darkcomet | 625720018417b027bbda97cc50e80288029503009457e911d51ba9590ede4c82

General

Target

acf05449c06970a54cc36fc7412f025f2c80c577d7ce3073b18fba70b39fb7f6.exe
Size

852KB
MD5

142b6a00a17c3f7853f4cfeebfe72c13
SHA1

799ea8e4a8295d0018e81fa910fe3e3e734237da
SHA256

acf05449c06970a54cc36fc7412f025f2c80c577d7ce3073b18fba70b39fb7f6
SHA512

761fb7c01fc53a2e260876d3e51e48b740ed86562e3505a4195fc2e89cd86762f76b725a7c267c439986515a7ca3b194f3367da3fdefafb47dd852b264f2d521
SSDEEP

12288:MMM0D0t0S0O0Sv8Di0BRtIwrfLDEDEOjX7kmW:NxgSfrvDi0BDIwrERnk7

Score

10^/10

darkcomet rat trojan upx

Malware Config

Signatures

Darkcomet
DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
trojan rat darkcomet

Drops startup file 3 IoCs

Processes:

acf05449c06970a54cc36fc7412f025f2c80c577d7ce3073b18fba70b39fb7f6.exe.exe

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\.exe	acf05449c06970a54cc36fc7412f025f2c80c577d7ce3073b18fba70b39fb7f6.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\.exe	acf05449c06970a54cc36fc7412f025f2c80c577d7ce3073b18fba70b39fb7f6.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\.exe	.exe

Executes dropped EXE 2 IoCs

Processes:

.exe.exe

pid	Process
2196	.exe
2716	.exe

Loads dropped DLL 3 IoCs

Processes:

acf05449c06970a54cc36fc7412f025f2c80c577d7ce3073b18fba70b39fb7f6.exe.exe

pid	Process
1900	acf05449c06970a54cc36fc7412f025f2c80c577d7ce3073b18fba70b39fb7f6.exe
1900	acf05449c06970a54cc36fc7412f025f2c80c577d7ce3073b18fba70b39fb7f6.exe
2196	.exe

UPX packed file 20 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral1/memory/2716-17-0x0000000000400000-0x00000000004B8000-memory.dmp	upx
behavioral1/memory/2716-19-0x0000000000400000-0x00000000004B8000-memory.dmp	upx
behavioral1/memory/2716-23-0x0000000000400000-0x00000000004B8000-memory.dmp	upx
behavioral1/memory/2716-26-0x0000000000400000-0x00000000004B8000-memory.dmp	upx
behavioral1/memory/2716-27-0x0000000000400000-0x00000000004B8000-memory.dmp	upx
behavioral1/memory/2716-29-0x0000000000400000-0x00000000004B8000-memory.dmp	upx
behavioral1/memory/2716-28-0x0000000000400000-0x00000000004B8000-memory.dmp	upx
behavioral1/memory/2716-30-0x0000000000400000-0x00000000004B8000-memory.dmp	upx
behavioral1/memory/2716-32-0x0000000000400000-0x00000000004B8000-memory.dmp	upx
behavioral1/memory/2716-33-0x0000000000400000-0x00000000004B8000-memory.dmp	upx
behavioral1/memory/2716-34-0x0000000000400000-0x00000000004B8000-memory.dmp	upx
behavioral1/memory/2716-35-0x0000000000400000-0x00000000004B8000-memory.dmp	upx
behavioral1/memory/2716-37-0x0000000000400000-0x00000000004B8000-memory.dmp	upx
behavioral1/memory/2716-41-0x0000000000400000-0x00000000004B8000-memory.dmp	upx
behavioral1/memory/2716-44-0x0000000000400000-0x00000000004B8000-memory.dmp	upx
behavioral1/memory/2716-48-0x0000000000400000-0x00000000004B8000-memory.dmp	upx
behavioral1/memory/2716-52-0x0000000000400000-0x00000000004B8000-memory.dmp	upx
behavioral1/memory/2716-55-0x0000000000400000-0x00000000004B8000-memory.dmp	upx
behavioral1/memory/2716-59-0x0000000000400000-0x00000000004B8000-memory.dmp	upx
behavioral1/memory/2716-62-0x0000000000400000-0x00000000004B8000-memory.dmp	upx

Suspicious use of SetThreadContext 1 IoCs

Processes:

.exe

description	pid	Process	procid_target
PID 2196 set thread context of 2716	2196	.exe	29

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 23 IoCs

Processes:

.exe

description	pid	Process
Token: SeIncreaseQuotaPrivilege	2716	.exe
Token: SeSecurityPrivilege	2716	.exe
Token: SeTakeOwnershipPrivilege	2716	.exe
Token: SeLoadDriverPrivilege	2716	.exe
Token: SeSystemProfilePrivilege	2716	.exe
Token: SeSystemtimePrivilege	2716	.exe
Token: SeProfSingleProcessPrivilege	2716	.exe
Token: SeIncBasePriorityPrivilege	2716	.exe
Token: SeCreatePagefilePrivilege	2716	.exe
Token: SeBackupPrivilege	2716	.exe
Token: SeRestorePrivilege	2716	.exe
Token: SeShutdownPrivilege	2716	.exe
Token: SeDebugPrivilege	2716	.exe
Token: SeSystemEnvironmentPrivilege	2716	.exe
Token: SeChangeNotifyPrivilege	2716	.exe
Token: SeRemoteShutdownPrivilege	2716	.exe
Token: SeUndockPrivilege	2716	.exe
Token: SeManageVolumePrivilege	2716	.exe
Token: SeImpersonatePrivilege	2716	.exe
Token: SeCreateGlobalPrivilege	2716	.exe
Token: 33	2716	.exe
Token: 34	2716	.exe
Token: 35	2716	.exe

Suspicious use of SetWindowsHookEx 3 IoCs

Processes:

acf05449c06970a54cc36fc7412f025f2c80c577d7ce3073b18fba70b39fb7f6.exe.exe.exe

pid	Process
1900	acf05449c06970a54cc36fc7412f025f2c80c577d7ce3073b18fba70b39fb7f6.exe
2196	.exe
2716	.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

acf05449c06970a54cc36fc7412f025f2c80c577d7ce3073b18fba70b39fb7f6.exe.exe

description	pid	Process	procid_target
PID 1900 wrote to memory of 2196	1900	acf05449c06970a54cc36fc7412f025f2c80c577d7ce3073b18fba70b39fb7f6.exe	28
PID 1900 wrote to memory of 2196	1900	acf05449c06970a54cc36fc7412f025f2c80c577d7ce3073b18fba70b39fb7f6.exe	28
PID 1900 wrote to memory of 2196	1900	acf05449c06970a54cc36fc7412f025f2c80c577d7ce3073b18fba70b39fb7f6.exe	28
PID 1900 wrote to memory of 2196	1900	acf05449c06970a54cc36fc7412f025f2c80c577d7ce3073b18fba70b39fb7f6.exe	28
PID 2196 wrote to memory of 2716	2196	.exe	29
PID 2196 wrote to memory of 2716	2196	.exe	29
PID 2196 wrote to memory of 2716	2196	.exe	29
PID 2196 wrote to memory of 2716	2196	.exe	29
PID 2196 wrote to memory of 2716	2196	.exe	29
PID 2196 wrote to memory of 2716	2196	.exe	29
PID 2196 wrote to memory of 2716	2196	.exe	29
PID 2196 wrote to memory of 2716	2196	.exe	29

C:\Users\Admin\AppData\Local\Temp\acf05449c06970a54cc36fc7412f025f2c80c577d7ce3073b18fba70b39fb7f6.exe
"C:\Users\Admin\AppData\Local\Temp\acf05449c06970a54cc36fc7412f025f2c80c577d7ce3073b18fba70b39fb7f6.exe"
1⤵
- Drops startup file
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1900
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\.exe"
  2⤵
  - Drops startup file
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetThreadContext
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2196
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    PID:2716

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\.exe

Filesize
852KB

MD5
142b6a00a17c3f7853f4cfeebfe72c13

SHA1
799ea8e4a8295d0018e81fa910fe3e3e734237da

SHA256
acf05449c06970a54cc36fc7412f025f2c80c577d7ce3073b18fba70b39fb7f6

SHA512
761fb7c01fc53a2e260876d3e51e48b740ed86562e3505a4195fc2e89cd86762f76b725a7c267c439986515a7ca3b194f3367da3fdefafb47dd852b264f2d521

Download Submit
memory/2716-17-0x0000000000400000-0x00000000004B8000-memory.dmp

Filesize
736KB

Download
memory/2716-15-0x0000000000400000-0x00000000004B8000-memory.dmp

Filesize
736KB

Download
memory/2716-19-0x0000000000400000-0x00000000004B8000-memory.dmp

Filesize
736KB

Download
memory/2716-23-0x0000000000400000-0x00000000004B8000-memory.dmp

Filesize
736KB

Download
memory/2716-21-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2716-26-0x0000000000400000-0x00000000004B8000-memory.dmp

Filesize
736KB

Download
memory/2716-27-0x0000000000400000-0x00000000004B8000-memory.dmp

Filesize
736KB

Download
memory/2716-29-0x0000000000400000-0x00000000004B8000-memory.dmp

Filesize
736KB

Download
memory/2716-28-0x0000000000400000-0x00000000004B8000-memory.dmp

Filesize
736KB

Download
memory/2716-30-0x0000000000400000-0x00000000004B8000-memory.dmp

Filesize
736KB

Download
memory/2716-31-0x00000000003C0000-0x00000000003C1000-memory.dmp

Filesize
4KB

Download
memory/2716-32-0x0000000000400000-0x00000000004B8000-memory.dmp

Filesize
736KB

Download
memory/2716-33-0x0000000000400000-0x00000000004B8000-memory.dmp

Filesize
736KB

Download
memory/2716-34-0x0000000000400000-0x00000000004B8000-memory.dmp

Filesize
736KB

Download
memory/2716-35-0x0000000000400000-0x00000000004B8000-memory.dmp

Filesize
736KB

Download
memory/2716-37-0x0000000000400000-0x00000000004B8000-memory.dmp

Filesize
736KB

Download
memory/2716-41-0x0000000000400000-0x00000000004B8000-memory.dmp

Filesize
736KB

Download
memory/2716-44-0x0000000000400000-0x00000000004B8000-memory.dmp

Filesize
736KB

Download
memory/2716-48-0x0000000000400000-0x00000000004B8000-memory.dmp

Filesize
736KB

Download
memory/2716-52-0x0000000000400000-0x00000000004B8000-memory.dmp

Filesize
736KB

Download
memory/2716-55-0x0000000000400000-0x00000000004B8000-memory.dmp

Filesize
736KB

Download
memory/2716-59-0x0000000000400000-0x00000000004B8000-memory.dmp

Filesize
736KB

Download
memory/2716-62-0x0000000000400000-0x00000000004B8000-memory.dmp

Filesize
736KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads