darkcomet | d47c0a65712aa145bd97605d900844f4aacd274a687fb5962cda290e4e2ab0c3

Analysis

max time kernel
108s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
27/02/2024, 15:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
a97418626ab5c6d356018f26be8c9e6e.exe
Size 1.2MB
Sample240227-sd4meacd2t
SHA256 d47c0a65712aa145bd97605d900844f4aacd274a687fb5962cda290e4e2ab0c3
MD5 a97418626ab5c6d356018f26be8c9e6e
SHA1 ccbde034a75030a04b77cce2feb099966d82d861
SHA512 0530b23827630288fee62b5150a5e56a7d35e1e615f2ba61b8b4f5ad055054c140f09aaefb9c5593d8b6ea89602432e7b2f13d777f3068361b674f643caf6f7d
SSDEEP 12288:tLOjzQ+cTp3vz9LgCL5YjbEewKIZV8f0kvdX5NUaOACjlkD/WrPXeVlwgbHd8/zO:t3h0IKDcjlKO9n8S4RFXn+Mhk
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

darkcomet persistence rat trojan

Malware Config

Signatures

Darkcomet
DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
trojan rat darkcomet

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1904519900-954640453-4250331663-1000\Control Panel\International\Geo\Nation	a97418626ab5c6d356018f26be8c9e6e.exe

Executes dropped EXE 3 IoCs

pid	Process
3208	svchost.exe
4488	rundll.exe
3300	svchost.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1904519900-954640453-4250331663-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\rundll.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\rundll.exe"	a97418626ab5c6d356018f26be8c9e6e.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 4916 set thread context of 3208	4916	a97418626ab5c6d356018f26be8c9e6e.exe	87
PID 4488 set thread context of 3300	4488	rundll.exe	92

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 2 IoCs

pid	pid_target	Process	procid_target
1396	3208	WerFault.exe	87
2328	3300	WerFault.exe	92

Suspicious use of WriteProcessMemory 31 IoCs

description	pid	Process	procid_target
PID 4916 wrote to memory of 3208	4916	a97418626ab5c6d356018f26be8c9e6e.exe	87
PID 4916 wrote to memory of 3208	4916	a97418626ab5c6d356018f26be8c9e6e.exe	87
PID 4916 wrote to memory of 3208	4916	a97418626ab5c6d356018f26be8c9e6e.exe	87
PID 4916 wrote to memory of 3208	4916	a97418626ab5c6d356018f26be8c9e6e.exe	87
PID 4916 wrote to memory of 3208	4916	a97418626ab5c6d356018f26be8c9e6e.exe	87
PID 4916 wrote to memory of 3208	4916	a97418626ab5c6d356018f26be8c9e6e.exe	87
PID 4916 wrote to memory of 3208	4916	a97418626ab5c6d356018f26be8c9e6e.exe	87
PID 4916 wrote to memory of 3208	4916	a97418626ab5c6d356018f26be8c9e6e.exe	87
PID 4916 wrote to memory of 3208	4916	a97418626ab5c6d356018f26be8c9e6e.exe	87
PID 4916 wrote to memory of 3208	4916	a97418626ab5c6d356018f26be8c9e6e.exe	87
PID 4916 wrote to memory of 3208	4916	a97418626ab5c6d356018f26be8c9e6e.exe	87
PID 4916 wrote to memory of 3208	4916	a97418626ab5c6d356018f26be8c9e6e.exe	87
PID 4916 wrote to memory of 3208	4916	a97418626ab5c6d356018f26be8c9e6e.exe	87
PID 4916 wrote to memory of 3208	4916	a97418626ab5c6d356018f26be8c9e6e.exe	87
PID 4916 wrote to memory of 4488	4916	a97418626ab5c6d356018f26be8c9e6e.exe	91
PID 4916 wrote to memory of 4488	4916	a97418626ab5c6d356018f26be8c9e6e.exe	91
PID 4916 wrote to memory of 4488	4916	a97418626ab5c6d356018f26be8c9e6e.exe	91
PID 4488 wrote to memory of 3300	4488	rundll.exe	92
PID 4488 wrote to memory of 3300	4488	rundll.exe	92
PID 4488 wrote to memory of 3300	4488	rundll.exe	92
PID 4488 wrote to memory of 3300	4488	rundll.exe	92
PID 4488 wrote to memory of 3300	4488	rundll.exe	92
PID 4488 wrote to memory of 3300	4488	rundll.exe	92
PID 4488 wrote to memory of 3300	4488	rundll.exe	92
PID 4488 wrote to memory of 3300	4488	rundll.exe	92
PID 4488 wrote to memory of 3300	4488	rundll.exe	92
PID 4488 wrote to memory of 3300	4488	rundll.exe	92
PID 4488 wrote to memory of 3300	4488	rundll.exe	92
PID 4488 wrote to memory of 3300	4488	rundll.exe	92
PID 4488 wrote to memory of 3300	4488	rundll.exe	92
PID 4488 wrote to memory of 3300	4488	rundll.exe	92

C:\Users\Admin\AppData\Local\Temp\a97418626ab5c6d356018f26be8c9e6e.exe
"C:\Users\Admin\AppData\Local\Temp\a97418626ab5c6d356018f26be8c9e6e.exe"
1⤵
- Checks computer location settings
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4916
- C:\Users\Admin\AppData\Local\Temp\svchost.exe
  C:\Users\Admin\AppData\Local\Temp\\svchost.exe
  2⤵
  - Executes dropped EXE
  PID:3208
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3208 -s 12
    3⤵
    - Program crash
    PID:1396
- C:\Users\Admin\AppData\Local\Temp\rundll.exe
  "C:\Users\Admin\AppData\Local\Temp\rundll.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:4488
- - C:\Users\Admin\AppData\Local\Temp\svchost.exe
    C:\Users\Admin\AppData\Local\Temp\\svchost.exe
    3⤵
    - Executes dropped EXE
    PID:3300
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3300 -s 12
      4⤵
      Program crash
      PID:2328

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3208 -ip 3208
1⤵
PID:1800

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 3300 -ip 3300
1⤵
PID:3696

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

rundll.exe

Path C:\Users\Admin\AppData\Local\Temp\rundll.exe
Size 1.2MB
SHA256 d47c0a65712aa145bd97605d900844f4aacd274a687fb5962cda290e4e2ab0c3
MD5 a97418626ab5c6d356018f26be8c9e6e
SHA1 ccbde034a75030a04b77cce2feb099966d82d861
SHA512 0530b23827630288fee62b5150a5e56a7d35e1e615f2ba61b8b4f5ad055054c140f09aaefb9c5593d8b6ea89602432e7b2f13d777f3068361b674f643caf6f7d
SSDEEP 12288:tLOjzQ+cTp3vz9LgCL5YjbEewKIZV8f0kvdX5NUaOACjlkD/WrPXeVlwgbHd8/zO:t3h0IKDcjlKO9n8S4RFXn+Mhk
MD5 SHA1 SHA512 SSDEEP

Submit Download

svchost.exe

Path C:\Users\Admin\AppData\Local\Temp\svchost.exe
Size 4KB
SHA256 2b9b6a97db334d59fa772c3f68d1d34e74e2bb76d180b0013ca0c7c9e90b0194
MD5 bb521b92cfc41248349a3870668e599b
SHA1 166d32ef95f3b9f96821f5959eb3ad56880d9669
SHA512 c7a5ad7d70daeecbc201e54964c8dfa0f435dd0e42183adc5ce53631eaa30a582d840919dcdf9c2cc0e5911fbb1b16b38aedc142a54825cda597ac331e9f617e
MD5 SHA1 SHA512

Submit Download

memory/3208-5-0x0000000013140000-0x00000000131F6000-memory.dmp

Download

memory/4488-21-0x0000000001290000-0x00000000012A0000-memory.dmp

Download

memory/4488-20-0x0000000074C70000-0x0000000075221000-memory.dmp

Download

memory/4488-22-0x0000000074C70000-0x0000000075221000-memory.dmp

Download

memory/4488-27-0x0000000074C70000-0x0000000075221000-memory.dmp

Download

memory/4916-0-0x0000000074C70000-0x0000000075221000-memory.dmp

Download

memory/4916-1-0x0000000074C70000-0x0000000075221000-memory.dmp

Download

memory/4916-2-0x0000000000F50000-0x0000000000F60000-memory.dmp

Download

memory/4916-19-0x0000000074C70000-0x0000000075221000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads