darkcomet | dd10760bfe828b03b8288f2d9d3255a9f186c382cf36edc785c0d5f333071f23

Analysis

max time kernel
156s
max time network
169s
platform
windows10-2004_x64
resource
win10v2004-20240221-en
resource tags

arch:x64arch:x86image:win10v2004-20240221-enlocale:en-usos:windows10-2004-x64system
submitted
25/02/2024, 16:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
a44e866d712e883d41e17abf68c79f2b.exe
Size 754KB
Sample240225-vgbf5sgd93
SHA256 dd10760bfe828b03b8288f2d9d3255a9f186c382cf36edc785c0d5f333071f23
MD5 a44e866d712e883d41e17abf68c79f2b
SHA1 c1dbfaf2fbe83dfd1efc025a6bd631b1d0d1a59f
SHA512 22eea8ef8f9057f5901017c4649b51a279be2e0817a49e2caebdd5ea180e4d8536b3f176cc88895433c4b9463260aad0270db02fd4813e572a46ef78485841cf
SSDEEP 12288:qFLlJnnbWOtz6sVJhvaz1Qc/WdI//vfM4qwrbkniafLo6vUTyl0w/q9jJR:+3nbWmJVJFwSddIXvfhqbiaxvRxq9
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

darkcomet evasion rat trojan

Malware Config

Signatures

Darkcomet
DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
trojan rat darkcomet

Modifies firewall policy service 2 TTPs 6 IoCs

evasion

Modify Registry

T1112

Windows Service

T1543.003

description	ioc	Process
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	a44e866d712e883d41e17abf68c79f2b.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0"	a44e866d712e883d41e17abf68c79f2b.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "0"	a44e866d712e883d41e17abf68c79f2b.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	iexplore.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0"	iexplore.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "0"	iexplore.exe

Modifies security service 2 TTPs 2 IoCs

evasion

Modify Registry

T1112

Windows Service

T1543.003

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wscsvc\Start = "4"	a44e866d712e883d41e17abf68c79f2b.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wscsvc\Start = "4"	iexplore.exe

Windows security bypass 2 TTPs 4 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	a44e866d712e883d41e17abf68c79f2b.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	a44e866d712e883d41e17abf68c79f2b.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	iexplore.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	iexplore.exe

Disables RegEdit via registry modification 2 IoCs

evasion

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2828415587-3732861812-1919322417-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	a44e866d712e883d41e17abf68c79f2b.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2828415587-3732861812-1919322417-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	iexplore.exe

Disables Task Manager via registry modification
evasion

Sets file to hidden 1 TTPs 1 IoCs

Modifies file attributes to stop it showing in Explorer etc.

evasion

Hidden Files and Directories

T1564.001

pid	Process
1580	attrib.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2828415587-3732861812-1919322417-1000\Control Panel\International\Geo\Nation	a44e866d712e883d41e17abf68c79f2b.exe

Windows security modification 2 TTPs 2 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	a44e866d712e883d41e17abf68c79f2b.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	a44e866d712e883d41e17abf68c79f2b.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2340 set thread context of 3424	2340	a44e866d712e883d41e17abf68c79f2b.exe	90

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3424	iexplore.exe

Suspicious use of AdjustPrivilegeToken 48 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	2340	a44e866d712e883d41e17abf68c79f2b.exe
Token: SeSecurityPrivilege	2340	a44e866d712e883d41e17abf68c79f2b.exe
Token: SeTakeOwnershipPrivilege	2340	a44e866d712e883d41e17abf68c79f2b.exe
Token: SeLoadDriverPrivilege	2340	a44e866d712e883d41e17abf68c79f2b.exe
Token: SeSystemProfilePrivilege	2340	a44e866d712e883d41e17abf68c79f2b.exe
Token: SeSystemtimePrivilege	2340	a44e866d712e883d41e17abf68c79f2b.exe
Token: SeProfSingleProcessPrivilege	2340	a44e866d712e883d41e17abf68c79f2b.exe
Token: SeIncBasePriorityPrivilege	2340	a44e866d712e883d41e17abf68c79f2b.exe
Token: SeCreatePagefilePrivilege	2340	a44e866d712e883d41e17abf68c79f2b.exe
Token: SeBackupPrivilege	2340	a44e866d712e883d41e17abf68c79f2b.exe
Token: SeRestorePrivilege	2340	a44e866d712e883d41e17abf68c79f2b.exe
Token: SeShutdownPrivilege	2340	a44e866d712e883d41e17abf68c79f2b.exe
Token: SeDebugPrivilege	2340	a44e866d712e883d41e17abf68c79f2b.exe
Token: SeSystemEnvironmentPrivilege	2340	a44e866d712e883d41e17abf68c79f2b.exe
Token: SeChangeNotifyPrivilege	2340	a44e866d712e883d41e17abf68c79f2b.exe
Token: SeRemoteShutdownPrivilege	2340	a44e866d712e883d41e17abf68c79f2b.exe
Token: SeUndockPrivilege	2340	a44e866d712e883d41e17abf68c79f2b.exe
Token: SeManageVolumePrivilege	2340	a44e866d712e883d41e17abf68c79f2b.exe
Token: SeImpersonatePrivilege	2340	a44e866d712e883d41e17abf68c79f2b.exe
Token: SeCreateGlobalPrivilege	2340	a44e866d712e883d41e17abf68c79f2b.exe
Token: 33	2340	a44e866d712e883d41e17abf68c79f2b.exe
Token: 34	2340	a44e866d712e883d41e17abf68c79f2b.exe
Token: 35	2340	a44e866d712e883d41e17abf68c79f2b.exe
Token: 36	2340	a44e866d712e883d41e17abf68c79f2b.exe
Token: SeIncreaseQuotaPrivilege	3424	iexplore.exe
Token: SeSecurityPrivilege	3424	iexplore.exe
Token: SeTakeOwnershipPrivilege	3424	iexplore.exe
Token: SeLoadDriverPrivilege	3424	iexplore.exe
Token: SeSystemProfilePrivilege	3424	iexplore.exe
Token: SeSystemtimePrivilege	3424	iexplore.exe
Token: SeProfSingleProcessPrivilege	3424	iexplore.exe
Token: SeIncBasePriorityPrivilege	3424	iexplore.exe
Token: SeCreatePagefilePrivilege	3424	iexplore.exe
Token: SeBackupPrivilege	3424	iexplore.exe
Token: SeRestorePrivilege	3424	iexplore.exe
Token: SeShutdownPrivilege	3424	iexplore.exe
Token: SeDebugPrivilege	3424	iexplore.exe
Token: SeSystemEnvironmentPrivilege	3424	iexplore.exe
Token: SeChangeNotifyPrivilege	3424	iexplore.exe
Token: SeRemoteShutdownPrivilege	3424	iexplore.exe
Token: SeUndockPrivilege	3424	iexplore.exe
Token: SeManageVolumePrivilege	3424	iexplore.exe
Token: SeImpersonatePrivilege	3424	iexplore.exe
Token: SeCreateGlobalPrivilege	3424	iexplore.exe
Token: 33	3424	iexplore.exe
Token: 34	3424	iexplore.exe
Token: 35	3424	iexplore.exe
Token: 36	3424	iexplore.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3424	iexplore.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2340 wrote to memory of 2180	2340	a44e866d712e883d41e17abf68c79f2b.exe	89
PID 2340 wrote to memory of 2180	2340	a44e866d712e883d41e17abf68c79f2b.exe	89
PID 2340 wrote to memory of 2180	2340	a44e866d712e883d41e17abf68c79f2b.exe	89
PID 2340 wrote to memory of 3424	2340	a44e866d712e883d41e17abf68c79f2b.exe	90
PID 2340 wrote to memory of 3424	2340	a44e866d712e883d41e17abf68c79f2b.exe	90
PID 2340 wrote to memory of 3424	2340	a44e866d712e883d41e17abf68c79f2b.exe	90
PID 2340 wrote to memory of 3424	2340	a44e866d712e883d41e17abf68c79f2b.exe	90
PID 2340 wrote to memory of 3424	2340	a44e866d712e883d41e17abf68c79f2b.exe	90
PID 2180 wrote to memory of 1580	2180	cmd.exe	92
PID 2180 wrote to memory of 1580	2180	cmd.exe	92
PID 2180 wrote to memory of 1580	2180	cmd.exe	92

System policy modification 1 TTPs 3 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\CurrentVersion	a44e866d712e883d41e17abf68c79f2b.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\CurrentVersion\Explorern	a44e866d712e883d41e17abf68c79f2b.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\CurrentVersion\Explorern\NoControlPanel = "1"	a44e866d712e883d41e17abf68c79f2b.exe

Views/modifies file attributes 1 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

pid	Process
1580	attrib.exe

C:\Users\Admin\AppData\Local\Temp\a44e866d712e883d41e17abf68c79f2b.exe
"C:\Users\Admin\AppData\Local\Temp\a44e866d712e883d41e17abf68c79f2b.exe"
1⤵
- Modifies firewall policy service
- Modifies security service
- Windows security bypass
- Disables RegEdit via registry modification
- Checks computer location settings
- Windows security modification
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2340
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmpcmd.bat" "
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2180
- - C:\Windows\SysWOW64\attrib.exe
    attrib "C:\Users\Admin\AppData\Local\Temp\a44e866d712e883d41e17abf68c79f2b.exe" +s +h
    3⤵
    - Sets file to hidden
    - Views/modifies file attributes
    PID:1580
- C:\Program Files (x86)\Internet Explorer\iexplore.exe
  "C:\Program Files (x86)\Internet Explorer\iexplore.exe"
  2⤵
  - Modifies firewall policy service
  - Modifies security service
  - Windows security bypass
  - Disables RegEdit via registry modification
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:3424

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

tmpcmd.bat

Path C:\Users\Admin\AppData\Local\Temp\tmpcmd.bat
Size 87B
SHA256 da89f1140593add8990ec06e35edc7c5e4e5ca40e08375b45c6be91d6a82f9de
MD5 cde7a15f9cb3f82a7997f5e578f164a8
SHA1 e4f3962a206e58870142352d950f320f27a692fd
SHA512 7aa15aa70e7f6b7a60f196ac0a01768940bc7c0e2df2ee87bb7d8f627e85f89685d71a5e9ab61b321745b02fb6a558637a6e74a8611c9b9f8e2f8d18adfce01c
MD5 SHA1 SHA512

Submit Download

memory/2340-0-0x00000000022A0000-0x00000000022A1000-memory.dmp

Download

memory/2340-5-0x0000000000400000-0x00000000004CB000-memory.dmp

Download

memory/3424-4-0x0000000000400000-0x00000000004CB000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads