darkcomet | 3794276fe447d5512ec62b362a0eaf0271dae2beae5b4797e6241f5b4653fd18

Analysis

max time kernel
144s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
28/02/2024, 01:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
aa9e85a4b731c75d986f9cad1fd2f59c.exe
Size 745KB
Sample240228-bjbp5sff43
SHA256 3794276fe447d5512ec62b362a0eaf0271dae2beae5b4797e6241f5b4653fd18
MD5 aa9e85a4b731c75d986f9cad1fd2f59c
SHA1 7e86857c88141891bea1ce097f2523919e61443a
SHA512 9c11c6d723b9e168caecc9a21299a9e36a783f3516195d87a6c59875d63773532e4aac5de0cb393d7219c27c93d0e910cfe4bb421b7465b888c206146a68638a
SSDEEP 12288:aaAchpWsuVTv7ItY8XljyypHP7cOLBev03hlULsmWZ++09ZcKDVsgdfV:7AEENIq8XwyVPQclDq/+WnpsSfV
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

darkcomet rat trojan

Malware Config

Signatures

Darkcomet
DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
trojan rat darkcomet

Checks BIOS information in registry 2 TTPs 1 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate	test.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2727153400-192325109-1870347593-1000\Control Panel\International\Geo\Nation	aa9e85a4b731c75d986f9cad1fd2f59c.exe

Executes dropped EXE 2 IoCs

pid	Process
3996	Stub.exe
412	test.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	test.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	test.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	test.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	test.exe

Enumerates system info in registry 2 TTPs 1 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	test.exe

Suspicious use of AdjustPrivilegeToken 24 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	412	test.exe
Token: SeSecurityPrivilege	412	test.exe
Token: SeTakeOwnershipPrivilege	412	test.exe
Token: SeLoadDriverPrivilege	412	test.exe
Token: SeSystemProfilePrivilege	412	test.exe
Token: SeSystemtimePrivilege	412	test.exe
Token: SeProfSingleProcessPrivilege	412	test.exe
Token: SeIncBasePriorityPrivilege	412	test.exe
Token: SeCreatePagefilePrivilege	412	test.exe
Token: SeBackupPrivilege	412	test.exe
Token: SeRestorePrivilege	412	test.exe
Token: SeShutdownPrivilege	412	test.exe
Token: SeDebugPrivilege	412	test.exe
Token: SeSystemEnvironmentPrivilege	412	test.exe
Token: SeChangeNotifyPrivilege	412	test.exe
Token: SeRemoteShutdownPrivilege	412	test.exe
Token: SeUndockPrivilege	412	test.exe
Token: SeManageVolumePrivilege	412	test.exe
Token: SeImpersonatePrivilege	412	test.exe
Token: SeCreateGlobalPrivilege	412	test.exe
Token: 33	412	test.exe
Token: 34	412	test.exe
Token: 35	412	test.exe
Token: 36	412	test.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
412	test.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 4624 wrote to memory of 3996	4624	aa9e85a4b731c75d986f9cad1fd2f59c.exe	90
PID 4624 wrote to memory of 3996	4624	aa9e85a4b731c75d986f9cad1fd2f59c.exe	90
PID 4624 wrote to memory of 412	4624	aa9e85a4b731c75d986f9cad1fd2f59c.exe	91
PID 4624 wrote to memory of 412	4624	aa9e85a4b731c75d986f9cad1fd2f59c.exe	91
PID 4624 wrote to memory of 412	4624	aa9e85a4b731c75d986f9cad1fd2f59c.exe	91

C:\Users\Admin\AppData\Local\Temp\aa9e85a4b731c75d986f9cad1fd2f59c.exe
"C:\Users\Admin\AppData\Local\Temp\aa9e85a4b731c75d986f9cad1fd2f59c.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4624
- C:\Users\Admin\AppData\Local\Temp\Stub.exe
  "C:\Users\Admin\AppData\Local\Temp\Stub.exe"
  2⤵
  - Executes dropped EXE
  PID:3996
- C:\Users\Admin\AppData\Local\Temp\test.exe
  "C:\Users\Admin\AppData\Local\Temp\test.exe"
  2⤵
  - Checks BIOS information in registry
  - Executes dropped EXE
  - Checks processor information in registry
  - Enumerates system info in registry
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:412

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Stub.exe

Path C:\Users\Admin\AppData\Local\Temp\Stub.exe
Size 16KB
SHA256 b394c4fc4860e48aef12a05eeb2264a0a883e6802cd1ed174ab917724de344e4
MD5 df12b01db7bb1d4882ce7e0becab9694
SHA1 c12bf33ecb4bffa6663371c0a96b128b2299ac6a
SHA512 5db59554e65b0b64df9180bd27e32b7c2ae165e9333e4275f27c59e42913c19b4746aea171619b3c39dae0e0d71ee9cf69243f5f9da7dfc53550b03f76dd1b2f
SSDEEP 384:JJHLDTTwh2WUcM2LzCWUkgyR4znDwgXdSb:Lr/TwhTU8zv6nDwx
MD5 SHA1 SHA512 SSDEEP

Submit Download

test.exe

Path C:\Users\Admin\AppData\Local\Temp\test.exe
Size 713KB
SHA256 ddc7cbed8f1af96798d1c63e41b086d63b08eb82a12b737131ac0eadc77e88e3
MD5 78bdf19883250a943cb622a2f55f34a9
SHA1 36a0dc7f24ceb80525596d4d767907faf8f902a3
SHA512 8153b6e1bad62fd9d98acce165f1a64e76cf8a50be7125f08d0d88f74ee6b0834b80420e7682dd5fbe82c497d00cf1899c75cb699c1d2988cf5be2c81471280f
SSDEEP 12288:aaAchpWsuVTv7ItY8XljyypHP7cOLBev03hlULsmWZ++09ZcKDVsgdfr:7AEENIq8XwyVPQclDq/+WnpsSfr
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/412-50-0x0000000000400000-0x00000000004C0000-memory.dmp

Download

memory/412-48-0x0000000000400000-0x00000000004C0000-memory.dmp

Download

memory/412-46-0x0000000000400000-0x00000000004C0000-memory.dmp

Download

memory/412-43-0x0000000000400000-0x00000000004C0000-memory.dmp

Download

memory/412-41-0x0000000000400000-0x00000000004C0000-memory.dmp

Download

memory/412-39-0x0000000000400000-0x00000000004C0000-memory.dmp

Download

memory/412-37-0x0000000000400000-0x00000000004C0000-memory.dmp

Download

memory/412-33-0x0000000002300000-0x0000000002301000-memory.dmp

Download

memory/3996-26-0x0000000000960000-0x0000000000970000-memory.dmp

Download

memory/3996-36-0x00007FFBBC230000-0x00007FFBBCBD1000-memory.dmp

Download

memory/3996-25-0x00007FFBBC230000-0x00007FFBBCBD1000-memory.dmp

Download

memory/3996-34-0x0000000000960000-0x0000000000970000-memory.dmp

Download

memory/3996-30-0x00007FFBBC230000-0x00007FFBBCBD1000-memory.dmp

Download

memory/4624-8-0x0000000000D30000-0x0000000000D40000-memory.dmp

Download

memory/4624-32-0x00007FFBBC230000-0x00007FFBBCBD1000-memory.dmp

Download

memory/4624-0-0x000000001B7B0000-0x000000001B856000-memory.dmp

Download

memory/4624-7-0x000000001C440000-0x000000001C48C000-memory.dmp

Download

memory/4624-6-0x0000000001290000-0x0000000001298000-memory.dmp

Download

memory/4624-5-0x000000001C2E0000-0x000000001C37C000-memory.dmp

Download

memory/4624-4-0x0000000000D30000-0x0000000000D40000-memory.dmp

Download

memory/4624-3-0x00007FFBBC230000-0x00007FFBBCBD1000-memory.dmp

Download

memory/4624-2-0x000000001BD30000-0x000000001C1FE000-memory.dmp

Download

memory/4624-1-0x00007FFBBC230000-0x00007FFBBCBD1000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads