darkcomet | 625720018417b027bbda97cc50e80288029503009457e911d51ba9590ede4c82

General

Target

acf05449c06970a54cc36fc7412f025f2c80c577d7ce3073b18fba70b39fb7f6.exe
Size

852KB
MD5

142b6a00a17c3f7853f4cfeebfe72c13
SHA1

799ea8e4a8295d0018e81fa910fe3e3e734237da
SHA256

acf05449c06970a54cc36fc7412f025f2c80c577d7ce3073b18fba70b39fb7f6
SHA512

761fb7c01fc53a2e260876d3e51e48b740ed86562e3505a4195fc2e89cd86762f76b725a7c267c439986515a7ca3b194f3367da3fdefafb47dd852b264f2d521
SSDEEP

12288:MMM0D0t0S0O0Sv8Di0BRtIwrfLDEDEOjX7kmW:NxgSfrvDi0BDIwrERnk7

Score

10^/10

darkcomet rat trojan upx

Malware Config

Signatures

Darkcomet
DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
trojan rat darkcomet

Drops startup file 3 IoCs

Processes:

acf05449c06970a54cc36fc7412f025f2c80c577d7ce3073b18fba70b39fb7f6.exe.exe

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\.exe	acf05449c06970a54cc36fc7412f025f2c80c577d7ce3073b18fba70b39fb7f6.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\.exe	acf05449c06970a54cc36fc7412f025f2c80c577d7ce3073b18fba70b39fb7f6.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\.exe	.exe

Executes dropped EXE 2 IoCs

Processes:

.exe.exe

pid	Process
2176	.exe
4424	.exe

UPX packed file 17 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral2/memory/4424-9-0x0000000000400000-0x00000000004B8000-memory.dmp	upx
behavioral2/memory/4424-11-0x0000000000400000-0x00000000004B8000-memory.dmp	upx
behavioral2/memory/4424-12-0x0000000000400000-0x00000000004B8000-memory.dmp	upx
behavioral2/memory/4424-13-0x0000000000400000-0x00000000004B8000-memory.dmp	upx
behavioral2/memory/4424-14-0x0000000000400000-0x00000000004B8000-memory.dmp	upx
behavioral2/memory/4424-16-0x0000000000400000-0x00000000004B8000-memory.dmp	upx
behavioral2/memory/4424-18-0x0000000000400000-0x00000000004B8000-memory.dmp	upx
behavioral2/memory/4424-17-0x0000000000400000-0x00000000004B8000-memory.dmp	upx
behavioral2/memory/4424-19-0x0000000000400000-0x00000000004B8000-memory.dmp	upx
behavioral2/memory/4424-21-0x0000000000400000-0x00000000004B8000-memory.dmp	upx
behavioral2/memory/4424-25-0x0000000000400000-0x00000000004B8000-memory.dmp	upx
behavioral2/memory/4424-28-0x0000000000400000-0x00000000004B8000-memory.dmp	upx
behavioral2/memory/4424-32-0x0000000000400000-0x00000000004B8000-memory.dmp	upx
behavioral2/memory/4424-36-0x0000000000400000-0x00000000004B8000-memory.dmp	upx
behavioral2/memory/4424-39-0x0000000000400000-0x00000000004B8000-memory.dmp	upx
behavioral2/memory/4424-43-0x0000000000400000-0x00000000004B8000-memory.dmp	upx
behavioral2/memory/4424-46-0x0000000000400000-0x00000000004B8000-memory.dmp	upx

Suspicious use of SetThreadContext 1 IoCs

Processes:

.exe

description	pid	Process	procid_target
PID 2176 set thread context of 4424	2176	.exe	89

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 24 IoCs

Processes:

.exe

description	pid	Process
Token: SeIncreaseQuotaPrivilege	4424	.exe
Token: SeSecurityPrivilege	4424	.exe
Token: SeTakeOwnershipPrivilege	4424	.exe
Token: SeLoadDriverPrivilege	4424	.exe
Token: SeSystemProfilePrivilege	4424	.exe
Token: SeSystemtimePrivilege	4424	.exe
Token: SeProfSingleProcessPrivilege	4424	.exe
Token: SeIncBasePriorityPrivilege	4424	.exe
Token: SeCreatePagefilePrivilege	4424	.exe
Token: SeBackupPrivilege	4424	.exe
Token: SeRestorePrivilege	4424	.exe
Token: SeShutdownPrivilege	4424	.exe
Token: SeDebugPrivilege	4424	.exe
Token: SeSystemEnvironmentPrivilege	4424	.exe
Token: SeChangeNotifyPrivilege	4424	.exe
Token: SeRemoteShutdownPrivilege	4424	.exe
Token: SeUndockPrivilege	4424	.exe
Token: SeManageVolumePrivilege	4424	.exe
Token: SeImpersonatePrivilege	4424	.exe
Token: SeCreateGlobalPrivilege	4424	.exe
Token: 33	4424	.exe
Token: 34	4424	.exe
Token: 35	4424	.exe
Token: 36	4424	.exe

Suspicious use of SetWindowsHookEx 3 IoCs

Processes:

acf05449c06970a54cc36fc7412f025f2c80c577d7ce3073b18fba70b39fb7f6.exe.exe.exe

pid	Process
3812	acf05449c06970a54cc36fc7412f025f2c80c577d7ce3073b18fba70b39fb7f6.exe
2176	.exe
4424	.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

acf05449c06970a54cc36fc7412f025f2c80c577d7ce3073b18fba70b39fb7f6.exe.exe

description	pid	Process	procid_target
PID 3812 wrote to memory of 2176	3812	acf05449c06970a54cc36fc7412f025f2c80c577d7ce3073b18fba70b39fb7f6.exe	86
PID 3812 wrote to memory of 2176	3812	acf05449c06970a54cc36fc7412f025f2c80c577d7ce3073b18fba70b39fb7f6.exe	86
PID 3812 wrote to memory of 2176	3812	acf05449c06970a54cc36fc7412f025f2c80c577d7ce3073b18fba70b39fb7f6.exe	86
PID 2176 wrote to memory of 4424	2176	.exe	89
PID 2176 wrote to memory of 4424	2176	.exe	89
PID 2176 wrote to memory of 4424	2176	.exe	89
PID 2176 wrote to memory of 4424	2176	.exe	89
PID 2176 wrote to memory of 4424	2176	.exe	89
PID 2176 wrote to memory of 4424	2176	.exe	89
PID 2176 wrote to memory of 4424	2176	.exe	89
PID 2176 wrote to memory of 4424	2176	.exe	89

C:\Users\Admin\AppData\Local\Temp\acf05449c06970a54cc36fc7412f025f2c80c577d7ce3073b18fba70b39fb7f6.exe
"C:\Users\Admin\AppData\Local\Temp\acf05449c06970a54cc36fc7412f025f2c80c577d7ce3073b18fba70b39fb7f6.exe"
1⤵
- Drops startup file
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3812
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\.exe"
  2⤵
  - Drops startup file
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2176
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    PID:4424

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\.exe

Filesize
852KB

MD5
142b6a00a17c3f7853f4cfeebfe72c13

SHA1
799ea8e4a8295d0018e81fa910fe3e3e734237da

SHA256
acf05449c06970a54cc36fc7412f025f2c80c577d7ce3073b18fba70b39fb7f6

SHA512
761fb7c01fc53a2e260876d3e51e48b740ed86562e3505a4195fc2e89cd86762f76b725a7c267c439986515a7ca3b194f3367da3fdefafb47dd852b264f2d521

Download Submit
memory/4424-9-0x0000000000400000-0x00000000004B8000-memory.dmp

Filesize
736KB

Download
memory/4424-11-0x0000000000400000-0x00000000004B8000-memory.dmp

Filesize
736KB

Download
memory/4424-12-0x0000000000400000-0x00000000004B8000-memory.dmp

Filesize
736KB

Download
memory/4424-13-0x0000000000400000-0x00000000004B8000-memory.dmp

Filesize
736KB

Download
memory/4424-14-0x0000000000400000-0x00000000004B8000-memory.dmp

Filesize
736KB

Download
memory/4424-15-0x0000000000B10000-0x0000000000B11000-memory.dmp

Filesize
4KB

Download
memory/4424-16-0x0000000000400000-0x00000000004B8000-memory.dmp

Filesize
736KB

Download
memory/4424-18-0x0000000000400000-0x00000000004B8000-memory.dmp

Filesize
736KB

Download
memory/4424-17-0x0000000000400000-0x00000000004B8000-memory.dmp

Filesize
736KB

Download
memory/4424-19-0x0000000000400000-0x00000000004B8000-memory.dmp

Filesize
736KB

Download
memory/4424-21-0x0000000000400000-0x00000000004B8000-memory.dmp

Filesize
736KB

Download
memory/4424-25-0x0000000000400000-0x00000000004B8000-memory.dmp

Filesize
736KB

Download
memory/4424-28-0x0000000000400000-0x00000000004B8000-memory.dmp

Filesize
736KB

Download
memory/4424-32-0x0000000000400000-0x00000000004B8000-memory.dmp

Filesize
736KB

Download
memory/4424-36-0x0000000000400000-0x00000000004B8000-memory.dmp

Filesize
736KB

Download
memory/4424-39-0x0000000000400000-0x00000000004B8000-memory.dmp

Filesize
736KB

Download
memory/4424-43-0x0000000000400000-0x00000000004B8000-memory.dmp

Filesize
736KB

Download
memory/4424-46-0x0000000000400000-0x00000000004B8000-memory.dmp

Filesize
736KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads