darkcomet | c9b37efc16b190f11f7607ace2a8f5b60639b716a72321fc3aada925c53aa7ed

General

Target

cdca6cf1adac7a1b0e924e6588b9e096.exe
Size

699KB
MD5

cdca6cf1adac7a1b0e924e6588b9e096
SHA1

1f0be53bbda5739eea99a8bce2f7602e17ff269e
SHA256

c9b37efc16b190f11f7607ace2a8f5b60639b716a72321fc3aada925c53aa7ed
SHA512

cfccc676c2808c4461846253fc44dd6cc46a7358357822863f967e5e1b1badb51052e4aefa2f9f371d92661be9de01739a33d3da5eae556f66feb1ad79f5a0a3
SSDEEP

12288:vsOW6Q4OWz9h8T+t7bzyHew18LpuVKxTlQrrq+3r5VuGBBNjZfRzV:hW6VXRhVbzyfyR0qMXNjBRZ

Score

10^/10

darkcomet guest16 evasion persistence rat trojan upx

Malware Config

Extracted

Family

darkcomet

Botnet

Guest16

C2

185.113.208.205:1604

Mutex

DC_MUTEX-UCGJZEA

Attributes

InstallPath
NvidiaGraphicSys.exe
gencode
Hdnr2tMwrvAj
install
true
offline_keylogger
true
persistence
true
reg_key
Nvidia Graphics

Signatures

Darkcomet
DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
trojan rat darkcomet

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

Processes:

XtuService.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\NvidiaGraphicSys.exe"	XtuService.exe

Windows security bypass 2 TTPs 1 IoCs
evasion trojan

Disable or Modify Tools
T1562.001

Modify Registry
T1112

Processes:

NvidiaGraphicSys.exe

description ioc process

Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" NvidiaGraphicSys.exe
Sets file to hidden 1 TTPs 2 IoCs
Modifies file attributes to stop it showing in Explorer etc.
evasion

Hidden Files and Directories
T1564.001

Processes:

attrib.exeattrib.exe

pid process

2408 attrib.exe
2412 attrib.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	NvidiaGraphicSys.exe

pid	process
2408	attrib.exe
2412	attrib.exe

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

cdca6cf1adac7a1b0e924e6588b9e096.exeXtuService.sfx.exeXtuService.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-609813121-2907144057-1731107329-1000\Control Panel\International\Geo\Nation	cdca6cf1adac7a1b0e924e6588b9e096.exe
Key value queried	\REGISTRY\USER\S-1-5-21-609813121-2907144057-1731107329-1000\Control Panel\International\Geo\Nation	XtuService.sfx.exe
Key value queried	\REGISTRY\USER\S-1-5-21-609813121-2907144057-1731107329-1000\Control Panel\International\Geo\Nation	XtuService.exe

Executes dropped EXE 3 IoCs

Processes:

XtuService.sfx.exeXtuService.exeNvidiaGraphicSys.exe

pid process

4560 XtuService.sfx.exe
3084 XtuService.exe
4552 NvidiaGraphicSys.exe

pid	process
4560	XtuService.sfx.exe
3084	XtuService.exe
4552	NvidiaGraphicSys.exe

UPX packed file 9 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\XtuService.exe	upx
behavioral2/memory/3084-21-0x0000000000400000-0x00000000004B7000-memory.dmp	upx
behavioral2/memory/3084-87-0x0000000000400000-0x00000000004B7000-memory.dmp	upx
behavioral2/memory/4552-88-0x0000000000400000-0x00000000004B7000-memory.dmp	upx
behavioral2/memory/4552-90-0x0000000000400000-0x00000000004B7000-memory.dmp	upx
behavioral2/memory/4552-92-0x0000000000400000-0x00000000004B7000-memory.dmp	upx
behavioral2/memory/4552-94-0x0000000000400000-0x00000000004B7000-memory.dmp	upx
behavioral2/memory/4552-96-0x0000000000400000-0x00000000004B7000-memory.dmp	upx
behavioral2/memory/4552-98-0x0000000000400000-0x00000000004B7000-memory.dmp	upx

Windows security modification 2 TTPs 1 IoCs
evasion trojan

Disable or Modify Tools
T1562.001

Modify Registry
T1112

Processes:

NvidiaGraphicSys.exe

description ioc process

Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" NvidiaGraphicSys.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	NvidiaGraphicSys.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

XtuService.exeNvidiaGraphicSys.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-609813121-2907144057-1731107329-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Nvidia Graphics = "C:\\Windows\\system32\\NvidiaGraphicSys.exe"	XtuService.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-609813121-2907144057-1731107329-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Nvidia Graphics = "C:\\Windows\\system32\\NvidiaGraphicSys.exe"	NvidiaGraphicSys.exe

Drops file in System32 directory 3 IoCs

Processes:

XtuService.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\	XtuService.exe
File created	C:\Windows\SysWOW64\NvidiaGraphicSys.exe	XtuService.exe
File opened for modification	C:\Windows\SysWOW64\NvidiaGraphicSys.exe	XtuService.exe

Drops file in Windows directory 5 IoCs

Processes:

cdca6cf1adac7a1b0e924e6588b9e096.exe

description	ioc	process
File created	C:\Windows\XtuService.sfx.exe	cdca6cf1adac7a1b0e924e6588b9e096.exe
File opened for modification	C:\Windows\XtuService.sfx.exe	cdca6cf1adac7a1b0e924e6588b9e096.exe
File created	C:\Windows\__tmp_rar_sfx_access_check_240617859	cdca6cf1adac7a1b0e924e6588b9e096.exe
File created	C:\Windows\XtuService.bat	cdca6cf1adac7a1b0e924e6588b9e096.exe
File opened for modification	C:\Windows\XtuService.bat	cdca6cf1adac7a1b0e924e6588b9e096.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Modifies registry class 1 IoCs

Processes:

XtuService.exe

description ioc process

Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ XtuService.exe
Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

NvidiaGraphicSys.exe

pid process

4552 NvidiaGraphicSys.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	XtuService.exe

pid	process
4552	NvidiaGraphicSys.exe

Suspicious use of AdjustPrivilegeToken 48 IoCs

Processes:

XtuService.exeNvidiaGraphicSys.exe

description	pid	process
Token: SeIncreaseQuotaPrivilege	3084	XtuService.exe
Token: SeSecurityPrivilege	3084	XtuService.exe
Token: SeTakeOwnershipPrivilege	3084	XtuService.exe
Token: SeLoadDriverPrivilege	3084	XtuService.exe
Token: SeSystemProfilePrivilege	3084	XtuService.exe
Token: SeSystemtimePrivilege	3084	XtuService.exe
Token: SeProfSingleProcessPrivilege	3084	XtuService.exe
Token: SeIncBasePriorityPrivilege	3084	XtuService.exe
Token: SeCreatePagefilePrivilege	3084	XtuService.exe
Token: SeBackupPrivilege	3084	XtuService.exe
Token: SeRestorePrivilege	3084	XtuService.exe
Token: SeShutdownPrivilege	3084	XtuService.exe
Token: SeDebugPrivilege	3084	XtuService.exe
Token: SeSystemEnvironmentPrivilege	3084	XtuService.exe
Token: SeChangeNotifyPrivilege	3084	XtuService.exe
Token: SeRemoteShutdownPrivilege	3084	XtuService.exe
Token: SeUndockPrivilege	3084	XtuService.exe
Token: SeManageVolumePrivilege	3084	XtuService.exe
Token: SeImpersonatePrivilege	3084	XtuService.exe
Token: SeCreateGlobalPrivilege	3084	XtuService.exe
Token: 33	3084	XtuService.exe
Token: 34	3084	XtuService.exe
Token: 35	3084	XtuService.exe
Token: 36	3084	XtuService.exe
Token: SeIncreaseQuotaPrivilege	4552	NvidiaGraphicSys.exe
Token: SeSecurityPrivilege	4552	NvidiaGraphicSys.exe
Token: SeTakeOwnershipPrivilege	4552	NvidiaGraphicSys.exe
Token: SeLoadDriverPrivilege	4552	NvidiaGraphicSys.exe
Token: SeSystemProfilePrivilege	4552	NvidiaGraphicSys.exe
Token: SeSystemtimePrivilege	4552	NvidiaGraphicSys.exe
Token: SeProfSingleProcessPrivilege	4552	NvidiaGraphicSys.exe
Token: SeIncBasePriorityPrivilege	4552	NvidiaGraphicSys.exe
Token: SeCreatePagefilePrivilege	4552	NvidiaGraphicSys.exe
Token: SeBackupPrivilege	4552	NvidiaGraphicSys.exe
Token: SeRestorePrivilege	4552	NvidiaGraphicSys.exe
Token: SeShutdownPrivilege	4552	NvidiaGraphicSys.exe
Token: SeDebugPrivilege	4552	NvidiaGraphicSys.exe
Token: SeSystemEnvironmentPrivilege	4552	NvidiaGraphicSys.exe
Token: SeChangeNotifyPrivilege	4552	NvidiaGraphicSys.exe
Token: SeRemoteShutdownPrivilege	4552	NvidiaGraphicSys.exe
Token: SeUndockPrivilege	4552	NvidiaGraphicSys.exe
Token: SeManageVolumePrivilege	4552	NvidiaGraphicSys.exe
Token: SeImpersonatePrivilege	4552	NvidiaGraphicSys.exe
Token: SeCreateGlobalPrivilege	4552	NvidiaGraphicSys.exe
Token: 33	4552	NvidiaGraphicSys.exe
Token: 34	4552	NvidiaGraphicSys.exe
Token: 35	4552	NvidiaGraphicSys.exe
Token: 36	4552	NvidiaGraphicSys.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

NvidiaGraphicSys.exe

pid process

4552 NvidiaGraphicSys.exe

pid	process
4552	NvidiaGraphicSys.exe

Suspicious use of WriteProcessMemory 46 IoCs

Processes:

cdca6cf1adac7a1b0e924e6588b9e096.execmd.exeXtuService.sfx.exeXtuService.execmd.execmd.exeNvidiaGraphicSys.exe

description	pid	process	target process
PID 3356 wrote to memory of 2248	3356	cdca6cf1adac7a1b0e924e6588b9e096.exe	cmd.exe
PID 3356 wrote to memory of 2248	3356	cdca6cf1adac7a1b0e924e6588b9e096.exe	cmd.exe
PID 3356 wrote to memory of 2248	3356	cdca6cf1adac7a1b0e924e6588b9e096.exe	cmd.exe
PID 2248 wrote to memory of 4560	2248	cmd.exe	XtuService.sfx.exe
PID 2248 wrote to memory of 4560	2248	cmd.exe	XtuService.sfx.exe
PID 2248 wrote to memory of 4560	2248	cmd.exe	XtuService.sfx.exe
PID 4560 wrote to memory of 3084	4560	XtuService.sfx.exe	XtuService.exe
PID 4560 wrote to memory of 3084	4560	XtuService.sfx.exe	XtuService.exe
PID 4560 wrote to memory of 3084	4560	XtuService.sfx.exe	XtuService.exe
PID 3084 wrote to memory of 2852	3084	XtuService.exe	cmd.exe
PID 3084 wrote to memory of 2852	3084	XtuService.exe	cmd.exe
PID 3084 wrote to memory of 2852	3084	XtuService.exe	cmd.exe
PID 3084 wrote to memory of 1348	3084	XtuService.exe	cmd.exe
PID 3084 wrote to memory of 1348	3084	XtuService.exe	cmd.exe
PID 3084 wrote to memory of 1348	3084	XtuService.exe	cmd.exe
PID 2852 wrote to memory of 2408	2852	cmd.exe	attrib.exe
PID 1348 wrote to memory of 2412	1348	cmd.exe	attrib.exe
PID 2852 wrote to memory of 2408	2852	cmd.exe	attrib.exe
PID 1348 wrote to memory of 2412	1348	cmd.exe	attrib.exe
PID 2852 wrote to memory of 2408	2852	cmd.exe	attrib.exe
PID 1348 wrote to memory of 2412	1348	cmd.exe	attrib.exe
PID 3084 wrote to memory of 4552	3084	XtuService.exe	NvidiaGraphicSys.exe
PID 3084 wrote to memory of 4552	3084	XtuService.exe	NvidiaGraphicSys.exe
PID 3084 wrote to memory of 4552	3084	XtuService.exe	NvidiaGraphicSys.exe
PID 4552 wrote to memory of 4080	4552	NvidiaGraphicSys.exe	notepad.exe
PID 4552 wrote to memory of 4080	4552	NvidiaGraphicSys.exe	notepad.exe
PID 4552 wrote to memory of 4080	4552	NvidiaGraphicSys.exe	notepad.exe
PID 4552 wrote to memory of 4080	4552	NvidiaGraphicSys.exe	notepad.exe
PID 4552 wrote to memory of 4080	4552	NvidiaGraphicSys.exe	notepad.exe
PID 4552 wrote to memory of 4080	4552	NvidiaGraphicSys.exe	notepad.exe
PID 4552 wrote to memory of 4080	4552	NvidiaGraphicSys.exe	notepad.exe
PID 4552 wrote to memory of 4080	4552	NvidiaGraphicSys.exe	notepad.exe
PID 4552 wrote to memory of 4080	4552	NvidiaGraphicSys.exe	notepad.exe
PID 4552 wrote to memory of 4080	4552	NvidiaGraphicSys.exe	notepad.exe
PID 4552 wrote to memory of 4080	4552	NvidiaGraphicSys.exe	notepad.exe
PID 4552 wrote to memory of 4080	4552	NvidiaGraphicSys.exe	notepad.exe
PID 4552 wrote to memory of 4080	4552	NvidiaGraphicSys.exe	notepad.exe
PID 4552 wrote to memory of 4080	4552	NvidiaGraphicSys.exe	notepad.exe
PID 4552 wrote to memory of 4080	4552	NvidiaGraphicSys.exe	notepad.exe
PID 4552 wrote to memory of 4080	4552	NvidiaGraphicSys.exe	notepad.exe
PID 4552 wrote to memory of 4080	4552	NvidiaGraphicSys.exe	notepad.exe
PID 4552 wrote to memory of 4080	4552	NvidiaGraphicSys.exe	notepad.exe
PID 4552 wrote to memory of 4080	4552	NvidiaGraphicSys.exe	notepad.exe
PID 4552 wrote to memory of 4080	4552	NvidiaGraphicSys.exe	notepad.exe
PID 4552 wrote to memory of 4080	4552	NvidiaGraphicSys.exe	notepad.exe
PID 4552 wrote to memory of 4080	4552	NvidiaGraphicSys.exe	notepad.exe

Views/modifies file attributes 1 TTPs 2 IoCs
evasion

Hidden Files and Directories
T1564.001

Processes:

attrib.exeattrib.exe

pid process

2408 attrib.exe
2412 attrib.exe

pid	process
2408	attrib.exe
2412	attrib.exe

C:\Users\Admin\AppData\Local\Temp\cdca6cf1adac7a1b0e924e6588b9e096.exe
"C:\Users\Admin\AppData\Local\Temp\cdca6cf1adac7a1b0e924e6588b9e096.exe"
1⤵
- Checks computer location settings
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:3356

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Windows\XtuService.bat" "
2⤵
- Suspicious use of WriteProcessMemory
PID:2248

C:\Windows\XtuService.sfx.exe
XtuService.sfx.exe -p12345 dC:\Users\Admin\AppData\Local\Temp
3⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4560

C:\Users\Admin\AppData\Local\Temp\XtuService.exe
"C:\Users\Admin\AppData\Local\Temp\XtuService.exe"
4⤵
- Modifies WinLogon for persistence
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3084

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp\XtuService.exe" +s +h
5⤵
- Suspicious use of WriteProcessMemory
PID:2852

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Users\Admin\AppData\Local\Temp\XtuService.exe" +s +h
6⤵
- Sets file to hidden
- Views/modifies file attributes
PID:2408

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp" +s +h
5⤵
- Suspicious use of WriteProcessMemory
PID:1348

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Users\Admin\AppData\Local\Temp" +s +h
6⤵
- Sets file to hidden
- Views/modifies file attributes
PID:2412

C:\Windows\SysWOW64\NvidiaGraphicSys.exe
"C:\Windows\system32\NvidiaGraphicSys.exe"
5⤵
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Adds Run key to start application
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4552

C:\Windows\SysWOW64\notepad.exe
notepad
6⤵
PID:4080

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

2

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Winlogon Helper DLL

1

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

2

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Winlogon Helper DLL

1

T1547.004

Defense Evasion

Modify Registry

4

T1112

Impair Defenses

2

T1562

Disable or Modify Tools

2

T1562.001

Hide Artifacts

2

T1564

Hidden Files and Directories

2

T1564.001

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\XtuService.exe
Filesize
252KB

MD5
a991a315e9e2cf61f714fa115850e0b5

SHA1
869eab5b7ad365b143f32ee09c4ac4f0a7c13239

SHA256
fb6749c7f90f62ea4f9f23256e0c99b530d33d17cfcb8706c8e196ac5c876e73

SHA512
692884aa9c13600a48bac3219ed91afdd55f269422a6d9f8780106e79f2649c979ed470e5a6a8a3fbb72df4f6c60c2a4b7aecaec475b937055a815baf06bf703

Download Submit
C:\Windows\XtuService.bat
Filesize
34B

MD5
1c74a86919d0e2ffc46439d9479f15dd

SHA1
9c3cf4a8b012282bfee734c27441b6b1ebe74cd3

SHA256
3e996691c8a3613d15dbe231a115a204abac909bf7d169d569a289499e8a92c3

SHA512
7296ed7b5a8d06ddb1aec91cb326a5fc9478727ff84a6279fcb074a9897b5634db461b1ef6df216e191b26c59aeadd3f849c0a264b9c8130082dcab583b84db0

Download Submit
C:\Windows\XtuService.sfx.exe
Filesize
540KB

MD5
dde022f6784892790dca1b1e46c802a9

SHA1
08a103673b3e7ea7f254be3ea58a2aae1ac5e2d1

SHA256
1203b0a5d202731d48e5d1a65bd3e75cb823d49548912da644ed3692194360d2

SHA512
cc19b16c443ff3120371709a302f097b4005a9caae9a2ee6af688a5258b6a17fedc11670722011b4d4d6b472556867b50e3bd27deff5203bcb6593b99606b1ec

Download Submit
memory/3084-21-0x0000000000400000-0x00000000004B7000-memory.dmp

Filesize
732KB

Download
memory/3084-23-0x00000000009D0000-0x00000000009D1000-memory.dmp

Filesize
4KB

Download
memory/3084-87-0x0000000000400000-0x00000000004B7000-memory.dmp

Filesize
732KB

Download
memory/4080-86-0x00000000005A0000-0x00000000005A1000-memory.dmp

Filesize
4KB

Download
memory/4552-85-0x00000000006A0000-0x00000000006A1000-memory.dmp

Filesize
4KB

Download
memory/4552-88-0x0000000000400000-0x00000000004B7000-memory.dmp

Filesize
732KB

Download
memory/4552-90-0x0000000000400000-0x00000000004B7000-memory.dmp

Filesize
732KB

Download
memory/4552-92-0x0000000000400000-0x00000000004B7000-memory.dmp

Filesize
732KB

Download
memory/4552-94-0x0000000000400000-0x00000000004B7000-memory.dmp

Filesize
732KB

Download
memory/4552-96-0x0000000000400000-0x00000000004B7000-memory.dmp

Filesize
732KB

Download
memory/4552-98-0x0000000000400000-0x00000000004B7000-memory.dmp

Filesize
732KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads