darkcomet | 427f8b826a8cc9e9059fcd956636a37a6aab8a3162b1ad1a3cc24752f6e8f351

General

Target

ce6de8599b565fddf67ee026ee4bc285.exe
Size

232KB
MD5

ce6de8599b565fddf67ee026ee4bc285
SHA1

a6045faafaecb660b65d45759b13a38ea2a7ce23
SHA256

427f8b826a8cc9e9059fcd956636a37a6aab8a3162b1ad1a3cc24752f6e8f351
SHA512

192e3ce197a090904d5e3838eb411e38097c20d5d7efbc6d055140fcc88e0a4cef78293e8c1c9c8abaeec55f075e17456e7607b7eaad1ed3b87866aa648d2a71
SSDEEP

3072:SNztnBlBp9ALvNKMKWqXs8NqU+xwDbUe2WpZJmXHB8zrYqHphTfBsbOEU0+rDGLh:SNJfRAzNK5W/1WRmR4r7JhuyE8wPQ

Score

10^/10

darkcomet latentbot guest16 evasion persistence rat trojan

Malware Config

Extracted

Family

darkcomet

Botnet

Guest16

C2

trackingservice.zapto.org:1604

Mutex

DC_MUTEX-Q0QBNJA

Attributes

InstallPath
Windupdt\winupdate.exe
gencode
ujn2qDPvmCGP
install
true
offline_keylogger
true
persistence
true
reg_key
winupdater

Extracted

Family

latentbot

C2

trackingservice.zapto.org

Signatures

Darkcomet
DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
trojan rat darkcomet
LatentBot
Modular trojan written in Delphi which has been in-the-wild since 2013.
trojan latentbot

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

Processes:

ce6de8599b565fddf67ee026ee4bc285.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windupdt\\winupdate.exe"	ce6de8599b565fddf67ee026ee4bc285.exe

Modifies firewall policy service 2 TTPs 6 IoCs

evasion

Modify Registry

T1112

Windows Service

T1543.003

Processes:

winupdate.exeiexplore.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "0"	winupdate.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	iexplore.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0"	iexplore.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "0"	iexplore.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	winupdate.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0"	winupdate.exe

Disables RegEdit via registry modification 2 IoCs

evasion

Processes:

iexplore.exewinupdate.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	winupdate.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

ce6de8599b565fddf67ee026ee4bc285.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000\Control Panel\International\Geo\Nation	ce6de8599b565fddf67ee026ee4bc285.exe

Executes dropped EXE 1 IoCs

Processes:

winupdate.exe

pid process

2120 winupdate.exe

pid	process
2120	winupdate.exe

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

ce6de8599b565fddf67ee026ee4bc285.exewinupdate.exeiexplore.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\winupdater = "C:\\Windupdt\\winupdate.exe"	ce6de8599b565fddf67ee026ee4bc285.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\winupdater = "C:\\Windupdt\\winupdate.exe"	winupdate.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\winupdater = "C:\\Windupdt\\winupdate.exe"	iexplore.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

winupdate.exe

description pid process target process

PID 2120 set thread context of 1252 2120 winupdate.exe iexplore.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

description	pid	process	target process
PID 2120 set thread context of 1252	2120	winupdate.exe	iexplore.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

ce6de8599b565fddf67ee026ee4bc285.exewinupdate.exeiexplore.exe

description	pid	process
Token: SeIncreaseQuotaPrivilege	4888	ce6de8599b565fddf67ee026ee4bc285.exe
Token: SeSecurityPrivilege	4888	ce6de8599b565fddf67ee026ee4bc285.exe
Token: SeTakeOwnershipPrivilege	4888	ce6de8599b565fddf67ee026ee4bc285.exe
Token: SeLoadDriverPrivilege	4888	ce6de8599b565fddf67ee026ee4bc285.exe
Token: SeSystemProfilePrivilege	4888	ce6de8599b565fddf67ee026ee4bc285.exe
Token: SeSystemtimePrivilege	4888	ce6de8599b565fddf67ee026ee4bc285.exe
Token: SeProfSingleProcessPrivilege	4888	ce6de8599b565fddf67ee026ee4bc285.exe
Token: SeIncBasePriorityPrivilege	4888	ce6de8599b565fddf67ee026ee4bc285.exe
Token: SeCreatePagefilePrivilege	4888	ce6de8599b565fddf67ee026ee4bc285.exe
Token: SeBackupPrivilege	4888	ce6de8599b565fddf67ee026ee4bc285.exe
Token: SeRestorePrivilege	4888	ce6de8599b565fddf67ee026ee4bc285.exe
Token: SeShutdownPrivilege	4888	ce6de8599b565fddf67ee026ee4bc285.exe
Token: SeDebugPrivilege	4888	ce6de8599b565fddf67ee026ee4bc285.exe
Token: SeSystemEnvironmentPrivilege	4888	ce6de8599b565fddf67ee026ee4bc285.exe
Token: SeChangeNotifyPrivilege	4888	ce6de8599b565fddf67ee026ee4bc285.exe
Token: SeRemoteShutdownPrivilege	4888	ce6de8599b565fddf67ee026ee4bc285.exe
Token: SeUndockPrivilege	4888	ce6de8599b565fddf67ee026ee4bc285.exe
Token: SeManageVolumePrivilege	4888	ce6de8599b565fddf67ee026ee4bc285.exe
Token: SeImpersonatePrivilege	4888	ce6de8599b565fddf67ee026ee4bc285.exe
Token: SeCreateGlobalPrivilege	4888	ce6de8599b565fddf67ee026ee4bc285.exe
Token: 33	4888	ce6de8599b565fddf67ee026ee4bc285.exe
Token: 34	4888	ce6de8599b565fddf67ee026ee4bc285.exe
Token: 35	4888	ce6de8599b565fddf67ee026ee4bc285.exe
Token: 36	4888	ce6de8599b565fddf67ee026ee4bc285.exe
Token: SeIncreaseQuotaPrivilege	2120	winupdate.exe
Token: SeSecurityPrivilege	2120	winupdate.exe
Token: SeTakeOwnershipPrivilege	2120	winupdate.exe
Token: SeLoadDriverPrivilege	2120	winupdate.exe
Token: SeSystemProfilePrivilege	2120	winupdate.exe
Token: SeSystemtimePrivilege	2120	winupdate.exe
Token: SeProfSingleProcessPrivilege	2120	winupdate.exe
Token: SeIncBasePriorityPrivilege	2120	winupdate.exe
Token: SeCreatePagefilePrivilege	2120	winupdate.exe
Token: SeBackupPrivilege	2120	winupdate.exe
Token: SeRestorePrivilege	2120	winupdate.exe
Token: SeShutdownPrivilege	2120	winupdate.exe
Token: SeDebugPrivilege	2120	winupdate.exe
Token: SeSystemEnvironmentPrivilege	2120	winupdate.exe
Token: SeChangeNotifyPrivilege	2120	winupdate.exe
Token: SeRemoteShutdownPrivilege	2120	winupdate.exe
Token: SeUndockPrivilege	2120	winupdate.exe
Token: SeManageVolumePrivilege	2120	winupdate.exe
Token: SeImpersonatePrivilege	2120	winupdate.exe
Token: SeCreateGlobalPrivilege	2120	winupdate.exe
Token: 33	2120	winupdate.exe
Token: 34	2120	winupdate.exe
Token: 35	2120	winupdate.exe
Token: 36	2120	winupdate.exe
Token: SeIncreaseQuotaPrivilege	1252	iexplore.exe
Token: SeSecurityPrivilege	1252	iexplore.exe
Token: SeTakeOwnershipPrivilege	1252	iexplore.exe
Token: SeLoadDriverPrivilege	1252	iexplore.exe
Token: SeSystemProfilePrivilege	1252	iexplore.exe
Token: SeSystemtimePrivilege	1252	iexplore.exe
Token: SeProfSingleProcessPrivilege	1252	iexplore.exe
Token: SeIncBasePriorityPrivilege	1252	iexplore.exe
Token: SeCreatePagefilePrivilege	1252	iexplore.exe
Token: SeBackupPrivilege	1252	iexplore.exe
Token: SeRestorePrivilege	1252	iexplore.exe
Token: SeShutdownPrivilege	1252	iexplore.exe
Token: SeDebugPrivilege	1252	iexplore.exe
Token: SeSystemEnvironmentPrivilege	1252	iexplore.exe
Token: SeChangeNotifyPrivilege	1252	iexplore.exe
Token: SeRemoteShutdownPrivilege	1252	iexplore.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

iexplore.exe

pid process

1252 iexplore.exe

pid	process
1252	iexplore.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

ce6de8599b565fddf67ee026ee4bc285.exewinupdate.exe

description	pid	process	target process
PID 4888 wrote to memory of 2120	4888	ce6de8599b565fddf67ee026ee4bc285.exe	winupdate.exe
PID 4888 wrote to memory of 2120	4888	ce6de8599b565fddf67ee026ee4bc285.exe	winupdate.exe
PID 4888 wrote to memory of 2120	4888	ce6de8599b565fddf67ee026ee4bc285.exe	winupdate.exe
PID 2120 wrote to memory of 1252	2120	winupdate.exe	iexplore.exe
PID 2120 wrote to memory of 1252	2120	winupdate.exe	iexplore.exe
PID 2120 wrote to memory of 1252	2120	winupdate.exe	iexplore.exe
PID 2120 wrote to memory of 1252	2120	winupdate.exe	iexplore.exe
PID 2120 wrote to memory of 1252	2120	winupdate.exe	iexplore.exe

C:\Users\Admin\AppData\Local\Temp\ce6de8599b565fddf67ee026ee4bc285.exe
"C:\Users\Admin\AppData\Local\Temp\ce6de8599b565fddf67ee026ee4bc285.exe"
1⤵
- Modifies WinLogon for persistence
- Checks computer location settings
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4888

C:\Windupdt\winupdate.exe
"C:\Windupdt\winupdate.exe"
2⤵
- Modifies firewall policy service
- Disables RegEdit via registry modification
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2120

C:\Program Files (x86)\Internet Explorer\iexplore.exe
"C:\Program Files (x86)\Internet Explorer\iexplore.exe"
3⤵
- Modifies firewall policy service
- Disables RegEdit via registry modification
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1252

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

2

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Winlogon Helper DLL

1

T1547.004

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

2

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Winlogon Helper DLL

1

T1547.004

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Defense Evasion

Modify Registry

3

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windupdt\winupdate.exe
Filesize
232KB

MD5
ce6de8599b565fddf67ee026ee4bc285

SHA1
a6045faafaecb660b65d45759b13a38ea2a7ce23

SHA256
427f8b826a8cc9e9059fcd956636a37a6aab8a3162b1ad1a3cc24752f6e8f351

SHA512
192e3ce197a090904d5e3838eb411e38097c20d5d7efbc6d055140fcc88e0a4cef78293e8c1c9c8abaeec55f075e17456e7607b7eaad1ed3b87866aa648d2a71

Download Submit
memory/2120-16-0x0000000002180000-0x0000000002181000-memory.dmp

Filesize
4KB

Download
memory/2120-18-0x0000000000400000-0x00000000004B3000-memory.dmp

Filesize
716KB

Download
memory/4888-0-0x0000000000400000-0x00000000004B3000-memory.dmp

Filesize
716KB

Download
memory/4888-1-0x00000000022B0000-0x00000000022B1000-memory.dmp

Filesize
4KB

Download
memory/4888-15-0x0000000000400000-0x00000000004B3000-memory.dmp

Filesize
716KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads