darkcomet | 867405e2fe37fcc2d1c0f619ec829393203fc3f18d87fcbae1a884f37e8d081d

Analysis

max time kernel
148s
max time network
160s
platform
windows10-2004_x64
resource
win10v2004-20240221-en
resource tags

arch:x64arch:x86image:win10v2004-20240221-enlocale:en-usos:windows10-2004-x64system
submitted
26/02/2024, 16:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
a6d0467395e81455f6b079568faf913b.exe
Size 804KB
Sample240226-t2a6fabb2z
SHA256 867405e2fe37fcc2d1c0f619ec829393203fc3f18d87fcbae1a884f37e8d081d
MD5 a6d0467395e81455f6b079568faf913b
SHA1 dd454bca5a905c0ffd09f2b03fffe16f8be63aa9
SHA512 63b4d5d14d0a4415468bebfc103e9324275078aca981853a8d42204c67173600183819a25a91dc43a2cf4f1cbf10efd17273fc3c5edfa5dd462dc4cdb5a279ee
SSDEEP 24576:VdPTtcIbM0SBTC13R2LKXgf9u0G/b5nCjX:VdPtM5BYR2LKQFGV+
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

darkcomet persistence rat trojan

Malware Config

Signatures

Darkcomet
DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
trojan rat darkcomet

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windupdt\\winupdate.exe"	a6d0467395e81455f6b079568faf913b.exe

Checks BIOS information in registry 2 TTPs 1 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate	a6d0467395e81455f6b079568faf913b.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2828415587-3732861812-1919322417-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\winupdater = "C:\\Windupdt\\winupdate.exe"	a6d0467395e81455f6b079568faf913b.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2828415587-3732861812-1919322417-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\winupdater = "C:\\Windupdt\\winupdate.exe"	notepad.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 1744 set thread context of 4068	1744	a6d0467395e81455f6b079568faf913b.exe	88
PID 4068 set thread context of 1408	4068	a6d0467395e81455f6b079568faf913b.exe	90

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	a6d0467395e81455f6b079568faf913b.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	a6d0467395e81455f6b079568faf913b.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	a6d0467395e81455f6b079568faf913b.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	a6d0467395e81455f6b079568faf913b.exe

Enumerates system info in registry 2 TTPs 1 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	a6d0467395e81455f6b079568faf913b.exe

Suspicious use of AdjustPrivilegeToken 24 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	4068	a6d0467395e81455f6b079568faf913b.exe
Token: SeSecurityPrivilege	4068	a6d0467395e81455f6b079568faf913b.exe
Token: SeTakeOwnershipPrivilege	4068	a6d0467395e81455f6b079568faf913b.exe
Token: SeLoadDriverPrivilege	4068	a6d0467395e81455f6b079568faf913b.exe
Token: SeSystemProfilePrivilege	4068	a6d0467395e81455f6b079568faf913b.exe
Token: SeSystemtimePrivilege	4068	a6d0467395e81455f6b079568faf913b.exe
Token: SeProfSingleProcessPrivilege	4068	a6d0467395e81455f6b079568faf913b.exe
Token: SeIncBasePriorityPrivilege	4068	a6d0467395e81455f6b079568faf913b.exe
Token: SeCreatePagefilePrivilege	4068	a6d0467395e81455f6b079568faf913b.exe
Token: SeBackupPrivilege	4068	a6d0467395e81455f6b079568faf913b.exe
Token: SeRestorePrivilege	4068	a6d0467395e81455f6b079568faf913b.exe
Token: SeShutdownPrivilege	4068	a6d0467395e81455f6b079568faf913b.exe
Token: SeDebugPrivilege	4068	a6d0467395e81455f6b079568faf913b.exe
Token: SeSystemEnvironmentPrivilege	4068	a6d0467395e81455f6b079568faf913b.exe
Token: SeChangeNotifyPrivilege	4068	a6d0467395e81455f6b079568faf913b.exe
Token: SeRemoteShutdownPrivilege	4068	a6d0467395e81455f6b079568faf913b.exe
Token: SeUndockPrivilege	4068	a6d0467395e81455f6b079568faf913b.exe
Token: SeManageVolumePrivilege	4068	a6d0467395e81455f6b079568faf913b.exe
Token: SeImpersonatePrivilege	4068	a6d0467395e81455f6b079568faf913b.exe
Token: SeCreateGlobalPrivilege	4068	a6d0467395e81455f6b079568faf913b.exe
Token: 33	4068	a6d0467395e81455f6b079568faf913b.exe
Token: 34	4068	a6d0467395e81455f6b079568faf913b.exe
Token: 35	4068	a6d0467395e81455f6b079568faf913b.exe
Token: 36	4068	a6d0467395e81455f6b079568faf913b.exe

Suspicious use of WriteProcessMemory 33 IoCs

description	pid	Process	procid_target
PID 1744 wrote to memory of 4068	1744	a6d0467395e81455f6b079568faf913b.exe	88
PID 1744 wrote to memory of 4068	1744	a6d0467395e81455f6b079568faf913b.exe	88
PID 1744 wrote to memory of 4068	1744	a6d0467395e81455f6b079568faf913b.exe	88
PID 1744 wrote to memory of 4068	1744	a6d0467395e81455f6b079568faf913b.exe	88
PID 1744 wrote to memory of 4068	1744	a6d0467395e81455f6b079568faf913b.exe	88
PID 4068 wrote to memory of 3868	4068	a6d0467395e81455f6b079568faf913b.exe	89
PID 4068 wrote to memory of 3868	4068	a6d0467395e81455f6b079568faf913b.exe	89
PID 4068 wrote to memory of 3868	4068	a6d0467395e81455f6b079568faf913b.exe	89
PID 4068 wrote to memory of 3868	4068	a6d0467395e81455f6b079568faf913b.exe	89
PID 4068 wrote to memory of 3868	4068	a6d0467395e81455f6b079568faf913b.exe	89
PID 4068 wrote to memory of 3868	4068	a6d0467395e81455f6b079568faf913b.exe	89
PID 4068 wrote to memory of 3868	4068	a6d0467395e81455f6b079568faf913b.exe	89
PID 4068 wrote to memory of 3868	4068	a6d0467395e81455f6b079568faf913b.exe	89
PID 4068 wrote to memory of 3868	4068	a6d0467395e81455f6b079568faf913b.exe	89
PID 4068 wrote to memory of 3868	4068	a6d0467395e81455f6b079568faf913b.exe	89
PID 4068 wrote to memory of 3868	4068	a6d0467395e81455f6b079568faf913b.exe	89
PID 4068 wrote to memory of 3868	4068	a6d0467395e81455f6b079568faf913b.exe	89
PID 4068 wrote to memory of 3868	4068	a6d0467395e81455f6b079568faf913b.exe	89
PID 4068 wrote to memory of 3868	4068	a6d0467395e81455f6b079568faf913b.exe	89
PID 4068 wrote to memory of 3868	4068	a6d0467395e81455f6b079568faf913b.exe	89
PID 4068 wrote to memory of 3868	4068	a6d0467395e81455f6b079568faf913b.exe	89
PID 4068 wrote to memory of 3868	4068	a6d0467395e81455f6b079568faf913b.exe	89
PID 4068 wrote to memory of 3868	4068	a6d0467395e81455f6b079568faf913b.exe	89
PID 4068 wrote to memory of 3868	4068	a6d0467395e81455f6b079568faf913b.exe	89
PID 4068 wrote to memory of 3868	4068	a6d0467395e81455f6b079568faf913b.exe	89
PID 4068 wrote to memory of 3868	4068	a6d0467395e81455f6b079568faf913b.exe	89
PID 4068 wrote to memory of 3868	4068	a6d0467395e81455f6b079568faf913b.exe	89
PID 4068 wrote to memory of 3868	4068	a6d0467395e81455f6b079568faf913b.exe	89
PID 4068 wrote to memory of 1408	4068	a6d0467395e81455f6b079568faf913b.exe	90
PID 4068 wrote to memory of 1408	4068	a6d0467395e81455f6b079568faf913b.exe	90
PID 4068 wrote to memory of 1408	4068	a6d0467395e81455f6b079568faf913b.exe	90
PID 4068 wrote to memory of 1408	4068	a6d0467395e81455f6b079568faf913b.exe	90
PID 4068 wrote to memory of 1408	4068	a6d0467395e81455f6b079568faf913b.exe	90

C:\Users\Admin\AppData\Local\Temp\a6d0467395e81455f6b079568faf913b.exe
"C:\Users\Admin\AppData\Local\Temp\a6d0467395e81455f6b079568faf913b.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1744
- C:\Users\Admin\AppData\Local\Temp\a6d0467395e81455f6b079568faf913b.exe
  "C:\Users\Admin\AppData\Local\Temp\a6d0467395e81455f6b079568faf913b.exe"
  2⤵
  - Modifies WinLogon for persistence
  - Checks BIOS information in registry
  - Adds Run key to start application
  - Suspicious use of SetThreadContext
  - Checks processor information in registry
  - Enumerates system info in registry
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4068
- - C:\Windows\SysWOW64\notepad.exe
    notepad
    3⤵
    - Adds Run key to start application
    PID:3868
- - C:\Windows\SysWOW64\explorer.exe
    "C:\Windows\SysWOW64\explorer.exe"
    3⤵
    PID:1408

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1408-11-0x0000000000400000-0x00000000004CF000-memory.dmp

Download

memory/1408-16-0x0000000000400000-0x00000000004CF000-memory.dmp

Download

memory/1408-15-0x0000000002CC0000-0x0000000002CC1000-memory.dmp

Download

memory/1408-14-0x0000000000400000-0x00000000004CF000-memory.dmp

Download

memory/1408-12-0x0000000000400000-0x00000000004CF000-memory.dmp

Download

memory/1408-10-0x0000000000400000-0x00000000004CF000-memory.dmp

Download

memory/1744-0-0x0000000002270000-0x0000000002271000-memory.dmp

Download

memory/1744-4-0x0000000000400000-0x00000000004CF000-memory.dmp

Download

memory/3868-8-0x0000000000810000-0x0000000000811000-memory.dmp

Download

memory/4068-3-0x0000000013140000-0x00000000131F6000-memory.dmp

Download

memory/4068-13-0x0000000013140000-0x00000000131F6000-memory.dmp

Download

memory/4068-6-0x0000000002890000-0x0000000002891000-memory.dmp

Download

memory/4068-5-0x0000000013140000-0x00000000131F6000-memory.dmp

Download

memory/4068-2-0x0000000013140000-0x00000000131F6000-memory.dmp

Download

memory/4068-1-0x0000000013140000-0x00000000131F6000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads