darkcomet | 4764430a1dcd759ca63408103232d28a82c2e1ae3c1cc29a536fecdee9171fb3

General

Target

53f9da2780b6f5a90cfa960a7ba80eef.exe
Size

1.3MB
MD5

53f9da2780b6f5a90cfa960a7ba80eef
SHA1

797377e262f78ebcbb50203a286fdcbc76b45e81
SHA256

4764430a1dcd759ca63408103232d28a82c2e1ae3c1cc29a536fecdee9171fb3
SHA512

bced0651108eecdad60f6b9291e065877f9b7b43ae5edbf659d6028c192de918f11e8d6019cc5e287f9036f33825c52f5b34fce58d4d76f02c834aa16dfdaa41
SSDEEP

24576:Vt3Neacap5W/4UHRY2FhJvQywVLjaGVOUN6nyhkHgKU6Y:VtUaAwls+9j4HgK

Score

10^/10

darkcomet slave evasion persistence rat spyware stealer trojan

Malware Config

Extracted

Family

darkcomet

Botnet

slave

C2

ratting.no-ip.org:1605

Mutex

DC_MUTEX-Q21PSYS

Attributes

gencode
3xN2KEijP0Bj
install
false
offline_keylogger
true
password
darkcomet
persistence
false

Signatures

Darkcomet
DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
trojan rat darkcomet

Disables RegEdit via registry modification 1 IoCs

evasion

Processes:

53f9da2780b6f5a90cfa960a7ba80eef.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	53f9da2780b6f5a90cfa960a7ba80eef.exe

Sets file to hidden 1 TTPs 2 IoCs
Modifies file attributes to stop it showing in Explorer etc.
evasion

Hidden Files and Directories
T1564.001

Processes:

attrib.exeattrib.exe

pid process

1544 attrib.exe
384 attrib.exe

pid	process
1544	attrib.exe
384	attrib.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

53f9da2780b6f5a90cfa960a7ba80eef.exeCrypted.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\Control Panel\International\Geo\Nation	53f9da2780b6f5a90cfa960a7ba80eef.exe
Key value queried	\REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\Control Panel\International\Geo\Nation	Crypted.exe

Executes dropped EXE 1 IoCs

Processes:

Crypted.exe

pid process

428 Crypted.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

pid	process
428	Crypted.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

53f9da2780b6f5a90cfa960a7ba80eef.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\53f9da2780b6f5a90cfa960a7ba80eef.exe"	53f9da2780b6f5a90cfa960a7ba80eef.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

taskmgr.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	taskmgr.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

53f9da2780b6f5a90cfa960a7ba80eef.exetaskmgr.exe

pid	process
4740	53f9da2780b6f5a90cfa960a7ba80eef.exe
4740	53f9da2780b6f5a90cfa960a7ba80eef.exe
4740	53f9da2780b6f5a90cfa960a7ba80eef.exe
4740	53f9da2780b6f5a90cfa960a7ba80eef.exe
4740	53f9da2780b6f5a90cfa960a7ba80eef.exe
4740	53f9da2780b6f5a90cfa960a7ba80eef.exe
4348	taskmgr.exe
4348	taskmgr.exe
4348	taskmgr.exe
4348	taskmgr.exe
4348	taskmgr.exe
4348	taskmgr.exe
4348	taskmgr.exe
4348	taskmgr.exe
4348	taskmgr.exe
4348	taskmgr.exe
4348	taskmgr.exe
4348	taskmgr.exe
4348	taskmgr.exe
4348	taskmgr.exe
4348	taskmgr.exe
4348	taskmgr.exe
4348	taskmgr.exe
4348	taskmgr.exe
4348	taskmgr.exe
4348	taskmgr.exe
4348	taskmgr.exe
4348	taskmgr.exe
4348	taskmgr.exe
4348	taskmgr.exe
4348	taskmgr.exe
4348	taskmgr.exe
4348	taskmgr.exe
4348	taskmgr.exe
4348	taskmgr.exe
4348	taskmgr.exe
4348	taskmgr.exe
4348	taskmgr.exe
4348	taskmgr.exe
4348	taskmgr.exe
4348	taskmgr.exe
4348	taskmgr.exe
4348	taskmgr.exe
4348	taskmgr.exe
4348	taskmgr.exe
4348	taskmgr.exe
4348	taskmgr.exe
4348	taskmgr.exe
4348	taskmgr.exe
4348	taskmgr.exe
4348	taskmgr.exe
4348	taskmgr.exe
4348	taskmgr.exe
4348	taskmgr.exe
4348	taskmgr.exe
4348	taskmgr.exe
4348	taskmgr.exe
4348	taskmgr.exe
4348	taskmgr.exe
4348	taskmgr.exe
4348	taskmgr.exe
4348	taskmgr.exe
4348	taskmgr.exe
4348	taskmgr.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

Processes:

Crypted.exetaskmgr.exe

pid process

428 Crypted.exe
4348 taskmgr.exe

pid	process
428	Crypted.exe
4348	taskmgr.exe

Suspicious use of AdjustPrivilegeToken 28 IoCs

Processes:

Crypted.exe53f9da2780b6f5a90cfa960a7ba80eef.exetaskmgr.exe

description	pid	process
Token: SeIncreaseQuotaPrivilege	428	Crypted.exe
Token: SeSecurityPrivilege	428	Crypted.exe
Token: SeTakeOwnershipPrivilege	428	Crypted.exe
Token: SeLoadDriverPrivilege	428	Crypted.exe
Token: SeSystemProfilePrivilege	428	Crypted.exe
Token: SeSystemtimePrivilege	428	Crypted.exe
Token: SeProfSingleProcessPrivilege	428	Crypted.exe
Token: SeIncBasePriorityPrivilege	428	Crypted.exe
Token: SeCreatePagefilePrivilege	428	Crypted.exe
Token: SeBackupPrivilege	428	Crypted.exe
Token: SeRestorePrivilege	428	Crypted.exe
Token: SeShutdownPrivilege	428	Crypted.exe
Token: SeDebugPrivilege	428	Crypted.exe
Token: SeSystemEnvironmentPrivilege	428	Crypted.exe
Token: SeChangeNotifyPrivilege	428	Crypted.exe
Token: SeRemoteShutdownPrivilege	428	Crypted.exe
Token: SeUndockPrivilege	428	Crypted.exe
Token: SeManageVolumePrivilege	428	Crypted.exe
Token: SeImpersonatePrivilege	428	Crypted.exe
Token: SeCreateGlobalPrivilege	428	Crypted.exe
Token: 33	428	Crypted.exe
Token: 34	428	Crypted.exe
Token: 35	428	Crypted.exe
Token: 36	428	Crypted.exe
Token: SeDebugPrivilege	4740	53f9da2780b6f5a90cfa960a7ba80eef.exe
Token: SeDebugPrivilege	4348	taskmgr.exe
Token: SeSystemProfilePrivilege	4348	taskmgr.exe
Token: SeCreateGlobalPrivilege	4348	taskmgr.exe

Suspicious use of FindShellTrayWindow 64 IoCs

Processes:

taskmgr.exe

pid	process
4348	taskmgr.exe
4348	taskmgr.exe
4348	taskmgr.exe
4348	taskmgr.exe
4348	taskmgr.exe
4348	taskmgr.exe
4348	taskmgr.exe
4348	taskmgr.exe
4348	taskmgr.exe
4348	taskmgr.exe
4348	taskmgr.exe
4348	taskmgr.exe
4348	taskmgr.exe
4348	taskmgr.exe
4348	taskmgr.exe
4348	taskmgr.exe
4348	taskmgr.exe
4348	taskmgr.exe
4348	taskmgr.exe
4348	taskmgr.exe
4348	taskmgr.exe
4348	taskmgr.exe
4348	taskmgr.exe
4348	taskmgr.exe
4348	taskmgr.exe
4348	taskmgr.exe
4348	taskmgr.exe
4348	taskmgr.exe
4348	taskmgr.exe
4348	taskmgr.exe
4348	taskmgr.exe
4348	taskmgr.exe
4348	taskmgr.exe
4348	taskmgr.exe
4348	taskmgr.exe
4348	taskmgr.exe
4348	taskmgr.exe
4348	taskmgr.exe
4348	taskmgr.exe
4348	taskmgr.exe
4348	taskmgr.exe
4348	taskmgr.exe
4348	taskmgr.exe
4348	taskmgr.exe
4348	taskmgr.exe
4348	taskmgr.exe
4348	taskmgr.exe
4348	taskmgr.exe
4348	taskmgr.exe
4348	taskmgr.exe
4348	taskmgr.exe
4348	taskmgr.exe
4348	taskmgr.exe
4348	taskmgr.exe
4348	taskmgr.exe
4348	taskmgr.exe
4348	taskmgr.exe
4348	taskmgr.exe
4348	taskmgr.exe
4348	taskmgr.exe
4348	taskmgr.exe
4348	taskmgr.exe
4348	taskmgr.exe
4348	taskmgr.exe

Suspicious use of SendNotifyMessage 64 IoCs

Processes:

taskmgr.exe

pid	process
4348	taskmgr.exe
4348	taskmgr.exe
4348	taskmgr.exe
4348	taskmgr.exe
4348	taskmgr.exe
4348	taskmgr.exe
4348	taskmgr.exe
4348	taskmgr.exe
4348	taskmgr.exe
4348	taskmgr.exe
4348	taskmgr.exe
4348	taskmgr.exe
4348	taskmgr.exe
4348	taskmgr.exe
4348	taskmgr.exe
4348	taskmgr.exe
4348	taskmgr.exe
4348	taskmgr.exe
4348	taskmgr.exe
4348	taskmgr.exe
4348	taskmgr.exe
4348	taskmgr.exe
4348	taskmgr.exe
4348	taskmgr.exe
4348	taskmgr.exe
4348	taskmgr.exe
4348	taskmgr.exe
4348	taskmgr.exe
4348	taskmgr.exe
4348	taskmgr.exe
4348	taskmgr.exe
4348	taskmgr.exe
4348	taskmgr.exe
4348	taskmgr.exe
4348	taskmgr.exe
4348	taskmgr.exe
4348	taskmgr.exe
4348	taskmgr.exe
4348	taskmgr.exe
4348	taskmgr.exe
4348	taskmgr.exe
4348	taskmgr.exe
4348	taskmgr.exe
4348	taskmgr.exe
4348	taskmgr.exe
4348	taskmgr.exe
4348	taskmgr.exe
4348	taskmgr.exe
4348	taskmgr.exe
4348	taskmgr.exe
4348	taskmgr.exe
4348	taskmgr.exe
4348	taskmgr.exe
4348	taskmgr.exe
4348	taskmgr.exe
4348	taskmgr.exe
4348	taskmgr.exe
4348	taskmgr.exe
4348	taskmgr.exe
4348	taskmgr.exe
4348	taskmgr.exe
4348	taskmgr.exe
4348	taskmgr.exe
4348	taskmgr.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

Crypted.exe

pid process

428 Crypted.exe

pid	process
428	Crypted.exe

Suspicious use of WriteProcessMemory 18 IoCs

Processes:

53f9da2780b6f5a90cfa960a7ba80eef.exeCrypted.execmd.execmd.exe

description	pid	process	target process
PID 4740 wrote to memory of 428	4740	53f9da2780b6f5a90cfa960a7ba80eef.exe	Crypted.exe
PID 4740 wrote to memory of 428	4740	53f9da2780b6f5a90cfa960a7ba80eef.exe	Crypted.exe
PID 4740 wrote to memory of 428	4740	53f9da2780b6f5a90cfa960a7ba80eef.exe	Crypted.exe
PID 428 wrote to memory of 2680	428	Crypted.exe	cmd.exe
PID 428 wrote to memory of 2680	428	Crypted.exe	cmd.exe
PID 428 wrote to memory of 2680	428	Crypted.exe	cmd.exe
PID 428 wrote to memory of 3756	428	Crypted.exe	cmd.exe
PID 428 wrote to memory of 3756	428	Crypted.exe	cmd.exe
PID 428 wrote to memory of 3756	428	Crypted.exe	cmd.exe
PID 3756 wrote to memory of 384	3756	cmd.exe	attrib.exe
PID 3756 wrote to memory of 384	3756	cmd.exe	attrib.exe
PID 3756 wrote to memory of 384	3756	cmd.exe	attrib.exe
PID 2680 wrote to memory of 1544	2680	cmd.exe	attrib.exe
PID 2680 wrote to memory of 1544	2680	cmd.exe	attrib.exe
PID 2680 wrote to memory of 1544	2680	cmd.exe	attrib.exe
PID 4740 wrote to memory of 4348	4740	53f9da2780b6f5a90cfa960a7ba80eef.exe	taskmgr.exe
PID 4740 wrote to memory of 4348	4740	53f9da2780b6f5a90cfa960a7ba80eef.exe	taskmgr.exe
PID 4740 wrote to memory of 4348	4740	53f9da2780b6f5a90cfa960a7ba80eef.exe	taskmgr.exe

Views/modifies file attributes 1 TTPs 2 IoCs
evasion

Hidden Files and Directories
T1564.001

Processes:

attrib.exeattrib.exe

pid process

384 attrib.exe
1544 attrib.exe

pid	process
384	attrib.exe
1544	attrib.exe

C:\Users\Admin\AppData\Local\Temp\53f9da2780b6f5a90cfa960a7ba80eef.exe
"C:\Users\Admin\AppData\Local\Temp\53f9da2780b6f5a90cfa960a7ba80eef.exe"
1⤵
- Disables RegEdit via registry modification
- Checks computer location settings
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4740

C:\Users\Admin\AppData\Local\Temp\Crypted.exe
"C:\Users\Admin\AppData\Local\Temp\Crypted.exe"
2⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:428

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp" +s +h
3⤵
- Suspicious use of WriteProcessMemory
PID:3756

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Users\Admin\AppData\Local\Temp" +s +h
4⤵
- Sets file to hidden
- Views/modifies file attributes
PID:384

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp\Crypted.exe" +s +h
3⤵
- Suspicious use of WriteProcessMemory
PID:2680

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Users\Admin\AppData\Local\Temp\Crypted.exe" +s +h
4⤵
- Sets file to hidden
- Views/modifies file attributes
PID:1544

C:\Windows\SysWOW64\taskmgr.exe
taskmgr.exe
2⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4348

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Hide Artifacts

2

T1564

Hidden Files and Directories

Modify Registry

Credential Access

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

Query Registry

2

T1012

System Information Discovery

3

T1082

Peripheral Device Discovery

1

T1120

Lateral Movement

Collection

Data from Local System

1

T1005

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Crypted.exe
Filesize
593KB

MD5
6b5b6b611176f9d64e2be4883a3ffb52

SHA1
466c9bd00c2bdcf067bfcb5e6cb6b6c6e2216190

SHA256
787e62d33a04d9ec39d15579159ab954766acc2ad4e6a0e94f65e6a36199ae6e

SHA512
fd6f8f08488ed4f97c5a7f0861b8fed63bb1d5db75a7b101d1895e6f76bed48ed57c8056e131c47c2ab1d5ec3d6f2a44153f14667269f636e3103efe5e2d7b50

Download Submit
C:\Users\Admin\AppData\Local\Temp\Crypted.exe
Filesize
407KB

MD5
5c9f0a44c40089d69d12793e41d54209

SHA1
da57b7e9832f6593042f860b45eba5a490792438

SHA256
1a0664dbac35cc234c02a3775989b37e35ee4a00f3adfa7c92d5b9bd8a2100f7

SHA512
0103d7e2a2b6c5ec3c9d053b34703c813099cce3194228db1cec00fa79679baa54e815b51a101562a27c39a474ae2541ac23e812d240bb471050a57a18bf76f7

Download Submit
C:\Users\Admin\AppData\Local\Temp\Crypted.exe
Filesize
498KB

MD5
c2c01edcea8336c93f751d8c55612ee9

SHA1
f59ceba2e3b518122a3902d4572a87da107be958

SHA256
597a7185082c9b08d1aacc9c76ccfc9bb6dcd119a85cc453b99c2d08d18a3ef2

SHA512
c0275ad92c3d826c9c7ecc44ee6233c246407b7ea2440b01184fec4d61bb6f5b2f7c61283feb72a23551daa1795b7ee127977ef9e1d4f7eeed2d0b2b9ad792c3

Download Submit
memory/428-45-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/428-18-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/428-47-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/428-14-0x00000000007E0000-0x00000000007E1000-memory.dmp

Filesize
4KB

Download
memory/428-15-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/428-34-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/428-44-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/428-46-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/428-43-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/428-42-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/428-40-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/428-39-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/428-38-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/428-37-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/428-35-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/4348-31-0x0000000008500000-0x0000000008501000-memory.dmp

Filesize
4KB

Download
memory/4348-22-0x0000000008500000-0x0000000008501000-memory.dmp

Filesize
4KB

Download
memory/4348-29-0x0000000008500000-0x0000000008501000-memory.dmp

Filesize
4KB

Download
memory/4348-28-0x0000000008500000-0x0000000008501000-memory.dmp

Filesize
4KB

Download
memory/4348-27-0x0000000008500000-0x0000000008501000-memory.dmp

Filesize
4KB

Download
memory/4348-30-0x0000000008500000-0x0000000008501000-memory.dmp

Filesize
4KB

Download
memory/4348-32-0x0000000008500000-0x0000000008501000-memory.dmp

Filesize
4KB

Download
memory/4348-23-0x0000000008500000-0x0000000008501000-memory.dmp

Filesize
4KB

Download
memory/4348-33-0x0000000008500000-0x0000000008501000-memory.dmp

Filesize
4KB

Download
memory/4348-21-0x0000000008500000-0x0000000008501000-memory.dmp

Filesize
4KB

Download
memory/4740-2-0x0000000000E40000-0x0000000000E50000-memory.dmp

Filesize
64KB

Download
memory/4740-36-0x0000000000E40000-0x0000000000E50000-memory.dmp

Filesize
64KB

Download
memory/4740-20-0x0000000000E40000-0x0000000000E50000-memory.dmp

Filesize
64KB

Download
memory/4740-19-0x0000000000E40000-0x0000000000E50000-memory.dmp

Filesize
64KB

Download
memory/4740-17-0x00000000748A0000-0x0000000074E51000-memory.dmp

Filesize
5.7MB

Download
memory/4740-16-0x00000000748A0000-0x0000000074E51000-memory.dmp

Filesize
5.7MB

Download
memory/4740-0-0x00000000748A0000-0x0000000074E51000-memory.dmp

Filesize
5.7MB

Download
memory/4740-1-0x00000000748A0000-0x0000000074E51000-memory.dmp

Filesize
5.7MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads