darkcomet | c9b37efc16b190f11f7607ace2a8f5b60639b716a72321fc3aada925c53aa7ed

Analysis

max time kernel
151s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
16/03/2024, 10:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
cdca6cf1adac7a1b0e924e6588b9e096.exe
Size 699KB
Sample240316-l86xpagh2v
SHA256 c9b37efc16b190f11f7607ace2a8f5b60639b716a72321fc3aada925c53aa7ed
MD5 cdca6cf1adac7a1b0e924e6588b9e096
SHA1 1f0be53bbda5739eea99a8bce2f7602e17ff269e
SHA512 cfccc676c2808c4461846253fc44dd6cc46a7358357822863f967e5e1b1badb51052e4aefa2f9f371d92661be9de01739a33d3da5eae556f66feb1ad79f5a0a3
SSDEEP 12288:vsOW6Q4OWz9h8T+t7bzyHew18LpuVKxTlQrrq+3r5VuGBBNjZfRzV:hW6VXRhVbzyfyR0qMXNjBRZ
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

darkcomet guest16 evasion persistence rat trojan upx

Malware Config

Extracted

Family

darkcomet

Botnet

Guest16

185.113.208.205:1604

Mutex

DC_MUTEX-UCGJZEA

Attributes

InstallPath
NvidiaGraphicSys.exe
gencode
Hdnr2tMwrvAj
install
true
offline_keylogger
true
persistence
true
reg_key
Nvidia Graphics

Signatures

Darkcomet
DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
trojan rat darkcomet

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\NvidiaGraphicSys.exe"	XtuService.exe

Windows security bypass 2 TTPs 1 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	NvidiaGraphicSys.exe

Sets file to hidden 1 TTPs 2 IoCs

Modifies file attributes to stop it showing in Explorer etc.

evasion

Hidden Files and Directories

T1564.001

pid	Process
2408	attrib.exe
2412	attrib.exe

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-609813121-2907144057-1731107329-1000\Control Panel\International\Geo\Nation	cdca6cf1adac7a1b0e924e6588b9e096.exe
Key value queried	\REGISTRY\USER\S-1-5-21-609813121-2907144057-1731107329-1000\Control Panel\International\Geo\Nation	XtuService.sfx.exe
Key value queried	\REGISTRY\USER\S-1-5-21-609813121-2907144057-1731107329-1000\Control Panel\International\Geo\Nation	XtuService.exe

Executes dropped EXE 3 IoCs

pid	Process
4560	XtuService.sfx.exe
3084	XtuService.exe
4552	NvidiaGraphicSys.exe

UPX packed file 9 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x000700000002321e-14.dat	upx
behavioral2/memory/3084-21-0x0000000000400000-0x00000000004B7000-memory.dmp	upx
behavioral2/memory/3084-87-0x0000000000400000-0x00000000004B7000-memory.dmp	upx
behavioral2/memory/4552-88-0x0000000000400000-0x00000000004B7000-memory.dmp	upx
behavioral2/memory/4552-90-0x0000000000400000-0x00000000004B7000-memory.dmp	upx
behavioral2/memory/4552-92-0x0000000000400000-0x00000000004B7000-memory.dmp	upx
behavioral2/memory/4552-94-0x0000000000400000-0x00000000004B7000-memory.dmp	upx
behavioral2/memory/4552-96-0x0000000000400000-0x00000000004B7000-memory.dmp	upx
behavioral2/memory/4552-98-0x0000000000400000-0x00000000004B7000-memory.dmp	upx

Windows security modification 2 TTPs 1 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	NvidiaGraphicSys.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-609813121-2907144057-1731107329-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Nvidia Graphics = "C:\\Windows\\system32\\NvidiaGraphicSys.exe"	XtuService.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-609813121-2907144057-1731107329-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Nvidia Graphics = "C:\\Windows\\system32\\NvidiaGraphicSys.exe"	NvidiaGraphicSys.exe

Drops file in System32 directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\	XtuService.exe
File created	C:\Windows\SysWOW64\NvidiaGraphicSys.exe	XtuService.exe
File opened for modification	C:\Windows\SysWOW64\NvidiaGraphicSys.exe	XtuService.exe

Drops file in Windows directory 5 IoCs

description	ioc	Process
File created	C:\Windows\XtuService.sfx.exe	cdca6cf1adac7a1b0e924e6588b9e096.exe
File opened for modification	C:\Windows\XtuService.sfx.exe	cdca6cf1adac7a1b0e924e6588b9e096.exe
File created	C:\Windows\__tmp_rar_sfx_access_check_240617859	cdca6cf1adac7a1b0e924e6588b9e096.exe
File created	C:\Windows\XtuService.bat	cdca6cf1adac7a1b0e924e6588b9e096.exe
File opened for modification	C:\Windows\XtuService.bat	cdca6cf1adac7a1b0e924e6588b9e096.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	XtuService.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4552	NvidiaGraphicSys.exe

Suspicious use of AdjustPrivilegeToken 48 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	3084	XtuService.exe
Token: SeSecurityPrivilege	3084	XtuService.exe
Token: SeTakeOwnershipPrivilege	3084	XtuService.exe
Token: SeLoadDriverPrivilege	3084	XtuService.exe
Token: SeSystemProfilePrivilege	3084	XtuService.exe
Token: SeSystemtimePrivilege	3084	XtuService.exe
Token: SeProfSingleProcessPrivilege	3084	XtuService.exe
Token: SeIncBasePriorityPrivilege	3084	XtuService.exe
Token: SeCreatePagefilePrivilege	3084	XtuService.exe
Token: SeBackupPrivilege	3084	XtuService.exe
Token: SeRestorePrivilege	3084	XtuService.exe
Token: SeShutdownPrivilege	3084	XtuService.exe
Token: SeDebugPrivilege	3084	XtuService.exe
Token: SeSystemEnvironmentPrivilege	3084	XtuService.exe
Token: SeChangeNotifyPrivilege	3084	XtuService.exe
Token: SeRemoteShutdownPrivilege	3084	XtuService.exe
Token: SeUndockPrivilege	3084	XtuService.exe
Token: SeManageVolumePrivilege	3084	XtuService.exe
Token: SeImpersonatePrivilege	3084	XtuService.exe
Token: SeCreateGlobalPrivilege	3084	XtuService.exe
Token: 33	3084	XtuService.exe
Token: 34	3084	XtuService.exe
Token: 35	3084	XtuService.exe
Token: 36	3084	XtuService.exe
Token: SeIncreaseQuotaPrivilege	4552	NvidiaGraphicSys.exe
Token: SeSecurityPrivilege	4552	NvidiaGraphicSys.exe
Token: SeTakeOwnershipPrivilege	4552	NvidiaGraphicSys.exe
Token: SeLoadDriverPrivilege	4552	NvidiaGraphicSys.exe
Token: SeSystemProfilePrivilege	4552	NvidiaGraphicSys.exe
Token: SeSystemtimePrivilege	4552	NvidiaGraphicSys.exe
Token: SeProfSingleProcessPrivilege	4552	NvidiaGraphicSys.exe
Token: SeIncBasePriorityPrivilege	4552	NvidiaGraphicSys.exe
Token: SeCreatePagefilePrivilege	4552	NvidiaGraphicSys.exe
Token: SeBackupPrivilege	4552	NvidiaGraphicSys.exe
Token: SeRestorePrivilege	4552	NvidiaGraphicSys.exe
Token: SeShutdownPrivilege	4552	NvidiaGraphicSys.exe
Token: SeDebugPrivilege	4552	NvidiaGraphicSys.exe
Token: SeSystemEnvironmentPrivilege	4552	NvidiaGraphicSys.exe
Token: SeChangeNotifyPrivilege	4552	NvidiaGraphicSys.exe
Token: SeRemoteShutdownPrivilege	4552	NvidiaGraphicSys.exe
Token: SeUndockPrivilege	4552	NvidiaGraphicSys.exe
Token: SeManageVolumePrivilege	4552	NvidiaGraphicSys.exe
Token: SeImpersonatePrivilege	4552	NvidiaGraphicSys.exe
Token: SeCreateGlobalPrivilege	4552	NvidiaGraphicSys.exe
Token: 33	4552	NvidiaGraphicSys.exe
Token: 34	4552	NvidiaGraphicSys.exe
Token: 35	4552	NvidiaGraphicSys.exe
Token: 36	4552	NvidiaGraphicSys.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4552	NvidiaGraphicSys.exe

Suspicious use of WriteProcessMemory 46 IoCs

description	pid	Process	procid_target
PID 3356 wrote to memory of 2248	3356	cdca6cf1adac7a1b0e924e6588b9e096.exe	87
PID 3356 wrote to memory of 2248	3356	cdca6cf1adac7a1b0e924e6588b9e096.exe	87
PID 3356 wrote to memory of 2248	3356	cdca6cf1adac7a1b0e924e6588b9e096.exe	87
PID 2248 wrote to memory of 4560	2248	cmd.exe	92
PID 2248 wrote to memory of 4560	2248	cmd.exe	92
PID 2248 wrote to memory of 4560	2248	cmd.exe	92
PID 4560 wrote to memory of 3084	4560	XtuService.sfx.exe	93
PID 4560 wrote to memory of 3084	4560	XtuService.sfx.exe	93
PID 4560 wrote to memory of 3084	4560	XtuService.sfx.exe	93
PID 3084 wrote to memory of 2852	3084	XtuService.exe	94
PID 3084 wrote to memory of 2852	3084	XtuService.exe	94
PID 3084 wrote to memory of 2852	3084	XtuService.exe	94
PID 3084 wrote to memory of 1348	3084	XtuService.exe	97
PID 3084 wrote to memory of 1348	3084	XtuService.exe	97
PID 3084 wrote to memory of 1348	3084	XtuService.exe	97
PID 2852 wrote to memory of 2408	2852	cmd.exe	99
PID 1348 wrote to memory of 2412	1348	cmd.exe	100
PID 2852 wrote to memory of 2408	2852	cmd.exe	99
PID 1348 wrote to memory of 2412	1348	cmd.exe	100
PID 2852 wrote to memory of 2408	2852	cmd.exe	99
PID 1348 wrote to memory of 2412	1348	cmd.exe	100
PID 3084 wrote to memory of 4552	3084	XtuService.exe	101
PID 3084 wrote to memory of 4552	3084	XtuService.exe	101
PID 3084 wrote to memory of 4552	3084	XtuService.exe	101
PID 4552 wrote to memory of 4080	4552	NvidiaGraphicSys.exe	102
PID 4552 wrote to memory of 4080	4552	NvidiaGraphicSys.exe	102
PID 4552 wrote to memory of 4080	4552	NvidiaGraphicSys.exe	102
PID 4552 wrote to memory of 4080	4552	NvidiaGraphicSys.exe	102
PID 4552 wrote to memory of 4080	4552	NvidiaGraphicSys.exe	102
PID 4552 wrote to memory of 4080	4552	NvidiaGraphicSys.exe	102
PID 4552 wrote to memory of 4080	4552	NvidiaGraphicSys.exe	102
PID 4552 wrote to memory of 4080	4552	NvidiaGraphicSys.exe	102
PID 4552 wrote to memory of 4080	4552	NvidiaGraphicSys.exe	102
PID 4552 wrote to memory of 4080	4552	NvidiaGraphicSys.exe	102
PID 4552 wrote to memory of 4080	4552	NvidiaGraphicSys.exe	102
PID 4552 wrote to memory of 4080	4552	NvidiaGraphicSys.exe	102
PID 4552 wrote to memory of 4080	4552	NvidiaGraphicSys.exe	102
PID 4552 wrote to memory of 4080	4552	NvidiaGraphicSys.exe	102
PID 4552 wrote to memory of 4080	4552	NvidiaGraphicSys.exe	102
PID 4552 wrote to memory of 4080	4552	NvidiaGraphicSys.exe	102
PID 4552 wrote to memory of 4080	4552	NvidiaGraphicSys.exe	102
PID 4552 wrote to memory of 4080	4552	NvidiaGraphicSys.exe	102
PID 4552 wrote to memory of 4080	4552	NvidiaGraphicSys.exe	102
PID 4552 wrote to memory of 4080	4552	NvidiaGraphicSys.exe	102
PID 4552 wrote to memory of 4080	4552	NvidiaGraphicSys.exe	102
PID 4552 wrote to memory of 4080	4552	NvidiaGraphicSys.exe	102

Views/modifies file attributes 1 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1564.001

pid	Process
2408	attrib.exe
2412	attrib.exe

C:\Users\Admin\AppData\Local\Temp\cdca6cf1adac7a1b0e924e6588b9e096.exe
"C:\Users\Admin\AppData\Local\Temp\cdca6cf1adac7a1b0e924e6588b9e096.exe"
1⤵
- Checks computer location settings
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:3356
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Windows\XtuService.bat" "
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2248
- - C:\Windows\XtuService.sfx.exe
    XtuService.sfx.exe -p12345 dC:\Users\Admin\AppData\Local\Temp
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:4560
  - - C:\Users\Admin\AppData\Local\Temp\XtuService.exe
      "C:\Users\Admin\AppData\Local\Temp\XtuService.exe"
      4⤵
      Modifies WinLogon for persistence
      Checks computer location settings
      Executes dropped EXE
      Adds Run key to start application
      Drops file in System32 directory
      Modifies registry class
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:3084
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp\XtuService.exe" +s +h
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:2852
      - C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Users\Admin\AppData\Local\Temp\XtuService.exe" +s +h
        6⤵
        Sets file to hidden
        Views/modifies file attributes
        
        PID:2408
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp" +s +h
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:1348
      - C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Users\Admin\AppData\Local\Temp" +s +h
        6⤵
        Sets file to hidden
        Views/modifies file attributes
        
        PID:2412
    - - C:\Windows\SysWOW64\NvidiaGraphicSys.exe
        
        "C:\Windows\system32\NvidiaGraphicSys.exe"
        5⤵
        Windows security bypass
        Executes dropped EXE
        Windows security modification
        Adds Run key to start application
        Suspicious behavior: GetForegroundWindowSpam
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:4552
      - C:\Windows\SysWOW64\notepad.exe
        
        notepad
        6⤵
        
        PID:4080

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

XtuService.exe

Path C:\Users\Admin\AppData\Local\Temp\XtuService.exe
Size 252KB
SHA256 fb6749c7f90f62ea4f9f23256e0c99b530d33d17cfcb8706c8e196ac5c876e73
MD5 a991a315e9e2cf61f714fa115850e0b5
SHA1 869eab5b7ad365b143f32ee09c4ac4f0a7c13239
SHA512 692884aa9c13600a48bac3219ed91afdd55f269422a6d9f8780106e79f2649c979ed470e5a6a8a3fbb72df4f6c60c2a4b7aecaec475b937055a815baf06bf703
SSDEEP 6144:KcNYk1yuwEDBum3qYWnl0pd0EX3Zq2b6wfIDYm0PHQ0:KcWkbgTYWnYnt/IDYhP
MD5 SHA1 SHA512 SSDEEP

Submit Download

XtuService.bat

Path C:\Windows\XtuService.bat
Size 34B
SHA256 3e996691c8a3613d15dbe231a115a204abac909bf7d169d569a289499e8a92c3
MD5 1c74a86919d0e2ffc46439d9479f15dd
SHA1 9c3cf4a8b012282bfee734c27441b6b1ebe74cd3
SHA512 7296ed7b5a8d06ddb1aec91cb326a5fc9478727ff84a6279fcb074a9897b5634db461b1ef6df216e191b26c59aeadd3f849c0a264b9c8130082dcab583b84db0
MD5 SHA1 SHA512

Submit Download

XtuService.sfx.exe

Path C:\Windows\XtuService.sfx.exe
Size 540KB
SHA256 1203b0a5d202731d48e5d1a65bd3e75cb823d49548912da644ed3692194360d2
MD5 dde022f6784892790dca1b1e46c802a9
SHA1 08a103673b3e7ea7f254be3ea58a2aae1ac5e2d1
SHA512 cc19b16c443ff3120371709a302f097b4005a9caae9a2ee6af688a5258b6a17fedc11670722011b4d4d6b472556867b50e3bd27deff5203bcb6593b99606b1ec
SSDEEP 12288:vsOW6Q4OWz9h8T+t7bzyHMLrH4/xM/ablOjM2/4QspOO:hW6VXRhVbzygwxNOtwQ8
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/3084-21-0x0000000000400000-0x00000000004B7000-memory.dmp

Download

memory/3084-23-0x00000000009D0000-0x00000000009D1000-memory.dmp

Download

memory/3084-87-0x0000000000400000-0x00000000004B7000-memory.dmp

Download

memory/4080-86-0x00000000005A0000-0x00000000005A1000-memory.dmp

Download

memory/4552-85-0x00000000006A0000-0x00000000006A1000-memory.dmp

Download

memory/4552-88-0x0000000000400000-0x00000000004B7000-memory.dmp

Download

memory/4552-90-0x0000000000400000-0x00000000004B7000-memory.dmp

Download

memory/4552-92-0x0000000000400000-0x00000000004B7000-memory.dmp

Download

memory/4552-94-0x0000000000400000-0x00000000004B7000-memory.dmp

Download

memory/4552-96-0x0000000000400000-0x00000000004B7000-memory.dmp

Download

memory/4552-98-0x0000000000400000-0x00000000004B7000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads