darkcomet | 10b13be0906d9530b2828a7f818438304a086da63cba668d4c9c3f12694c8154

Analysis

max time kernel
140s
max time network
143s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
16/03/2024, 13:53

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ce373cff10289f49d31c2280269a3a22.exe
Size 341KB
Sample240316-q7e5ssec46
SHA256 10b13be0906d9530b2828a7f818438304a086da63cba668d4c9c3f12694c8154
MD5 ce373cff10289f49d31c2280269a3a22
SHA1 411606fef2afb4435352f66c576ba545a6b11423
SHA512 f4b189ee7390c03f9cde10b4018081a839f3b08611ba7cfde8cebad36d2e02685d34780fc3b2518dc574d9969e30d4b5ce4244311a4745c6e84314dbf756e849
SSDEEP 6144:l9E2tV49pL+2u6AnQI+C8XEkcLRl3kB9VeBB:l9E2tV49pL+2tAn1+C8X/cLRl3kB/eB
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

darkcomet persistence rat trojan

Malware Config

Signatures

Darkcomet
DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
trojan rat darkcomet
Uses the VBS compiler for execution 1 TTPs

Scripting
T1064

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\svchost.exe = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\svchost.exe\""	ce373cff10289f49d31c2280269a3a22.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ = "C:\\"	vbc.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2324 set thread context of 3500	2324	ce373cff10289f49d31c2280269a3a22.exe	97

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 2324 wrote to memory of 3500	2324	ce373cff10289f49d31c2280269a3a22.exe	97
PID 2324 wrote to memory of 3500	2324	ce373cff10289f49d31c2280269a3a22.exe	97
PID 2324 wrote to memory of 3500	2324	ce373cff10289f49d31c2280269a3a22.exe	97
PID 2324 wrote to memory of 3500	2324	ce373cff10289f49d31c2280269a3a22.exe	97
PID 2324 wrote to memory of 3500	2324	ce373cff10289f49d31c2280269a3a22.exe	97
PID 2324 wrote to memory of 3500	2324	ce373cff10289f49d31c2280269a3a22.exe	97
PID 2324 wrote to memory of 3500	2324	ce373cff10289f49d31c2280269a3a22.exe	97
PID 2324 wrote to memory of 3500	2324	ce373cff10289f49d31c2280269a3a22.exe	97
PID 2324 wrote to memory of 3500	2324	ce373cff10289f49d31c2280269a3a22.exe	97
PID 2324 wrote to memory of 3500	2324	ce373cff10289f49d31c2280269a3a22.exe	97

C:\Users\Admin\AppData\Local\Temp\ce373cff10289f49d31c2280269a3a22.exe
"C:\Users\Admin\AppData\Local\Temp\ce373cff10289f49d31c2280269a3a22.exe"
1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2324
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
  C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
  2⤵
  - Adds Run key to start application
  PID:3500

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3972 --field-trial-handle=2276,i,11674642242468042059,14711253743544118298,262144 --variations-seed-version /prefetch:8
1⤵
PID:3548

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scripting

T1064

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Scripting

T1064

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2324-0-0x00000000750F0000-0x00000000756A1000-memory.dmp

Download

memory/2324-1-0x00000000012A0000-0x00000000012B0000-memory.dmp

Download

memory/2324-2-0x00000000750F0000-0x00000000756A1000-memory.dmp

Download

memory/2324-10-0x00000000750F0000-0x00000000756A1000-memory.dmp

Download

memory/3500-4-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/3500-5-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/3500-7-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/3500-8-0x0000000000400000-0x0000000000429000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads