Score

10^/10

darkcomet all rat trojan

Malware Config

Extracted

Family

darkcomet

Botnet

All

C2

192.168.41.1:1604

Mutex

DC_MUTEX-47UZCQB

Attributes

gencode
Fp87tWpxW5mD
install
false
offline_keylogger
true
persistence
false

Signatures

Darkcomet
DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
trojan rat darkcomet
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 23 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	540	easy_Malicious_18002e1b1d29f91ca895ea6ed641bda48f9d8f7b596e4642122dfca1b7a6c34c.exe
Token: SeSecurityPrivilege	540	easy_Malicious_18002e1b1d29f91ca895ea6ed641bda48f9d8f7b596e4642122dfca1b7a6c34c.exe
Token: SeTakeOwnershipPrivilege	540	easy_Malicious_18002e1b1d29f91ca895ea6ed641bda48f9d8f7b596e4642122dfca1b7a6c34c.exe
Token: SeLoadDriverPrivilege	540	easy_Malicious_18002e1b1d29f91ca895ea6ed641bda48f9d8f7b596e4642122dfca1b7a6c34c.exe
Token: SeSystemProfilePrivilege	540	easy_Malicious_18002e1b1d29f91ca895ea6ed641bda48f9d8f7b596e4642122dfca1b7a6c34c.exe
Token: SeSystemtimePrivilege	540	easy_Malicious_18002e1b1d29f91ca895ea6ed641bda48f9d8f7b596e4642122dfca1b7a6c34c.exe
Token: SeProfSingleProcessPrivilege	540	easy_Malicious_18002e1b1d29f91ca895ea6ed641bda48f9d8f7b596e4642122dfca1b7a6c34c.exe
Token: SeIncBasePriorityPrivilege	540	easy_Malicious_18002e1b1d29f91ca895ea6ed641bda48f9d8f7b596e4642122dfca1b7a6c34c.exe
Token: SeCreatePagefilePrivilege	540	easy_Malicious_18002e1b1d29f91ca895ea6ed641bda48f9d8f7b596e4642122dfca1b7a6c34c.exe
Token: SeBackupPrivilege	540	easy_Malicious_18002e1b1d29f91ca895ea6ed641bda48f9d8f7b596e4642122dfca1b7a6c34c.exe
Token: SeRestorePrivilege	540	easy_Malicious_18002e1b1d29f91ca895ea6ed641bda48f9d8f7b596e4642122dfca1b7a6c34c.exe
Token: SeShutdownPrivilege	540	easy_Malicious_18002e1b1d29f91ca895ea6ed641bda48f9d8f7b596e4642122dfca1b7a6c34c.exe
Token: SeDebugPrivilege	540	easy_Malicious_18002e1b1d29f91ca895ea6ed641bda48f9d8f7b596e4642122dfca1b7a6c34c.exe
Token: SeSystemEnvironmentPrivilege	540	easy_Malicious_18002e1b1d29f91ca895ea6ed641bda48f9d8f7b596e4642122dfca1b7a6c34c.exe
Token: SeChangeNotifyPrivilege	540	easy_Malicious_18002e1b1d29f91ca895ea6ed641bda48f9d8f7b596e4642122dfca1b7a6c34c.exe
Token: SeRemoteShutdownPrivilege	540	easy_Malicious_18002e1b1d29f91ca895ea6ed641bda48f9d8f7b596e4642122dfca1b7a6c34c.exe
Token: SeUndockPrivilege	540	easy_Malicious_18002e1b1d29f91ca895ea6ed641bda48f9d8f7b596e4642122dfca1b7a6c34c.exe
Token: SeManageVolumePrivilege	540	easy_Malicious_18002e1b1d29f91ca895ea6ed641bda48f9d8f7b596e4642122dfca1b7a6c34c.exe
Token: SeImpersonatePrivilege	540	easy_Malicious_18002e1b1d29f91ca895ea6ed641bda48f9d8f7b596e4642122dfca1b7a6c34c.exe
Token: SeCreateGlobalPrivilege	540	easy_Malicious_18002e1b1d29f91ca895ea6ed641bda48f9d8f7b596e4642122dfca1b7a6c34c.exe
Token: 33	540	easy_Malicious_18002e1b1d29f91ca895ea6ed641bda48f9d8f7b596e4642122dfca1b7a6c34c.exe
Token: 34	540	easy_Malicious_18002e1b1d29f91ca895ea6ed641bda48f9d8f7b596e4642122dfca1b7a6c34c.exe
Token: 35	540	easy_Malicious_18002e1b1d29f91ca895ea6ed641bda48f9d8f7b596e4642122dfca1b7a6c34c.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
540	easy_Malicious_18002e1b1d29f91ca895ea6ed641bda48f9d8f7b596e4642122dfca1b7a6c34c.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 540 wrote to memory of 3040	540	easy_Malicious_18002e1b1d29f91ca895ea6ed641bda48f9d8f7b596e4642122dfca1b7a6c34c.exe	28
PID 540 wrote to memory of 3040	540	easy_Malicious_18002e1b1d29f91ca895ea6ed641bda48f9d8f7b596e4642122dfca1b7a6c34c.exe	28
PID 540 wrote to memory of 3040	540	easy_Malicious_18002e1b1d29f91ca895ea6ed641bda48f9d8f7b596e4642122dfca1b7a6c34c.exe	28
PID 540 wrote to memory of 3040	540	easy_Malicious_18002e1b1d29f91ca895ea6ed641bda48f9d8f7b596e4642122dfca1b7a6c34c.exe	28
PID 540 wrote to memory of 3032	540	easy_Malicious_18002e1b1d29f91ca895ea6ed641bda48f9d8f7b596e4642122dfca1b7a6c34c.exe	29
PID 540 wrote to memory of 3032	540	easy_Malicious_18002e1b1d29f91ca895ea6ed641bda48f9d8f7b596e4642122dfca1b7a6c34c.exe	29
PID 540 wrote to memory of 3032	540	easy_Malicious_18002e1b1d29f91ca895ea6ed641bda48f9d8f7b596e4642122dfca1b7a6c34c.exe	29
PID 540 wrote to memory of 3032	540	easy_Malicious_18002e1b1d29f91ca895ea6ed641bda48f9d8f7b596e4642122dfca1b7a6c34c.exe	29

C:\Users\Admin\AppData\Local\Temp\easy_Malicious_18002e1b1d29f91ca895ea6ed641bda48f9d8f7b596e4642122dfca1b7a6c34c.exe
"C:\Users\Admin\AppData\Local\Temp\easy_Malicious_18002e1b1d29f91ca895ea6ed641bda48f9d8f7b596e4642122dfca1b7a6c34c.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:540
- C:\Program Files (x86)\Internet Explorer\iexplore.exe
  "C:\Program Files (x86)\Internet Explorer\iexplore.exe"
  2⤵
  PID:3040
- C:\Windows\explorer.exe
  "C:\Windows\explorer.exe"
  2⤵
  PID:3032

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/540-54-0x0000000000250000-0x0000000000251000-memory.dmp

Filesize
4KB

Download
memory/540-55-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/540-57-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download

Analysis

Sharing