darkcomet | f805abca58f0933dc66b09f7b9886394a92d481343df2851415f673b2b7ca0f2

Analysis

max time kernel
152s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
15/01/2024, 22:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
5e412597778f7df65155685a8bdcd4be.exe
Size 1.3MB
Sample240115-2el87ahbd2
SHA256 f805abca58f0933dc66b09f7b9886394a92d481343df2851415f673b2b7ca0f2
MD5 5e412597778f7df65155685a8bdcd4be
SHA1 1086c375c09c07486f0542c679a74d61dd943594
SHA512 579bb3cea0b8daa74b9221191d4ad484f92379f01f8298d055fb50e3ae0a58e15847b6933ab6d6960564ebd0625d680ca31b7d74e2a233d7b43ae9e9de1438da
SSDEEP 24576:vFAABG9aJp25/4ddZMAsiIMXNI+RVN64AzFfoC9kAblzH2JCYkkX5zA:ZaaJpo/yZN6MXN9/NrAZgM2JlFA
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

darkcomet latentbot sks persistence rat trojan upx

Malware Config

Extracted

Family

darkcomet

Botnet

essstzttztz.zapto.org:1612

Mutex

DC_MUTEX-F54S21D

Attributes

gencode
lwRB5npjTSK8
install
false
offline_keylogger
true
persistence
false

Extracted

Family

latentbot

essstzttztz.zapto.org

Signatures

Darkcomet
DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
trojan rat darkcomet
LatentBot
Modular trojan written in Delphi which has been in-the-wild since 2013.
trojan latentbot

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\Control Panel\International\Geo\Nation	5e412597778f7df65155685a8bdcd4be.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\Control Panel\International\Geo\Nation	WLIDSCV.exe

Executes dropped EXE 2 IoCs

pid	Process
5088	WLIDSCV.exe
3512	flashmk.exe

UPX packed file 20 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/1192-41-0x0000000000400000-0x00000000004BA000-memory.dmp	upx
behavioral2/memory/1192-42-0x0000000000400000-0x00000000004BA000-memory.dmp	upx
behavioral2/memory/1192-43-0x0000000000400000-0x00000000004BA000-memory.dmp	upx
behavioral2/memory/1192-45-0x0000000000400000-0x00000000004BA000-memory.dmp	upx
behavioral2/memory/1192-47-0x0000000000400000-0x00000000004BA000-memory.dmp	upx
behavioral2/memory/1192-48-0x0000000000400000-0x00000000004BA000-memory.dmp	upx
behavioral2/memory/1192-49-0x0000000000400000-0x00000000004BA000-memory.dmp	upx
behavioral2/memory/1192-54-0x0000000000400000-0x00000000004BA000-memory.dmp	upx
behavioral2/memory/1192-55-0x0000000000400000-0x00000000004BA000-memory.dmp	upx
behavioral2/memory/1192-56-0x0000000000400000-0x00000000004BA000-memory.dmp	upx
behavioral2/memory/1192-57-0x0000000000400000-0x00000000004BA000-memory.dmp	upx
behavioral2/memory/1192-58-0x0000000000400000-0x00000000004BA000-memory.dmp	upx
behavioral2/memory/1192-59-0x0000000000400000-0x00000000004BA000-memory.dmp	upx
behavioral2/memory/1192-60-0x0000000000400000-0x00000000004BA000-memory.dmp	upx
behavioral2/memory/1192-61-0x0000000000400000-0x00000000004BA000-memory.dmp	upx
behavioral2/memory/1192-62-0x0000000000400000-0x00000000004BA000-memory.dmp	upx
behavioral2/memory/1192-63-0x0000000000400000-0x00000000004BA000-memory.dmp	upx
behavioral2/memory/1192-64-0x0000000000400000-0x00000000004BA000-memory.dmp	upx
behavioral2/memory/1192-65-0x0000000000400000-0x00000000004BA000-memory.dmp	upx
behavioral2/memory/1192-66-0x0000000000400000-0x00000000004BA000-memory.dmp	upx

Uses the VBS compiler for execution 1 TTPs

Scripting
T1064

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\audiops = "C:\\Users\\Admin\\AppData\\Roaming\\flashmk.exe"	vbc.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 2988 set thread context of 4496	2988	5e412597778f7df65155685a8bdcd4be.exe	88
PID 3512 set thread context of 1192	3512	flashmk.exe	96

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

NTFS ADS 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\flashmk.exe:ZONE.identifier	cmd.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
5088	WLIDSCV.exe
5088	WLIDSCV.exe
5088	WLIDSCV.exe
3512	flashmk.exe
5088	WLIDSCV.exe
5088	WLIDSCV.exe
3512	flashmk.exe
5088	WLIDSCV.exe
3512	flashmk.exe
5088	WLIDSCV.exe
5088	WLIDSCV.exe
3512	flashmk.exe
5088	WLIDSCV.exe
3512	flashmk.exe
5088	WLIDSCV.exe
5088	WLIDSCV.exe
3512	flashmk.exe
5088	WLIDSCV.exe
5088	WLIDSCV.exe
3512	flashmk.exe
5088	WLIDSCV.exe
3512	flashmk.exe
5088	WLIDSCV.exe
5088	WLIDSCV.exe
3512	flashmk.exe
5088	WLIDSCV.exe
5088	WLIDSCV.exe
3512	flashmk.exe
5088	WLIDSCV.exe
3512	flashmk.exe
5088	WLIDSCV.exe
5088	WLIDSCV.exe
3512	flashmk.exe
5088	WLIDSCV.exe
5088	WLIDSCV.exe
3512	flashmk.exe
5088	WLIDSCV.exe
3512	flashmk.exe
5088	WLIDSCV.exe
5088	WLIDSCV.exe
3512	flashmk.exe
5088	WLIDSCV.exe
5088	WLIDSCV.exe
3512	flashmk.exe
5088	WLIDSCV.exe
3512	flashmk.exe
5088	WLIDSCV.exe
5088	WLIDSCV.exe
3512	flashmk.exe
5088	WLIDSCV.exe
5088	WLIDSCV.exe
3512	flashmk.exe
5088	WLIDSCV.exe
3512	flashmk.exe
5088	WLIDSCV.exe
5088	WLIDSCV.exe
3512	flashmk.exe
5088	WLIDSCV.exe
5088	WLIDSCV.exe
3512	flashmk.exe
5088	WLIDSCV.exe
3512	flashmk.exe
5088	WLIDSCV.exe
5088	WLIDSCV.exe

Suspicious use of AdjustPrivilegeToken 26 IoCs

description	pid	Process
Token: SeDebugPrivilege	5088	WLIDSCV.exe
Token: SeDebugPrivilege	3512	flashmk.exe
Token: SeIncreaseQuotaPrivilege	1192	vbc.exe
Token: SeSecurityPrivilege	1192	vbc.exe
Token: SeTakeOwnershipPrivilege	1192	vbc.exe
Token: SeLoadDriverPrivilege	1192	vbc.exe
Token: SeSystemProfilePrivilege	1192	vbc.exe
Token: SeSystemtimePrivilege	1192	vbc.exe
Token: SeProfSingleProcessPrivilege	1192	vbc.exe
Token: SeIncBasePriorityPrivilege	1192	vbc.exe
Token: SeCreatePagefilePrivilege	1192	vbc.exe
Token: SeBackupPrivilege	1192	vbc.exe
Token: SeRestorePrivilege	1192	vbc.exe
Token: SeShutdownPrivilege	1192	vbc.exe
Token: SeDebugPrivilege	1192	vbc.exe
Token: SeSystemEnvironmentPrivilege	1192	vbc.exe
Token: SeChangeNotifyPrivilege	1192	vbc.exe
Token: SeRemoteShutdownPrivilege	1192	vbc.exe
Token: SeUndockPrivilege	1192	vbc.exe
Token: SeManageVolumePrivilege	1192	vbc.exe
Token: SeImpersonatePrivilege	1192	vbc.exe
Token: SeCreateGlobalPrivilege	1192	vbc.exe
Token: 33	1192	vbc.exe
Token: 34	1192	vbc.exe
Token: 35	1192	vbc.exe
Token: 36	1192	vbc.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4496	vbc.exe
1192	vbc.exe

Suspicious use of WriteProcessMemory 31 IoCs

description	pid	Process	procid_target
PID 2988 wrote to memory of 4496	2988	5e412597778f7df65155685a8bdcd4be.exe	88
PID 2988 wrote to memory of 4496	2988	5e412597778f7df65155685a8bdcd4be.exe	88
PID 2988 wrote to memory of 4496	2988	5e412597778f7df65155685a8bdcd4be.exe	88
PID 2988 wrote to memory of 4496	2988	5e412597778f7df65155685a8bdcd4be.exe	88
PID 2988 wrote to memory of 4496	2988	5e412597778f7df65155685a8bdcd4be.exe	88
PID 2988 wrote to memory of 4496	2988	5e412597778f7df65155685a8bdcd4be.exe	88
PID 2988 wrote to memory of 4496	2988	5e412597778f7df65155685a8bdcd4be.exe	88
PID 2988 wrote to memory of 4496	2988	5e412597778f7df65155685a8bdcd4be.exe	88
PID 2988 wrote to memory of 436	2988	5e412597778f7df65155685a8bdcd4be.exe	89
PID 2988 wrote to memory of 436	2988	5e412597778f7df65155685a8bdcd4be.exe	89
PID 2988 wrote to memory of 436	2988	5e412597778f7df65155685a8bdcd4be.exe	89
PID 2988 wrote to memory of 2796	2988	5e412597778f7df65155685a8bdcd4be.exe	91
PID 2988 wrote to memory of 2796	2988	5e412597778f7df65155685a8bdcd4be.exe	91
PID 2988 wrote to memory of 2796	2988	5e412597778f7df65155685a8bdcd4be.exe	91
PID 2796 wrote to memory of 2552	2796	vbc.exe	93
PID 2796 wrote to memory of 2552	2796	vbc.exe	93
PID 2796 wrote to memory of 2552	2796	vbc.exe	93
PID 2988 wrote to memory of 5088	2988	5e412597778f7df65155685a8bdcd4be.exe	94
PID 2988 wrote to memory of 5088	2988	5e412597778f7df65155685a8bdcd4be.exe	94
PID 2988 wrote to memory of 5088	2988	5e412597778f7df65155685a8bdcd4be.exe	94
PID 5088 wrote to memory of 3512	5088	WLIDSCV.exe	95
PID 5088 wrote to memory of 3512	5088	WLIDSCV.exe	95
PID 5088 wrote to memory of 3512	5088	WLIDSCV.exe	95
PID 3512 wrote to memory of 1192	3512	flashmk.exe	96
PID 3512 wrote to memory of 1192	3512	flashmk.exe	96
PID 3512 wrote to memory of 1192	3512	flashmk.exe	96
PID 3512 wrote to memory of 1192	3512	flashmk.exe	96
PID 3512 wrote to memory of 1192	3512	flashmk.exe	96
PID 3512 wrote to memory of 1192	3512	flashmk.exe	96
PID 3512 wrote to memory of 1192	3512	flashmk.exe	96
PID 3512 wrote to memory of 1192	3512	flashmk.exe	96

C:\Users\Admin\AppData\Local\Temp\5e412597778f7df65155685a8bdcd4be.exe
"C:\Users\Admin\AppData\Local\Temp\5e412597778f7df65155685a8bdcd4be.exe"
1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2988
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
  C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
  2⤵
  - Adds Run key to start application
  - Suspicious use of SetWindowsHookEx
  PID:4496
- C:\Windows\SysWOW64\cmd.exe
  "cmd"
  2⤵
  - NTFS ADS
  PID:436
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
  "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\_wzwxwn9.cmdline"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2796
- - C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
    C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES1875.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc1BF1643F49A54BFC9AEEA1941A14D9FA.TMP"
    3⤵
    PID:2552
- C:\Users\Admin\AppData\Roaming\WLIDSCV.exe
  "C:\Users\Admin\AppData\Roaming\WLIDSCV.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:5088
- - C:\Users\Admin\AppData\Roaming\flashmk.exe
    "C:\Users\Admin\AppData\Roaming\flashmk.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:3512
  - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
      C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
      4⤵
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of SetWindowsHookEx
      PID:1192

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scripting

T1064

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Scripting

T1064

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RES1875.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES1875.tmp
Size 1KB
SHA256 e8acc159384616530d29fbf03cc823614a0b3e5d1431d6c6a6b719d77ddb4846
MD5 0688b0cf82ce0af7a7c962226efef539
SHA1 7e8e6077464f02275c374a303c4b901cde815024
SHA512 87004b96448c1b477f44a47e1ed09d29cc250c1ff0413b41688ca44bd132d32261ef2b0d309c9e5407d34d594857de2e5eaced70c0409d117cf4a1d48eb0edc2
MD5 SHA1 SHA512

Submit Download

_wzwxwn9.0.vb

Path C:\Users\Admin\AppData\Local\Temp\_wzwxwn9.0.vb
Size 1KB
SHA256 712952f1122fba1bbc1e90f094a7bca3dba7ee975f67521a022e709c71830fe8
MD5 2495f282d9843448e187592dda4bcf4f
SHA1 a8b6a96aa278dd58d6c50280c2294b9a85d3269a
SHA512 9f361c818dcbba5be12cce22af8244951ce466f5b22b9e7f7e2ee0a691d68b3722994486f87130de8dc3d45c5be606d1550f8b6b806c6c5ed1b3e9b136fe8eb0
MD5 SHA1 SHA512

Submit Download

_wzwxwn9.cmdline

Path C:\Users\Admin\AppData\Local\Temp\_wzwxwn9.cmdline
Size 248B
SHA256 64ec6bf2b876d9124bc3ce96381ed98d80a52ee0b473401cae6afbe44083d5a1
MD5 9b8522d003240bf79f762bb61bb68435
SHA1 281e06231f9f16e6838b61dbf0448ea950deed15
SHA512 8dc8346cb7ab850f7ea162c8865f70fa7b7f28d1a4430e9c5528288cffb7026bae2581457d1bca403df834953008c407ee89c6194ecbc6f4515d16d4fdb59f9d
MD5 SHA1 SHA512

Submit Download

vbc1BF1643F49A54BFC9AEEA1941A14D9FA.TMP

Path C:\Users\Admin\AppData\Local\Temp\vbc1BF1643F49A54BFC9AEEA1941A14D9FA.TMP
Size 644B
SHA256 1ee0d7a798e175d5a7d518bb3b27d4cebff4bc1bade76f4a3e433d88ee926d1e
MD5 070d19a29fd713891607e27d97ead816
SHA1 e42cf75eb53e89ce253dea01274f383bc498cb3b
SHA512 65a26d184056e35d15c6609bc15313742cbc77baeb0228e1081bdc96ff91631fdcf363787a1bfdfa4883155039c7ef2953ad7e4e4f20e2f71005d0bec98e27ef
MD5 SHA1 SHA512

Submit Download

WLIDSCV.exe

Path C:\Users\Admin\AppData\Roaming\WLIDSCV.exe
Size 7KB
SHA256 8e331e1a84f8d79e91d432999f5d2e964fe18941f31a1f72049fd1ebeb78dfdd
MD5 1c0edf2f56fe742fd463fbbd98ff2055
SHA1 6f3bb141eef67f11196461d17ba330c7bdbcf33f
SHA512 0540ab93e5472255cfc97d0e24d940f129a460284a93a9b4a50507002f02358aa674263d2ae175231309bbec57a01fffb1e394105c56db4b9b804f2115bcf0a7
SSDEEP 96:092cW/n0STTKysyM6Kco2zFcE2hYlnlYJnLLmL0KffaZA20vU8bv1dRXmmcsBx:0U+6f3CVEnlYJLSLTCZA/cE
MD5 SHA1 SHA512 SSDEEP

Submit Download

flashmk.exe

Path C:\Users\Admin\AppData\Roaming\flashmk.exe
Size 1.3MB
SHA256 f805abca58f0933dc66b09f7b9886394a92d481343df2851415f673b2b7ca0f2
MD5 5e412597778f7df65155685a8bdcd4be
SHA1 1086c375c09c07486f0542c679a74d61dd943594
SHA512 579bb3cea0b8daa74b9221191d4ad484f92379f01f8298d055fb50e3ae0a58e15847b6933ab6d6960564ebd0625d680ca31b7d74e2a233d7b43ae9e9de1438da
SSDEEP 24576:vFAABG9aJp25/4ddZMAsiIMXNI+RVN64AzFfoC9kAblzH2JCYkkX5zA:ZaaJpo/yZN6MXN9/NrAZgM2JlFA
MD5 SHA1 SHA512 SSDEEP

Submit Download

fp.txt

Path C:\Users\Admin\AppData\Roaming\fp.txt
Size 88B
SHA256 0586568567658a3badbf9a6db31f60886499ebe55ef8b0ec295f443146663600
MD5 fd1c8f9a5df6ce2b556971e286ee0a57
SHA1 fe311c3b88e3535dc3cc9d2364f8fbf4a5c2d4d1
SHA512 362004c46971436191a6ef929a4a8755ce06b6527bc74e2551422c7f759f5d99489b5d347f2ebe7ddf61af92c98c21d30127cf031a17ec3bfa6543dda258cbce
MD5 SHA1 SHA512

Submit Download

memory/1192-43-0x0000000000400000-0x00000000004BA000-memory.dmp

Download

memory/1192-57-0x0000000000400000-0x00000000004BA000-memory.dmp

Download

memory/1192-66-0x0000000000400000-0x00000000004BA000-memory.dmp

Download

memory/1192-65-0x0000000000400000-0x00000000004BA000-memory.dmp

Download

memory/1192-64-0x0000000000400000-0x00000000004BA000-memory.dmp

Download

memory/1192-63-0x0000000000400000-0x00000000004BA000-memory.dmp

Download

memory/1192-62-0x0000000000400000-0x00000000004BA000-memory.dmp

Download

memory/1192-61-0x0000000000400000-0x00000000004BA000-memory.dmp

Download

memory/1192-60-0x0000000000400000-0x00000000004BA000-memory.dmp

Download

memory/1192-59-0x0000000000400000-0x00000000004BA000-memory.dmp

Download

memory/1192-58-0x0000000000400000-0x00000000004BA000-memory.dmp

Download

memory/1192-56-0x0000000000400000-0x00000000004BA000-memory.dmp

Download

memory/1192-55-0x0000000000400000-0x00000000004BA000-memory.dmp

Download

memory/1192-41-0x0000000000400000-0x00000000004BA000-memory.dmp

Download

memory/1192-42-0x0000000000400000-0x00000000004BA000-memory.dmp

Download

memory/1192-54-0x0000000000400000-0x00000000004BA000-memory.dmp

Download

memory/1192-45-0x0000000000400000-0x00000000004BA000-memory.dmp

Download

memory/1192-46-0x0000000000B20000-0x0000000000B21000-memory.dmp

Download

memory/1192-47-0x0000000000400000-0x00000000004BA000-memory.dmp

Download

memory/1192-48-0x0000000000400000-0x00000000004BA000-memory.dmp

Download

memory/1192-49-0x0000000000400000-0x00000000004BA000-memory.dmp

Download

memory/2796-20-0x0000000002430000-0x0000000002440000-memory.dmp

Download

memory/2988-1-0x0000000075160000-0x0000000075711000-memory.dmp

Download

memory/2988-2-0x0000000001810000-0x0000000001820000-memory.dmp

Download

memory/2988-0-0x0000000075160000-0x0000000075711000-memory.dmp

Download

memory/2988-35-0x0000000075160000-0x0000000075711000-memory.dmp

Download

memory/3512-53-0x0000000001170000-0x0000000001180000-memory.dmp

Download

memory/3512-40-0x0000000075160000-0x0000000075711000-memory.dmp

Download

memory/3512-39-0x0000000001170000-0x0000000001180000-memory.dmp

Download

memory/3512-52-0x0000000075160000-0x0000000075711000-memory.dmp

Download

memory/3512-38-0x0000000075160000-0x0000000075711000-memory.dmp

Download

memory/4496-15-0x0000000000400000-0x0000000000405000-memory.dmp

Download

memory/4496-6-0x0000000000400000-0x0000000000405000-memory.dmp

Download

memory/4496-4-0x0000000000400000-0x0000000000405000-memory.dmp

Download

memory/5088-33-0x0000000000BC0000-0x0000000000BD0000-memory.dmp

Download

memory/5088-50-0x0000000075160000-0x0000000075711000-memory.dmp

Download

memory/5088-32-0x0000000075160000-0x0000000075711000-memory.dmp

Download

memory/5088-51-0x0000000000BC0000-0x0000000000BD0000-memory.dmp

Download