darkcomet | hxxps://github[.]com/zxo2004/DarkComet-RAT-5[.]3[.]1

Analysis

max time kernel
154s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
14/02/2024, 16:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://github.com/zxo2004/DarkComet-RAT-5.3.1
Sample240214-tyb9bsgd49

Score

10^/10

darkcomet rat trojan upx

Malware Config

Signatures

Darkcomet
DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
trojan rat darkcomet

Executes dropped EXE 1 IoCs

pid	Process
1380	upnp.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x0003000000000719-488.dat	upx
behavioral1/memory/1380-491-0x0000000000400000-0x000000000040D000-memory.dmp	upx
behavioral1/memory/1380-496-0x0000000000400000-0x000000000040D000-memory.dmp	upx

Checks processor information in registry 2 TTPs 8 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000_Classes\Local Settings	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000_Classes\Local Settings	msedge.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
3492	msedge.exe
3492	msedge.exe
4700	msedge.exe
4700	msedge.exe
4844	identity_helper.exe
4844	identity_helper.exe
4428	msedge.exe
4428	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2260	DarkComet.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4420	firefox.exe
Token: SeDebugPrivilege	4420	firefox.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4420	firefox.exe
4420	firefox.exe
4420	firefox.exe
4420	firefox.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
2260	DarkComet.exe
5044	DarkComet.exe
4812	DarkComet.exe
2260	DarkComet.exe
2260	DarkComet.exe
2260	DarkComet.exe
2260	DarkComet.exe
2260	DarkComet.exe
2260	DarkComet.exe
2260	DarkComet.exe
2260	DarkComet.exe
2260	DarkComet.exe
2260	DarkComet.exe
2260	DarkComet.exe
2260	DarkComet.exe
2260	DarkComet.exe
2260	DarkComet.exe
2260	DarkComet.exe
2260	DarkComet.exe
2260	DarkComet.exe
2260	DarkComet.exe

Suspicious use of SendNotifyMessage 30 IoCs

pid	Process
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4420	firefox.exe
4420	firefox.exe
4420	firefox.exe
2260	DarkComet.exe
2260	DarkComet.exe
2260	DarkComet.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4420	firefox.exe
2260	DarkComet.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4700 wrote to memory of 3060	4700	msedge.exe	69
PID 4700 wrote to memory of 3060	4700	msedge.exe	69
PID 4700 wrote to memory of 2012	4700	msedge.exe	85
PID 4700 wrote to memory of 2012	4700	msedge.exe	85
PID 4700 wrote to memory of 2012	4700	msedge.exe	85
PID 4700 wrote to memory of 2012	4700	msedge.exe	85
PID 4700 wrote to memory of 2012	4700	msedge.exe	85
PID 4700 wrote to memory of 2012	4700	msedge.exe	85
PID 4700 wrote to memory of 2012	4700	msedge.exe	85
PID 4700 wrote to memory of 2012	4700	msedge.exe	85
PID 4700 wrote to memory of 2012	4700	msedge.exe	85
PID 4700 wrote to memory of 2012	4700	msedge.exe	85
PID 4700 wrote to memory of 2012	4700	msedge.exe	85
PID 4700 wrote to memory of 2012	4700	msedge.exe	85
PID 4700 wrote to memory of 2012	4700	msedge.exe	85
PID 4700 wrote to memory of 2012	4700	msedge.exe	85
PID 4700 wrote to memory of 2012	4700	msedge.exe	85
PID 4700 wrote to memory of 2012	4700	msedge.exe	85
PID 4700 wrote to memory of 2012	4700	msedge.exe	85
PID 4700 wrote to memory of 2012	4700	msedge.exe	85
PID 4700 wrote to memory of 2012	4700	msedge.exe	85
PID 4700 wrote to memory of 2012	4700	msedge.exe	85
PID 4700 wrote to memory of 2012	4700	msedge.exe	85
PID 4700 wrote to memory of 2012	4700	msedge.exe	85
PID 4700 wrote to memory of 2012	4700	msedge.exe	85
PID 4700 wrote to memory of 2012	4700	msedge.exe	85
PID 4700 wrote to memory of 2012	4700	msedge.exe	85
PID 4700 wrote to memory of 2012	4700	msedge.exe	85
PID 4700 wrote to memory of 2012	4700	msedge.exe	85
PID 4700 wrote to memory of 2012	4700	msedge.exe	85
PID 4700 wrote to memory of 2012	4700	msedge.exe	85
PID 4700 wrote to memory of 2012	4700	msedge.exe	85
PID 4700 wrote to memory of 2012	4700	msedge.exe	85
PID 4700 wrote to memory of 2012	4700	msedge.exe	85
PID 4700 wrote to memory of 2012	4700	msedge.exe	85
PID 4700 wrote to memory of 2012	4700	msedge.exe	85
PID 4700 wrote to memory of 2012	4700	msedge.exe	85
PID 4700 wrote to memory of 2012	4700	msedge.exe	85
PID 4700 wrote to memory of 2012	4700	msedge.exe	85
PID 4700 wrote to memory of 2012	4700	msedge.exe	85
PID 4700 wrote to memory of 2012	4700	msedge.exe	85
PID 4700 wrote to memory of 2012	4700	msedge.exe	85
PID 4700 wrote to memory of 3492	4700	msedge.exe	86
PID 4700 wrote to memory of 3492	4700	msedge.exe	86
PID 4700 wrote to memory of 2164	4700	msedge.exe	87
PID 4700 wrote to memory of 2164	4700	msedge.exe	87
PID 4700 wrote to memory of 2164	4700	msedge.exe	87
PID 4700 wrote to memory of 2164	4700	msedge.exe	87
PID 4700 wrote to memory of 2164	4700	msedge.exe	87
PID 4700 wrote to memory of 2164	4700	msedge.exe	87
PID 4700 wrote to memory of 2164	4700	msedge.exe	87
PID 4700 wrote to memory of 2164	4700	msedge.exe	87
PID 4700 wrote to memory of 2164	4700	msedge.exe	87
PID 4700 wrote to memory of 2164	4700	msedge.exe	87
PID 4700 wrote to memory of 2164	4700	msedge.exe	87
PID 4700 wrote to memory of 2164	4700	msedge.exe	87
PID 4700 wrote to memory of 2164	4700	msedge.exe	87
PID 4700 wrote to memory of 2164	4700	msedge.exe	87
PID 4700 wrote to memory of 2164	4700	msedge.exe	87
PID 4700 wrote to memory of 2164	4700	msedge.exe	87
PID 4700 wrote to memory of 2164	4700	msedge.exe	87
PID 4700 wrote to memory of 2164	4700	msedge.exe	87
PID 4700 wrote to memory of 2164	4700	msedge.exe	87
PID 4700 wrote to memory of 2164	4700	msedge.exe	87

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://github.com/zxo2004/DarkComet-RAT-5.3.1
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe662846f8,0x7ffe66284708,0x7ffe66284718
  2⤵
  PID:3060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2260,6340238665542572511,408160763328063131,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2268 /prefetch:2
  2⤵
  PID:2012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2260,6340238665542572511,408160763328063131,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2320 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2260,6340238665542572511,408160763328063131,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2712 /prefetch:8
  2⤵
  PID:2164
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2260,6340238665542572511,408160763328063131,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3356 /prefetch:1
  2⤵
  PID:2480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2260,6340238665542572511,408160763328063131,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3368 /prefetch:1
  2⤵
  PID:3140
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2260,6340238665542572511,408160763328063131,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5752 /prefetch:8
  2⤵
  PID:2268
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2260,6340238665542572511,408160763328063131,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5752 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4844
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2260,6340238665542572511,408160763328063131,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3640 /prefetch:1
  2⤵
  PID:3228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2260,6340238665542572511,408160763328063131,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=3716 /prefetch:8
  2⤵
  PID:408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2260,6340238665542572511,408160763328063131,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3384 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2260,6340238665542572511,408160763328063131,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5432 /prefetch:1
  2⤵
  PID:864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2260,6340238665542572511,408160763328063131,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6172 /prefetch:1
  2⤵
  PID:1392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2260,6340238665542572511,408160763328063131,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6160 /prefetch:1
  2⤵
  PID:2644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2260,6340238665542572511,408160763328063131,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5344 /prefetch:1
  2⤵
  PID:916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2260,6340238665542572511,408160763328063131,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4688 /prefetch:1
  2⤵
  PID:1440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2260,6340238665542572511,408160763328063131,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1896 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4452

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
PID:1484
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Checks processor information in registry
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  PID:4420
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4420.0.742922364\489383867" -parentBuildID 20221007134813 -prefsHandle 1900 -prefMapHandle 1896 -prefsLen 20749 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {be6feacc-aa9f-473b-a98d-5ad82d7a445a} 4420 "\\.\pipe\gecko-crash-server-pipe.4420" 1984 2839a3f0458 gpu
    3⤵
    PID:2720
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4420.1.422599392\196136997" -parentBuildID 20221007134813 -prefsHandle 2408 -prefMapHandle 2404 -prefsLen 20785 -prefMapSize 233444 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {a81f824d-a12f-49c9-967c-c77f98248f12} 4420 "\\.\pipe\gecko-crash-server-pipe.4420" 2424 2839a0e6858 socket
    3⤵
    - Checks processor information in registry
    PID:2772
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4420.2.622097303\214675525" -childID 1 -isForBrowser -prefsHandle 3284 -prefMapHandle 1032 -prefsLen 20823 -prefMapSize 233444 -jsInitHandle 1100 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {cf748375-ed66-4013-b65e-54e61e038232} 4420 "\\.\pipe\gecko-crash-server-pipe.4420" 2912 2839e39cf58 tab
    3⤵
    PID:3424
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4420.3.1726132890\62823310" -childID 2 -isForBrowser -prefsHandle 3644 -prefMapHandle 3640 -prefsLen 26066 -prefMapSize 233444 -jsInitHandle 1100 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {ea31f5ce-35c6-4f13-830a-90ab92b7cafd} 4420 "\\.\pipe\gecko-crash-server-pipe.4420" 3652 28386660458 tab
    3⤵
    PID:1752
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4420.4.98930537\1431012504" -childID 3 -isForBrowser -prefsHandle 4656 -prefMapHandle 4652 -prefsLen 26125 -prefMapSize 233444 -jsInitHandle 1100 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {8589cea5-91cf-46c3-b63f-fcea93c1b345} 4420 "\\.\pipe\gecko-crash-server-pipe.4420" 4676 283a069dc58 tab
    3⤵
    PID:2896

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2428

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2412

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3408

C:\Users\Admin\Documents\Darkcomet RAT 5.3.1\Darkcomet RAT 5.3.1\DarkComet.exe
"C:\Users\Admin\Documents\Darkcomet RAT 5.3.1\Darkcomet RAT 5.3.1\DarkComet.exe"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:2260
- C:\Users\Admin\AppData\Local\Temp\upnp.exe
  "C:\Users\Admin\AppData\Local\Temp\upnp.exe" -a 10.127.0.233 80 80 TCP
  2⤵
  - Executes dropped EXE
  PID:1380

C:\Users\Admin\Documents\Darkcomet RAT 5.3.1\Darkcomet RAT 5.3.1\DarkComet.exe
"C:\Users\Admin\Documents\Darkcomet RAT 5.3.1\Darkcomet RAT 5.3.1\DarkComet.exe"
1⤵
- Suspicious use of FindShellTrayWindow
PID:5044

C:\Users\Admin\Documents\Darkcomet RAT 5.3.1\Darkcomet RAT 5.3.1\DarkComet.exe
"C:\Users\Admin\Documents\Darkcomet RAT 5.3.1\Darkcomet RAT 5.3.1\DarkComet.exe"
1⤵
- Suspicious use of FindShellTrayWindow
PID:4812

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Documents\Darkcomet RAT 5.3.1\Darkcomet RAT 5.3.1\changelog.txt
1⤵
PID:2268

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 245b396ed1accfae337f770d3757c932bc30a8fc8dd133b5cefe82242760c2c7
MD5 fa070c9c9ab8d902ee4f3342d217275f
SHA1 ac69818312a7eba53586295c5b04eefeb5c73903
SHA512 df92ca6d405d603ef5f07dbf9516d9e11e1fdc13610bb59e6d4712e55dd661f756c8515fc2c359c1db6b8b126e7f5a15886e643d93c012ef34a11041e02cc0dc
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 1KB
SHA256 696da6b67bb8fecb3573d561087668557b7538edf43d4330e27d01d5b872c38d
MD5 2628dbb35865a0cfe7fe8a67c86616e4
SHA1 13e53261837650e2dff5499f3c00219331290713
SHA512 f7ac209af6d8a1230515ae239224d15bc487d10e84a64181686cff11ed8269f1be04374a62ee1c727ca0fcfad168e364d2d333dc71cbdc386dcb510ddfb9f0c4
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 573B
SHA256 8dc36283781a25af9e2ae76d255ae311b2715396f710ff0e9850b0e64525759d
MD5 0028a1a5c441a3cd5a60c34da771564f
SHA1 e15d27a8322b435564ebcd36467b997d0fa8ef32
SHA512 e26efd2be3114e733acdc00fb54150790872b10c88a7c4d3a19a16383bf58897ad89f14b3255a984f836666b98bafc099d8988532d03acda0dee7a7a7da3f40e
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 ac32398b1abf6503ffb508e8370bdc053bbc884b3cd0c9bff1e4bc7406d2a8e8
MD5 8990dc12ad5f1e3326f4f961fb738285
SHA1 16ee72f542a4728e5e6af5b97f1927f0e48a4cd8
SHA512 f2b2ba76ab31763a2c8cbbfc9aaa89fecb0f6d9cff6da2513c1555ec1e91b13745c8a51b932b7a0d9fdf336befad91dbd17a684b5be9b220f42806286d3c9cbb
SSDEEP 96:nbkdQY1KZvvwpvWMoiVmdeHUJLZUWQyV+VDCzia:nbklEtvGWMXILZrj
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 f48e5253414b8b1c0fe4a4355f7a56fcd60dbfb552df8fa0a343165853d5fb1c
MD5 b19271fa3b9778ca2852acf10ddf73f9
SHA1 8b643836ee4ba375a6a136aa4505e061303f3dd9
SHA512 9e7020886f974de35193b6559272efdf8c844beb5152fef5a7bb576ec25d8035c3548fd9baf9b65bccf27490ee2cd652085fb6393bb440412fa6fdce07b84ecd
SSDEEP 96:ndk8sQwQY1KJvvwpvWMoiVmdeFwTjNUJAQZUWQyV+VD7AiEwb:ndkVEdvGWMVwTpIVZrg
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 af4815d74916b80963f642dda8e21f55feae6cfeb0deb7719ca0fe2d842b3526
MD5 526fb74a6267a5950e04e273c9358d49
SHA1 b3e1d2b036143b0f729d1a25ea650d4e257d3ef1
SHA512 1909ea559199d81e5de7c11ac1cf8c7161c2ddc30a73bc1cbc16726d2c23c990a8732c166e41b275993b9e9da3fab0647f92f6e8393af08765061db3c47e7667
SSDEEP 96:ndkGQY1KJvvwpvWMoiVmdekuI1jUJEZUWQyV+VDCAiEwb:ndk4EdvGWM0uIhIEZrV
MD5 SHA1 SHA512 SSDEEP

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 24KB
SHA256 9692162e8a88be0977395cc0704fe882b9a39b78bdfc9d579a8c961e15347a37
MD5 917dedf44ae3675e549e7b7ffc2c8ccd
SHA1 b7604eb16f0366e698943afbcf0c070d197271c0
SHA512 9628f7857eb88f8dceac00ffdcba2ed822fb9ebdada95e54224a0afc50bccd3e3d20c5abadbd20f61eba51dbf71c5c745b29309122d88b5cc6752a1dfc3be053
SSDEEP 768:nXQWtp8F1+UoAYDCx9Tuqh0VfUC9xbog/OVfLlQMrUoRt+:nXQWtpu1jayLiwo
MD5 SHA1 SHA512 SSDEEP

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 1KB
SHA256 00a463268db53b91475a1fa766fe28ded77062f6f25464e0a257955560944d32
MD5 b4b0828dc3ae8ce2ef5c464d134a8d3f
SHA1 dfe240102986f2b86620ff767d92c06b8e58a3ad
SHA512 4ca2f101f581456ead35038bbae411da8fd45f1f6ad887ffb50bb27f439c47c6196c54ca6da6809b41372925d0d8cf0c81514137264379b47ec00219667bf8d5
MD5 SHA1 SHA512

Submit Download

TransportSecurity~RFe57fc80.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57fc80.TMP
Size 1KB
SHA256 9b74a662670c063493a580f1d31ccf35946ee54f9d7bacdbc4d21e54ac57b4ef
MD5 3216dc9a3cddbbe4c2ea863ce9a4cfaa
SHA1 7658f217c2e7bac9ed9260866517ff6f680c36bf
SHA512 5f7bfd820fc6aae1eb4bdf72b8b8b82b8ada5bfcc412bcbd1c736647e0d825327677975294f7c95398e77e2b2e4e7f6034c3604b221abed1bf5f52552d716b3b
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 10KB
SHA256 06104e34a283e064c0e0dc377ea5fbbdc3e956c3a2a6c420f9bcd9563cd979a5
MD5 1673cd9f08d38f38e1a9d3672774f249
SHA1 08bd6c736e6ef64294c88db75b5897b38d0483b5
SHA512 2024fddf53811d19b092dd1c033e5712452ac29f76f30578b8b1c7b3f3e58df904aa72608d9711165a85b46afa55f158d88ebb210d7a02e80bd56e8e573bcf90
SSDEEP 192:6oCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexup94e2RUbubBbhTw8AftwKCh:+9iIxuERzA83h09RZxYQDm86W2m
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 10KB
SHA256 7977125e2c37d37fb51b611906dbfc1cb2f7f4aa2ce6e80e390a0b63d19b0bae
MD5 cce38c67537522507561be265daa58f0
SHA1 e1810227e261061e0557d04ac292efe78bfee450
SHA512 b5965737a5c5b45d88c6838287c04efdf7545070cbc1f0ab6a2bc9e69407d45be0f1c036af7d71f984c39bdad6a51c0d17e17e9291842a5557ea3167ab3c6c02
SSDEEP 192:RoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupW4e2RUbTBahTw8AftwKC8Q:N9iIxuERzA83h09RZxY12986W2m
MD5 SHA1 SHA512 SSDEEP

Submit Download

upnp.exe

Path C:\Users\Admin\AppData\Local\Temp\upnp.exe
Size 12KB
SHA256 da659d8c05cfcb5f0abe167191665359123643000d12140836c28d204294ceb6
MD5 13804f8dc4e72ba103d5e34de895c9db
SHA1 03d7a0500ccb2fef3222ed1eb55f2cbedbb8b8c5
SHA512 9abb98795a1b1c142c50c7c110966b4249972de5b1f40445b27d70c3127140b0ddaaada1d92297e96ffd71177b12cd87749953ffdcf6e5da7803b9f9527d7652
SSDEEP 192:NfPZyzqwizgU1sxCa49gqiVpEu6Tg/g7mj2D4VClx1RZ2UHnpoDkBTVh:N3Zyz8gCda49gTFJ/g7mY2CLtHnCDk/
MD5 SHA1 SHA512 SSDEEP

Submit Download

data.safe.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\eg7x8yxg.default-release\datareporting\glean\db\data.safe.bin
Size 2KB
SHA256 59aa696d5fa3c905d2a2ff725dabd530b8e1710cae9c847f9ab88f7f54d10bf6
MD5 8171f7e9e63790a79ea872dce45cf4f2
SHA1 9fcbae26467e9deae1ffd74ddbe4ddf1b94198b7
SHA512 c43fe460525b9a5a86fbb213e5b604a4e787836d27c43a0a7bb58e42820700f2ecae4a330c356e52882fb1833e5ab83d5413de8197eb03f3537ad49bc8df0cdb
MD5 SHA1 SHA512

Submit Download

5b91f2e9-47d4-4349-859b-10ae93257fe9

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\eg7x8yxg.default-release\datareporting\glean\pending_pings\5b91f2e9-47d4-4349-859b-10ae93257fe9
Size 12KB
SHA256 c25a7daf9bf567bf044295edd9455db75d805542b6c6a0f9dcadc9ff16ca628e
MD5 db8e142adfdbb3cfa4206c98dbca6498
SHA1 49146e87e2994121925e9aa184ce77457329914e
SHA512 974e55f6f5bda07530744d1a4a27f571efba1b8b2a86628ed9d4e80ca16255004d6a37d8803e04a2a62392b904027a860e6ee9b49b59dd9b106654cfacc693bc
SSDEEP 192:znb/tnKtRO1U+WRM3Jxtj9jJXGPg4j9hgmrephywzgMo1ZAy69aGqfHV1H3GoEjC:zzU09Of
MD5 SHA1 SHA512 SSDEEP

Submit Download

d80b36d6-6156-4a95-a31c-0299bb9f5684

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\eg7x8yxg.default-release\datareporting\glean\pending_pings\d80b36d6-6156-4a95-a31c-0299bb9f5684
Size 746B
SHA256 c0f433057c527a8f02e2754a0ba80f9cf8084359f0b794cd57aaa228c9763009
MD5 39be1e9ee4c92fc412f2ff3ba759ce7b
SHA1 3ae457a48420a035edcc05815fb7523c253bc54f
SHA512 9614c9d83234033a86ac07180e4200ef1c255846a9fc6fb432343079cad9fa628f40f485160913297ea713e17eec745320272e49c646fb925e5baca70dae8629
MD5 SHA1 SHA512

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\eg7x8yxg.default-release\prefs-1.js
Size 6KB
SHA256 5b7c8bd4824d803c2d909b2e06ae1cfd7e9f815ccb71a5e76188c48bb62fdb6b
MD5 6374cc1904c3eea9475933036d4d4c48
SHA1 e55d46ef613333def028137097e701b4322bfe1e
SHA512 03238d3f66285d3dfd44bf9e57dd95df7591caf3f75fadefd83ebb22b45afe9f858a72ac92131245413445cd8ac3dd58a6aa000be02b24314703f7817736b5f1
SSDEEP 96:xHR5nUTeqGqNfdmQF1ZeOTzS0PXAnpj8HDeJxoBw8VIu:f5nIRxdmQF1ZeyPXlDaoBw8Vv
MD5 SHA1 SHA512 SSDEEP

Submit Download

sessionstore.jsonlz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\eg7x8yxg.default-release\sessionstore.jsonlz4
Size 883B
SHA256 00f3010287973cfe51215eae1847be5d926f67bf10767f01e175de678f16f57e
MD5 1d2dbac8809d883f7d3d347eb62609f7
SHA1 908e58cef2b2917829501775a73f0d62f90dd9ea
SHA512 8491ed45f8ed0366e25643a148e26a1245b7b3d4e3805484cee99cf9b5d3902cfde97326d0923b7402e354d2452bd96c59f629ea574c011f3f15f6c532499a7c
MD5 SHA1 SHA512

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\eg7x8yxg.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 184KB
SHA256 7eff8f28c9937842c52b02de166c91abb6347548313394838f8cba51092fc627
MD5 c7d68ab7381a0e06d8428c47b6a7abd7
SHA1 22b2c3f77830f7dbc19a5106b8a400512f6d7f34
SHA512 97aeed813b41cf5bf2d4883c01188d300c1373f8a2eb1810262f19ced633e89542a5a7cab6be81f0541a19a4617d8f3c6a11167403b6513669d6292e9decbcd9
SSDEEP 3072:6GcHzPRuFPF3y3O6g39636uacM1eHHx7k7:6GcHzPR093y3O636uacM1eH27
MD5 SHA1 SHA512 SSDEEP

Submit Download

config.ini

Path C:\Users\Admin\Documents\Darkcomet RAT 5.3.1\Darkcomet RAT 5.3.1\config.ini
Size 522B
SHA256 21a222e00ea35f663dc6c397c0a0aa6d80e52187644b170cee9e186892a22f4e
MD5 0a5baccb60ddf613c9ef2b18e0b1863f
SHA1 39bb75213fab1a7b9ab51089ef54f43086d8b1f3
SHA512 b24b4e15fc975f81e5e5216cc098f8a34faeb5f7b3f10fe8f9f4a19157abe62f293b4687440434744e5c5284736a9a472fc5d04f5fda72e94fe5e7140b36de9b
MD5 SHA1 SHA512

Submit Download

Unconfirmed 386567.crdownload

Path C:\Users\Admin\Downloads\Unconfirmed 386567.crdownload
Size 3.1MB
SHA256 fde40480c010d87166f520cd28469ef925399d26f485e1480f43a604f5967ec9
MD5 a7660b30f87beb1fc0cd494600c623bf
SHA1 fd51f4379b191ac34983a21f42e79d6fb90e61f6
SHA512 ba90bc6bfc239371707649ee3fc8e5122f1afe64eaa1927fa046d6a98b0df8606bdd72936d2bc856e563312a83a3d7a1e0ce973cc40d69575e4f6307cf5c78f3
SSDEEP 49152:JHFR9gxPBfZMBQrRSuPt+7dhz8OOm2yJkxYRx7g06PQmgQ4kzbXdXghiwYP2l:JHO8QXPt6Xn2n+X7+Q5T8Bgh2P2l
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1380-496-0x0000000000400000-0x000000000040D000-memory.dmp

Download

memory/1380-491-0x0000000000400000-0x000000000040D000-memory.dmp

Download

memory/2260-472-0x0000000002D30000-0x0000000002D31000-memory.dmp

Download

memory/2260-477-0x00000000068D0000-0x00000000068D1000-memory.dmp

Download

memory/2260-510-0x0000000000400000-0x0000000000F67000-memory.dmp

Download

memory/2260-505-0x0000000000400000-0x0000000000F67000-memory.dmp

Download

memory/2260-442-0x0000000000400000-0x0000000000F67000-memory.dmp

Download

memory/2260-397-0x00000000068D0000-0x00000000068D1000-memory.dmp

Download

memory/2260-385-0x0000000005B00000-0x0000000005B01000-memory.dmp

Download

memory/2260-473-0x0000000005B00000-0x0000000005B01000-memory.dmp

Download

memory/2260-474-0x0000000000400000-0x0000000000F67000-memory.dmp

Download

memory/2260-437-0x0000000000400000-0x0000000000F67000-memory.dmp

Download

memory/2260-481-0x0000000000400000-0x0000000000F67000-memory.dmp

Download

memory/2260-500-0x0000000000400000-0x0000000000F67000-memory.dmp

Download

memory/2260-382-0x0000000002D30000-0x0000000002D31000-memory.dmp

Download

memory/2260-493-0x0000000000400000-0x0000000000F67000-memory.dmp

Download

memory/4812-383-0x0000000002D40000-0x0000000002D41000-memory.dmp

Download

memory/4812-441-0x0000000000400000-0x0000000000F67000-memory.dmp

Download

memory/5044-384-0x0000000001150000-0x0000000001151000-memory.dmp

Download

memory/5044-440-0x0000000000400000-0x0000000000F67000-memory.dmp

Download