darkcomet | 15617bf15fa1f38e13a5159852f73c618adc1aef96d888da4720409d4fa14985

Analysis

max time kernel
90s
max time network
92s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
16/02/2024, 09:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
a000d7e7ef9c1a618c637af55d34eb5b.exe
Size 848KB
Sample240216-k8ggcsfg28
SHA256 15617bf15fa1f38e13a5159852f73c618adc1aef96d888da4720409d4fa14985
MD5 a000d7e7ef9c1a618c637af55d34eb5b
SHA1 554dd684a37d8a56391d7e0660d598a28f01c1b8
SHA512 f293550f58ea9f220e644ef4f90e740569c4a85e929694fc6e446504ef797d641403449249bbaf9e9028749408c5cd13f8df053fcdab9bc1c1a45f1f54fa8639
SSDEEP 24576:b5gYwQeG01TMrzplscGzmfgHjR5BjMbOQzgb6sEX:b5+QeL1TMrFlHGzmfWZMZEbZ
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

darkcomet persistence rat trojan

Malware Config

Signatures

Darkcomet
DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
trojan rat darkcomet

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windupdt\\winupdate.exe"	a000d7e7ef9c1a618c637af55d34eb5b.exe

Checks BIOS information in registry 2 TTPs 1 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate	a000d7e7ef9c1a618c637af55d34eb5b.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1168293393-3419776239-306423207-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\winupdater = "C:\\Windupdt\\winupdate.exe"	a000d7e7ef9c1a618c637af55d34eb5b.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1168293393-3419776239-306423207-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\winupdater = "C:\\Windupdt\\winupdate.exe"	notepad.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 852 set thread context of 2560	852	a000d7e7ef9c1a618c637af55d34eb5b.exe	84

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	a000d7e7ef9c1a618c637af55d34eb5b.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	a000d7e7ef9c1a618c637af55d34eb5b.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	a000d7e7ef9c1a618c637af55d34eb5b.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	a000d7e7ef9c1a618c637af55d34eb5b.exe

Enumerates system info in registry 2 TTPs 1 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	a000d7e7ef9c1a618c637af55d34eb5b.exe

Suspicious use of AdjustPrivilegeToken 24 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	852	a000d7e7ef9c1a618c637af55d34eb5b.exe
Token: SeSecurityPrivilege	852	a000d7e7ef9c1a618c637af55d34eb5b.exe
Token: SeTakeOwnershipPrivilege	852	a000d7e7ef9c1a618c637af55d34eb5b.exe
Token: SeLoadDriverPrivilege	852	a000d7e7ef9c1a618c637af55d34eb5b.exe
Token: SeSystemProfilePrivilege	852	a000d7e7ef9c1a618c637af55d34eb5b.exe
Token: SeSystemtimePrivilege	852	a000d7e7ef9c1a618c637af55d34eb5b.exe
Token: SeProfSingleProcessPrivilege	852	a000d7e7ef9c1a618c637af55d34eb5b.exe
Token: SeIncBasePriorityPrivilege	852	a000d7e7ef9c1a618c637af55d34eb5b.exe
Token: SeCreatePagefilePrivilege	852	a000d7e7ef9c1a618c637af55d34eb5b.exe
Token: SeBackupPrivilege	852	a000d7e7ef9c1a618c637af55d34eb5b.exe
Token: SeRestorePrivilege	852	a000d7e7ef9c1a618c637af55d34eb5b.exe
Token: SeShutdownPrivilege	852	a000d7e7ef9c1a618c637af55d34eb5b.exe
Token: SeDebugPrivilege	852	a000d7e7ef9c1a618c637af55d34eb5b.exe
Token: SeSystemEnvironmentPrivilege	852	a000d7e7ef9c1a618c637af55d34eb5b.exe
Token: SeChangeNotifyPrivilege	852	a000d7e7ef9c1a618c637af55d34eb5b.exe
Token: SeRemoteShutdownPrivilege	852	a000d7e7ef9c1a618c637af55d34eb5b.exe
Token: SeUndockPrivilege	852	a000d7e7ef9c1a618c637af55d34eb5b.exe
Token: SeManageVolumePrivilege	852	a000d7e7ef9c1a618c637af55d34eb5b.exe
Token: SeImpersonatePrivilege	852	a000d7e7ef9c1a618c637af55d34eb5b.exe
Token: SeCreateGlobalPrivilege	852	a000d7e7ef9c1a618c637af55d34eb5b.exe
Token: 33	852	a000d7e7ef9c1a618c637af55d34eb5b.exe
Token: 34	852	a000d7e7ef9c1a618c637af55d34eb5b.exe
Token: 35	852	a000d7e7ef9c1a618c637af55d34eb5b.exe
Token: 36	852	a000d7e7ef9c1a618c637af55d34eb5b.exe

Suspicious use of WriteProcessMemory 28 IoCs

description	pid	Process	procid_target
PID 852 wrote to memory of 1452	852	a000d7e7ef9c1a618c637af55d34eb5b.exe	83
PID 852 wrote to memory of 1452	852	a000d7e7ef9c1a618c637af55d34eb5b.exe	83
PID 852 wrote to memory of 1452	852	a000d7e7ef9c1a618c637af55d34eb5b.exe	83
PID 852 wrote to memory of 1452	852	a000d7e7ef9c1a618c637af55d34eb5b.exe	83
PID 852 wrote to memory of 1452	852	a000d7e7ef9c1a618c637af55d34eb5b.exe	83
PID 852 wrote to memory of 1452	852	a000d7e7ef9c1a618c637af55d34eb5b.exe	83
PID 852 wrote to memory of 1452	852	a000d7e7ef9c1a618c637af55d34eb5b.exe	83
PID 852 wrote to memory of 1452	852	a000d7e7ef9c1a618c637af55d34eb5b.exe	83
PID 852 wrote to memory of 1452	852	a000d7e7ef9c1a618c637af55d34eb5b.exe	83
PID 852 wrote to memory of 1452	852	a000d7e7ef9c1a618c637af55d34eb5b.exe	83
PID 852 wrote to memory of 1452	852	a000d7e7ef9c1a618c637af55d34eb5b.exe	83
PID 852 wrote to memory of 1452	852	a000d7e7ef9c1a618c637af55d34eb5b.exe	83
PID 852 wrote to memory of 1452	852	a000d7e7ef9c1a618c637af55d34eb5b.exe	83
PID 852 wrote to memory of 1452	852	a000d7e7ef9c1a618c637af55d34eb5b.exe	83
PID 852 wrote to memory of 1452	852	a000d7e7ef9c1a618c637af55d34eb5b.exe	83
PID 852 wrote to memory of 1452	852	a000d7e7ef9c1a618c637af55d34eb5b.exe	83
PID 852 wrote to memory of 1452	852	a000d7e7ef9c1a618c637af55d34eb5b.exe	83
PID 852 wrote to memory of 1452	852	a000d7e7ef9c1a618c637af55d34eb5b.exe	83
PID 852 wrote to memory of 1452	852	a000d7e7ef9c1a618c637af55d34eb5b.exe	83
PID 852 wrote to memory of 1452	852	a000d7e7ef9c1a618c637af55d34eb5b.exe	83
PID 852 wrote to memory of 1452	852	a000d7e7ef9c1a618c637af55d34eb5b.exe	83
PID 852 wrote to memory of 1452	852	a000d7e7ef9c1a618c637af55d34eb5b.exe	83
PID 852 wrote to memory of 1452	852	a000d7e7ef9c1a618c637af55d34eb5b.exe	83
PID 852 wrote to memory of 2560	852	a000d7e7ef9c1a618c637af55d34eb5b.exe	84
PID 852 wrote to memory of 2560	852	a000d7e7ef9c1a618c637af55d34eb5b.exe	84
PID 852 wrote to memory of 2560	852	a000d7e7ef9c1a618c637af55d34eb5b.exe	84
PID 852 wrote to memory of 2560	852	a000d7e7ef9c1a618c637af55d34eb5b.exe	84
PID 852 wrote to memory of 2560	852	a000d7e7ef9c1a618c637af55d34eb5b.exe	84

C:\Users\Admin\AppData\Local\Temp\a000d7e7ef9c1a618c637af55d34eb5b.exe
"C:\Users\Admin\AppData\Local\Temp\a000d7e7ef9c1a618c637af55d34eb5b.exe"
1⤵
- Modifies WinLogon for persistence
- Checks BIOS information in registry
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:852
- C:\Windows\SysWOW64\notepad.exe
  notepad
  2⤵
  - Adds Run key to start application
  PID:1452
- C:\Windows\SysWOW64\explorer.exe
  "C:\Windows\SysWOW64\explorer.exe"
  2⤵
  PID:2560

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

PCGWIN32.LI5

Path C:\ProgramData\jI82l\PCGWIN32.LI5
Size 2KB
SHA256 7ca61ead7f90ba38cf989621d90bf3762d0cee90f848cf22b62a47f3b283259b
MD5 c29715918e0705252d26b866e93a0e04
SHA1 f661e26bfefe3e93baae4888e391a9fbfe8e3c8f
SHA512 7a647749fcf1d86008a5d2501ee3d9cb5580e577b1048c108a7b5feed896adc718633977352e8fb754b1d4e170994829b4f4f2f3ba5820c36aff53ae935977ed
MD5 SHA1 SHA512

Submit Download

winupdate.exe

Path C:\Windupdt\winupdate.exe
Size 848KB
SHA256 15617bf15fa1f38e13a5159852f73c618adc1aef96d888da4720409d4fa14985
MD5 a000d7e7ef9c1a618c637af55d34eb5b
SHA1 554dd684a37d8a56391d7e0660d598a28f01c1b8
SHA512 f293550f58ea9f220e644ef4f90e740569c4a85e929694fc6e446504ef797d641403449249bbaf9e9028749408c5cd13f8df053fcdab9bc1c1a45f1f54fa8639
SSDEEP 24576:b5gYwQeG01TMrzplscGzmfgHjR5BjMbOQzgb6sEX:b5+QeL1TMrFlHGzmfWZMZEbZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/852-0-0x0000000013140000-0x0000000013226000-memory.dmp

Download

memory/852-12-0x00000000026A0000-0x00000000026A1000-memory.dmp

Download

memory/852-21-0x0000000013140000-0x0000000013226000-memory.dmp

Download

memory/1452-14-0x0000000000C40000-0x0000000000C41000-memory.dmp

Download

memory/2560-19-0x0000000013140000-0x0000000013226000-memory.dmp

Download

memory/2560-20-0x0000000013140000-0x0000000013226000-memory.dmp

Download

memory/2560-22-0x0000000013140000-0x0000000013226000-memory.dmp

Download

memory/2560-23-0x0000000013140000-0x0000000013226000-memory.dmp

Download

memory/2560-24-0x0000000013140000-0x0000000013226000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads