darkcomet | 32595284e52beb44bb8078bb8a183b1686b6c1237c8bad51136590e2fb117ede

Analysis

max time kernel
151s
max time network
158s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
20/03/2024, 01:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
d79f6fdb15f1af2f911347e68db2cbda.exe
Size 1.3MB
Sample240320-cde12sef2z
SHA256 32595284e52beb44bb8078bb8a183b1686b6c1237c8bad51136590e2fb117ede
MD5 d79f6fdb15f1af2f911347e68db2cbda
SHA1 89483194f8a3128cf58d5a5a3dd603979f172354
SHA512 118a17fa13ebc46f167d67011acb85f3935add9644b75ad3a973999e6f0e367c85c4053bb695982a4a145fe1184f661815661d8d29a2893ae83f0fdec9d9cfd2
SSDEEP 12288:t1Eu4AZ+EOJTSNT8JpclOVgvcWS2LgHtJpXMKI1jdT5yRVhJUzIwX5+9NB8GYbnU:J0GMG15eisLl74ZYS+/VRZztfU
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

darkcomet victim persistence rat trojan

Malware Config

Extracted

Family

darkcomet

Botnet

victim

127.0.0.1:1604
127.0.0.1:999
localarea.zapto.org:999
localarea.zapto.org:1604

Mutex

DC_MUTEX-261ZY4Q

Attributes

gencode
LByfBB2posaE
install
false
offline_keylogger
true
persistence
false

Signatures

Darkcomet
DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
trojan rat darkcomet

Executes dropped EXE 1 IoCs

pid	Process
3412	svchost.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\1 = "C:\\Users\\Admin\\AppData\\Roaming\\d79f6fdb15f1af2f911347e68db2cbda.exe"	d79f6fdb15f1af2f911347e68db2cbda.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 964 set thread context of 3412	964	d79f6fdb15f1af2f911347e68db2cbda.exe	101

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 24 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	3412	svchost.exe
Token: SeSecurityPrivilege	3412	svchost.exe
Token: SeTakeOwnershipPrivilege	3412	svchost.exe
Token: SeLoadDriverPrivilege	3412	svchost.exe
Token: SeSystemProfilePrivilege	3412	svchost.exe
Token: SeSystemtimePrivilege	3412	svchost.exe
Token: SeProfSingleProcessPrivilege	3412	svchost.exe
Token: SeIncBasePriorityPrivilege	3412	svchost.exe
Token: SeCreatePagefilePrivilege	3412	svchost.exe
Token: SeBackupPrivilege	3412	svchost.exe
Token: SeRestorePrivilege	3412	svchost.exe
Token: SeShutdownPrivilege	3412	svchost.exe
Token: SeDebugPrivilege	3412	svchost.exe
Token: SeSystemEnvironmentPrivilege	3412	svchost.exe
Token: SeChangeNotifyPrivilege	3412	svchost.exe
Token: SeRemoteShutdownPrivilege	3412	svchost.exe
Token: SeUndockPrivilege	3412	svchost.exe
Token: SeManageVolumePrivilege	3412	svchost.exe
Token: SeImpersonatePrivilege	3412	svchost.exe
Token: SeCreateGlobalPrivilege	3412	svchost.exe
Token: 33	3412	svchost.exe
Token: 34	3412	svchost.exe
Token: 35	3412	svchost.exe
Token: 36	3412	svchost.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3412	svchost.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 964 wrote to memory of 3412	964	d79f6fdb15f1af2f911347e68db2cbda.exe	101
PID 964 wrote to memory of 3412	964	d79f6fdb15f1af2f911347e68db2cbda.exe	101
PID 964 wrote to memory of 3412	964	d79f6fdb15f1af2f911347e68db2cbda.exe	101
PID 964 wrote to memory of 3412	964	d79f6fdb15f1af2f911347e68db2cbda.exe	101
PID 964 wrote to memory of 3412	964	d79f6fdb15f1af2f911347e68db2cbda.exe	101
PID 964 wrote to memory of 3412	964	d79f6fdb15f1af2f911347e68db2cbda.exe	101
PID 964 wrote to memory of 3412	964	d79f6fdb15f1af2f911347e68db2cbda.exe	101
PID 964 wrote to memory of 3412	964	d79f6fdb15f1af2f911347e68db2cbda.exe	101
PID 964 wrote to memory of 3412	964	d79f6fdb15f1af2f911347e68db2cbda.exe	101
PID 964 wrote to memory of 3412	964	d79f6fdb15f1af2f911347e68db2cbda.exe	101
PID 964 wrote to memory of 3412	964	d79f6fdb15f1af2f911347e68db2cbda.exe	101
PID 964 wrote to memory of 3412	964	d79f6fdb15f1af2f911347e68db2cbda.exe	101
PID 964 wrote to memory of 3412	964	d79f6fdb15f1af2f911347e68db2cbda.exe	101
PID 964 wrote to memory of 3412	964	d79f6fdb15f1af2f911347e68db2cbda.exe	101

C:\Users\Admin\AppData\Local\Temp\d79f6fdb15f1af2f911347e68db2cbda.exe
"C:\Users\Admin\AppData\Local\Temp\d79f6fdb15f1af2f911347e68db2cbda.exe"
1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:964
- C:\Users\Admin\AppData\Local\Temp\svchost.exe
  C:\Users\Admin\AppData\Local\Temp\svchost.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:3412

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1412 --field-trial-handle=3088,i,14310325015283915034,7660943942870463106,262144 --variations-seed-version /prefetch:8
1⤵
PID:3196

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

svchost.exe

Path C:\Users\Admin\AppData\Local\Temp\svchost.exe
Size 1.1MB
SHA256 b3a37093609f9a20ad60b85a9fa9de2ba674cba9b5bd687729440c70ba619ca0
MD5 d881de17aa8f2e2c08cbb7b265f928f9
SHA1 08936aebc87decf0af6e8eada191062b5e65ac2a
SHA512 5f23bfb1b8740247b36ed0ab741738c7d4c949736129e767213e321607d1ccd3e3a8428e4ba44bd28a275b5e3f6206285b1a522514b7ef7ea5e698d90a713d34
SSDEEP 24576:jp2silPBMIXGWClfuRcUGIJYK15Qs/QZM:jp2sMO7VzUTJH15QFZM
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/964-15-0x0000000074CC0000-0x0000000075271000-memory.dmp

Download

memory/964-1-0x0000000074CC0000-0x0000000075271000-memory.dmp

Download

memory/964-2-0x00000000016E0000-0x00000000016F0000-memory.dmp

Download

memory/964-0-0x0000000074CC0000-0x0000000075271000-memory.dmp

Download

memory/3412-19-0x0000000000400000-0x00000000004B5000-memory.dmp

Download

memory/3412-23-0x0000000000400000-0x00000000004B5000-memory.dmp

Download

memory/3412-13-0x0000000000400000-0x00000000004B5000-memory.dmp

Download

memory/3412-10-0x0000000000400000-0x00000000004B5000-memory.dmp

Download

memory/3412-16-0x00000000025C0000-0x00000000025C1000-memory.dmp

Download

memory/3412-17-0x0000000000400000-0x00000000004B5000-memory.dmp

Download

memory/3412-18-0x0000000000400000-0x00000000004B5000-memory.dmp

Download

memory/3412-7-0x0000000000400000-0x00000000004B5000-memory.dmp

Download

memory/3412-20-0x0000000000400000-0x00000000004B5000-memory.dmp

Download

memory/3412-21-0x00000000025C0000-0x00000000025C1000-memory.dmp

Download

memory/3412-22-0x0000000000400000-0x00000000004B5000-memory.dmp

Download

memory/3412-11-0x0000000000400000-0x00000000004B5000-memory.dmp

Download

memory/3412-24-0x0000000000400000-0x00000000004B5000-memory.dmp

Download

memory/3412-25-0x0000000000400000-0x00000000004B5000-memory.dmp

Download

memory/3412-26-0x0000000000400000-0x00000000004B5000-memory.dmp

Download

memory/3412-27-0x0000000000400000-0x00000000004B5000-memory.dmp

Download

memory/3412-28-0x0000000000400000-0x00000000004B5000-memory.dmp

Download

memory/3412-29-0x0000000000400000-0x00000000004B5000-memory.dmp

Download

memory/3412-30-0x0000000000400000-0x00000000004B5000-memory.dmp

Download

memory/3412-31-0x0000000000400000-0x00000000004B5000-memory.dmp

Download

memory/3412-32-0x0000000000400000-0x00000000004B5000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads