darkcomet | 50345c9206d2abdbd6ba42f019456e51d9b1d1507e794c4ffc27d561ef3a5b83

Analysis

max time kernel
151s
max time network
158s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
02/04/2024, 13:53

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
f461b17cf839f10db53155f207682533d99a056ee3a883ff7e0e6f5bc77f87c6.exe
Size 5.4MB
Sample240402-q7b35scc2y
SHA256 f461b17cf839f10db53155f207682533d99a056ee3a883ff7e0e6f5bc77f87c6
MD5 616fd2b3429b816fc7ebc62d103cc995
SHA1 5a202f24dda9c7b9407b1bc41c27a84c29ea964f
SHA512 a0c1a065d6d6b18127c92597baccbcd4fd2136eee4462182899a928c163a2adad065ceabd6a12bf369a8e5ceafb318c29782100ebfc3e63e014602b7253d1bc2
SSDEEP 98304:9uv8pxJvkLXr8+VOOrjL6eRhzvBG40st9Rl0E4dV0Q89XbrnH:9dY4+QOrjpRhzBL0K9H05dCQwH
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

darkcomet evasion persistence rat trojan vmprotect

Malware Config

Signatures

Darkcomet
DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
trojan rat darkcomet

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\Runtime Broker.exe"	f461b17cf839f10db53155f207682533d99a056ee3a883ff7e0e6f5bc77f87c6.exe

Sets file to hidden 1 TTPs 2 IoCs

Modifies file attributes to stop it showing in Explorer etc.

evasion

Hidden Files and Directories

T1564.001

pid	Process
2056	attrib.exe
2416	attrib.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-557049126-2506969350-2798870634-1000\Control Panel\International\Geo\Nation	f461b17cf839f10db53155f207682533d99a056ee3a883ff7e0e6f5bc77f87c6.exe

Executes dropped EXE 1 IoCs

pid	Process
4460	Runtime Broker.exe

VMProtect packed file 6 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

resource	yara_rule
behavioral2/memory/1700-0-0x0000000000400000-0x0000000000D3E000-memory.dmp	vmprotect
behavioral2/memory/1700-9-0x0000000000400000-0x0000000000D3E000-memory.dmp	vmprotect
behavioral2/files/0x000b000000023158-16.dat	vmprotect
behavioral2/memory/1700-25-0x0000000000400000-0x0000000000D3E000-memory.dmp	vmprotect
behavioral2/memory/4460-35-0x0000000000400000-0x0000000000D3E000-memory.dmp	vmprotect
behavioral2/memory/4460-39-0x0000000000400000-0x0000000000D3E000-memory.dmp	vmprotect

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-557049126-2506969350-2798870634-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RUNTIMEBROKHANDLER = "C:\\Windows\\system32\\Runtime Broker.exe"	f461b17cf839f10db53155f207682533d99a056ee3a883ff7e0e6f5bc77f87c6.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-557049126-2506969350-2798870634-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RUNTIMEBROKHANDLER = "C:\\Windows\\system32\\Runtime Broker.exe"	Runtime Broker.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 1 IoCs

Web Service

T1102

flow	ioc
13	7.tcp.eu.ngrok.io

Drops file in System32 directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\	f461b17cf839f10db53155f207682533d99a056ee3a883ff7e0e6f5bc77f87c6.exe
File created	C:\Windows\SysWOW64\Runtime Broker.exe	f461b17cf839f10db53155f207682533d99a056ee3a883ff7e0e6f5bc77f87c6.exe
File opened for modification	C:\Windows\SysWOW64\Runtime Broker.exe	f461b17cf839f10db53155f207682533d99a056ee3a883ff7e0e6f5bc77f87c6.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
1700	f461b17cf839f10db53155f207682533d99a056ee3a883ff7e0e6f5bc77f87c6.exe
4460	Runtime Broker.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
1700	f461b17cf839f10db53155f207682533d99a056ee3a883ff7e0e6f5bc77f87c6.exe
1700	f461b17cf839f10db53155f207682533d99a056ee3a883ff7e0e6f5bc77f87c6.exe
1700	f461b17cf839f10db53155f207682533d99a056ee3a883ff7e0e6f5bc77f87c6.exe
1700	f461b17cf839f10db53155f207682533d99a056ee3a883ff7e0e6f5bc77f87c6.exe
4460	Runtime Broker.exe
4460	Runtime Broker.exe
4460	Runtime Broker.exe
4460	Runtime Broker.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4460	Runtime Broker.exe

Suspicious use of AdjustPrivilegeToken 48 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	1700	f461b17cf839f10db53155f207682533d99a056ee3a883ff7e0e6f5bc77f87c6.exe
Token: SeSecurityPrivilege	1700	f461b17cf839f10db53155f207682533d99a056ee3a883ff7e0e6f5bc77f87c6.exe
Token: SeTakeOwnershipPrivilege	1700	f461b17cf839f10db53155f207682533d99a056ee3a883ff7e0e6f5bc77f87c6.exe
Token: SeLoadDriverPrivilege	1700	f461b17cf839f10db53155f207682533d99a056ee3a883ff7e0e6f5bc77f87c6.exe
Token: SeSystemProfilePrivilege	1700	f461b17cf839f10db53155f207682533d99a056ee3a883ff7e0e6f5bc77f87c6.exe
Token: SeSystemtimePrivilege	1700	f461b17cf839f10db53155f207682533d99a056ee3a883ff7e0e6f5bc77f87c6.exe
Token: SeProfSingleProcessPrivilege	1700	f461b17cf839f10db53155f207682533d99a056ee3a883ff7e0e6f5bc77f87c6.exe
Token: SeIncBasePriorityPrivilege	1700	f461b17cf839f10db53155f207682533d99a056ee3a883ff7e0e6f5bc77f87c6.exe
Token: SeCreatePagefilePrivilege	1700	f461b17cf839f10db53155f207682533d99a056ee3a883ff7e0e6f5bc77f87c6.exe
Token: SeBackupPrivilege	1700	f461b17cf839f10db53155f207682533d99a056ee3a883ff7e0e6f5bc77f87c6.exe
Token: SeRestorePrivilege	1700	f461b17cf839f10db53155f207682533d99a056ee3a883ff7e0e6f5bc77f87c6.exe
Token: SeShutdownPrivilege	1700	f461b17cf839f10db53155f207682533d99a056ee3a883ff7e0e6f5bc77f87c6.exe
Token: SeDebugPrivilege	1700	f461b17cf839f10db53155f207682533d99a056ee3a883ff7e0e6f5bc77f87c6.exe
Token: SeSystemEnvironmentPrivilege	1700	f461b17cf839f10db53155f207682533d99a056ee3a883ff7e0e6f5bc77f87c6.exe
Token: SeChangeNotifyPrivilege	1700	f461b17cf839f10db53155f207682533d99a056ee3a883ff7e0e6f5bc77f87c6.exe
Token: SeRemoteShutdownPrivilege	1700	f461b17cf839f10db53155f207682533d99a056ee3a883ff7e0e6f5bc77f87c6.exe
Token: SeUndockPrivilege	1700	f461b17cf839f10db53155f207682533d99a056ee3a883ff7e0e6f5bc77f87c6.exe
Token: SeManageVolumePrivilege	1700	f461b17cf839f10db53155f207682533d99a056ee3a883ff7e0e6f5bc77f87c6.exe
Token: SeImpersonatePrivilege	1700	f461b17cf839f10db53155f207682533d99a056ee3a883ff7e0e6f5bc77f87c6.exe
Token: SeCreateGlobalPrivilege	1700	f461b17cf839f10db53155f207682533d99a056ee3a883ff7e0e6f5bc77f87c6.exe
Token: 33	1700	f461b17cf839f10db53155f207682533d99a056ee3a883ff7e0e6f5bc77f87c6.exe
Token: 34	1700	f461b17cf839f10db53155f207682533d99a056ee3a883ff7e0e6f5bc77f87c6.exe
Token: 35	1700	f461b17cf839f10db53155f207682533d99a056ee3a883ff7e0e6f5bc77f87c6.exe
Token: 36	1700	f461b17cf839f10db53155f207682533d99a056ee3a883ff7e0e6f5bc77f87c6.exe
Token: SeIncreaseQuotaPrivilege	4460	Runtime Broker.exe
Token: SeSecurityPrivilege	4460	Runtime Broker.exe
Token: SeTakeOwnershipPrivilege	4460	Runtime Broker.exe
Token: SeLoadDriverPrivilege	4460	Runtime Broker.exe
Token: SeSystemProfilePrivilege	4460	Runtime Broker.exe
Token: SeSystemtimePrivilege	4460	Runtime Broker.exe
Token: SeProfSingleProcessPrivilege	4460	Runtime Broker.exe
Token: SeIncBasePriorityPrivilege	4460	Runtime Broker.exe
Token: SeCreatePagefilePrivilege	4460	Runtime Broker.exe
Token: SeBackupPrivilege	4460	Runtime Broker.exe
Token: SeRestorePrivilege	4460	Runtime Broker.exe
Token: SeShutdownPrivilege	4460	Runtime Broker.exe
Token: SeDebugPrivilege	4460	Runtime Broker.exe
Token: SeSystemEnvironmentPrivilege	4460	Runtime Broker.exe
Token: SeChangeNotifyPrivilege	4460	Runtime Broker.exe
Token: SeRemoteShutdownPrivilege	4460	Runtime Broker.exe
Token: SeUndockPrivilege	4460	Runtime Broker.exe
Token: SeManageVolumePrivilege	4460	Runtime Broker.exe
Token: SeImpersonatePrivilege	4460	Runtime Broker.exe
Token: SeCreateGlobalPrivilege	4460	Runtime Broker.exe
Token: 33	4460	Runtime Broker.exe
Token: 34	4460	Runtime Broker.exe
Token: 35	4460	Runtime Broker.exe
Token: 36	4460	Runtime Broker.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4460	Runtime Broker.exe

Suspicious use of WriteProcessMemory 42 IoCs

description	pid	Process	procid_target
PID 1700 wrote to memory of 3800	1700	f461b17cf839f10db53155f207682533d99a056ee3a883ff7e0e6f5bc77f87c6.exe	88
PID 1700 wrote to memory of 3800	1700	f461b17cf839f10db53155f207682533d99a056ee3a883ff7e0e6f5bc77f87c6.exe	88
PID 1700 wrote to memory of 3800	1700	f461b17cf839f10db53155f207682533d99a056ee3a883ff7e0e6f5bc77f87c6.exe	88
PID 1700 wrote to memory of 2068	1700	f461b17cf839f10db53155f207682533d99a056ee3a883ff7e0e6f5bc77f87c6.exe	90
PID 1700 wrote to memory of 2068	1700	f461b17cf839f10db53155f207682533d99a056ee3a883ff7e0e6f5bc77f87c6.exe	90
PID 1700 wrote to memory of 2068	1700	f461b17cf839f10db53155f207682533d99a056ee3a883ff7e0e6f5bc77f87c6.exe	90
PID 1700 wrote to memory of 4460	1700	f461b17cf839f10db53155f207682533d99a056ee3a883ff7e0e6f5bc77f87c6.exe	92
PID 1700 wrote to memory of 4460	1700	f461b17cf839f10db53155f207682533d99a056ee3a883ff7e0e6f5bc77f87c6.exe	92
PID 1700 wrote to memory of 4460	1700	f461b17cf839f10db53155f207682533d99a056ee3a883ff7e0e6f5bc77f87c6.exe	92
PID 2068 wrote to memory of 2056	2068	cmd.exe	93
PID 2068 wrote to memory of 2056	2068	cmd.exe	93
PID 2068 wrote to memory of 2056	2068	cmd.exe	93
PID 3800 wrote to memory of 2416	3800	cmd.exe	94
PID 3800 wrote to memory of 2416	3800	cmd.exe	94
PID 3800 wrote to memory of 2416	3800	cmd.exe	94
PID 4460 wrote to memory of 3996	4460	Runtime Broker.exe	97
PID 4460 wrote to memory of 3996	4460	Runtime Broker.exe	97
PID 4460 wrote to memory of 3996	4460	Runtime Broker.exe	97
PID 4460 wrote to memory of 3180	4460	Runtime Broker.exe	98
PID 4460 wrote to memory of 3180	4460	Runtime Broker.exe	98
PID 4460 wrote to memory of 3108	4460	Runtime Broker.exe	99
PID 4460 wrote to memory of 3108	4460	Runtime Broker.exe	99
PID 4460 wrote to memory of 3108	4460	Runtime Broker.exe	99
PID 4460 wrote to memory of 3108	4460	Runtime Broker.exe	99
PID 4460 wrote to memory of 3108	4460	Runtime Broker.exe	99
PID 4460 wrote to memory of 3108	4460	Runtime Broker.exe	99
PID 4460 wrote to memory of 3108	4460	Runtime Broker.exe	99
PID 4460 wrote to memory of 3108	4460	Runtime Broker.exe	99
PID 4460 wrote to memory of 3108	4460	Runtime Broker.exe	99
PID 4460 wrote to memory of 3108	4460	Runtime Broker.exe	99
PID 4460 wrote to memory of 3108	4460	Runtime Broker.exe	99
PID 4460 wrote to memory of 3108	4460	Runtime Broker.exe	99
PID 4460 wrote to memory of 3108	4460	Runtime Broker.exe	99
PID 4460 wrote to memory of 3108	4460	Runtime Broker.exe	99
PID 4460 wrote to memory of 3108	4460	Runtime Broker.exe	99
PID 4460 wrote to memory of 3108	4460	Runtime Broker.exe	99
PID 4460 wrote to memory of 3108	4460	Runtime Broker.exe	99
PID 4460 wrote to memory of 3108	4460	Runtime Broker.exe	99
PID 4460 wrote to memory of 3108	4460	Runtime Broker.exe	99
PID 4460 wrote to memory of 3108	4460	Runtime Broker.exe	99
PID 4460 wrote to memory of 3108	4460	Runtime Broker.exe	99
PID 4460 wrote to memory of 3108	4460	Runtime Broker.exe	99

Views/modifies file attributes 1 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1564.001

pid	Process
2056	attrib.exe
2416	attrib.exe

C:\Users\Admin\AppData\Local\Temp\f461b17cf839f10db53155f207682533d99a056ee3a883ff7e0e6f5bc77f87c6.exe
"C:\Users\Admin\AppData\Local\Temp\f461b17cf839f10db53155f207682533d99a056ee3a883ff7e0e6f5bc77f87c6.exe"
1⤵
- Modifies WinLogon for persistence
- Checks computer location settings
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1700
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp\f461b17cf839f10db53155f207682533d99a056ee3a883ff7e0e6f5bc77f87c6.exe" +s +h
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3800
- - C:\Windows\SysWOW64\attrib.exe
    attrib "C:\Users\Admin\AppData\Local\Temp\f461b17cf839f10db53155f207682533d99a056ee3a883ff7e0e6f5bc77f87c6.exe" +s +h
    3⤵
    - Sets file to hidden
    - Views/modifies file attributes
    PID:2416
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp" +s +h
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2068
- - C:\Windows\SysWOW64\attrib.exe
    attrib "C:\Users\Admin\AppData\Local\Temp" +s +h
    3⤵
    - Sets file to hidden
    - Views/modifies file attributes
    PID:2056
- C:\Windows\SysWOW64\Runtime Broker.exe
  "C:\Windows\system32\Runtime Broker.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4460
- - C:\Program Files (x86)\Internet Explorer\iexplore.exe
    "C:\Program Files (x86)\Internet Explorer\iexplore.exe"
    3⤵
    PID:3996
- - C:\Windows\explorer.exe
    "C:\Windows\explorer.exe"
    3⤵
    PID:3180
- - C:\Windows\SysWOW64\notepad.exe
    notepad
    3⤵
    PID:3108

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Runtime Broker.exe

Path C:\Windows\SysWOW64\Runtime Broker.exe
Size 5.4MB
SHA256 f461b17cf839f10db53155f207682533d99a056ee3a883ff7e0e6f5bc77f87c6
MD5 616fd2b3429b816fc7ebc62d103cc995
SHA1 5a202f24dda9c7b9407b1bc41c27a84c29ea964f
SHA512 a0c1a065d6d6b18127c92597baccbcd4fd2136eee4462182899a928c163a2adad065ceabd6a12bf369a8e5ceafb318c29782100ebfc3e63e014602b7253d1bc2
SSDEEP 98304:9uv8pxJvkLXr8+VOOrjL6eRhzvBG40st9Rl0E4dV0Q89XbrnH:9dY4+QOrjpRhzBL0K9H05dCQwH
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1700-25-0x0000000000400000-0x0000000000D3E000-memory.dmp

Download

memory/1700-7-0x0000000002C30000-0x0000000002C31000-memory.dmp

Download

memory/1700-3-0x0000000002AE0000-0x0000000002AE1000-memory.dmp

Download

memory/1700-4-0x0000000002AF0000-0x0000000002AF1000-memory.dmp

Download

memory/1700-5-0x0000000002B00000-0x0000000002B01000-memory.dmp

Download

memory/1700-6-0x0000000002B10000-0x0000000002B11000-memory.dmp

Download

memory/1700-0-0x0000000000400000-0x0000000000D3E000-memory.dmp

Download

memory/1700-8-0x0000000002C40000-0x0000000002C41000-memory.dmp

Download

memory/1700-9-0x0000000000400000-0x0000000000D3E000-memory.dmp

Download

memory/1700-11-0x0000000002C80000-0x0000000002C81000-memory.dmp

Download

memory/1700-2-0x0000000002AB0000-0x0000000002AB1000-memory.dmp

Download

memory/1700-1-0x0000000002AA0000-0x0000000002AA1000-memory.dmp

Download

memory/3108-38-0x0000000000FA0000-0x0000000000FA1000-memory.dmp

Download

memory/4460-31-0x0000000002C30000-0x0000000002C31000-memory.dmp

Download

memory/4460-28-0x0000000002BF0000-0x0000000002BF1000-memory.dmp

Download

memory/4460-26-0x0000000002BB0000-0x0000000002BB1000-memory.dmp

Download

memory/4460-29-0x0000000002C10000-0x0000000002C11000-memory.dmp

Download

memory/4460-27-0x0000000002BC0000-0x0000000002BC1000-memory.dmp

Download

memory/4460-30-0x0000000002C20000-0x0000000002C21000-memory.dmp

Download

memory/4460-34-0x0000000002C50000-0x0000000002C51000-memory.dmp

Download

memory/4460-33-0x0000000002C40000-0x0000000002C41000-memory.dmp

Download

memory/4460-35-0x0000000000400000-0x0000000000D3E000-memory.dmp

Download

memory/4460-37-0x0000000003280000-0x0000000003281000-memory.dmp

Download

memory/4460-39-0x0000000000400000-0x0000000000D3E000-memory.dmp

Download