darkcomet | 9bee27b268c35b46a2cd109a4f743af3a664e0a84443d2cd08b1f9a089db559f

General

Target

acf05449c06970a54cc36fc7412f025f2c80c577d7ce3073b18fba70b39fb7f6.exe
Size

852KB
MD5

142b6a00a17c3f7853f4cfeebfe72c13
SHA1

799ea8e4a8295d0018e81fa910fe3e3e734237da
SHA256

acf05449c06970a54cc36fc7412f025f2c80c577d7ce3073b18fba70b39fb7f6
SHA512

761fb7c01fc53a2e260876d3e51e48b740ed86562e3505a4195fc2e89cd86762f76b725a7c267c439986515a7ca3b194f3367da3fdefafb47dd852b264f2d521
SSDEEP

12288:MMM0D0t0S0O0Sv8Di0BRtIwrfLDEDEOjX7kmW:NxgSfrvDi0BDIwrERnk7

Score

10^/10

darkcomet rat trojan upx

Malware Config

Signatures

Darkcomet
DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
trojan rat darkcomet

Drops startup file 3 IoCs

Processes:

acf05449c06970a54cc36fc7412f025f2c80c577d7ce3073b18fba70b39fb7f6.exe.exe

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\.exe	acf05449c06970a54cc36fc7412f025f2c80c577d7ce3073b18fba70b39fb7f6.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\.exe	acf05449c06970a54cc36fc7412f025f2c80c577d7ce3073b18fba70b39fb7f6.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\.exe	.exe

Executes dropped EXE 2 IoCs

Processes:

.exe.exe

pid	Process
3916	.exe
2836	.exe

UPX packed file 17 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral2/memory/2836-9-0x0000000000400000-0x00000000004B8000-memory.dmp	upx
behavioral2/memory/2836-12-0x0000000000400000-0x00000000004B8000-memory.dmp	upx
behavioral2/memory/2836-13-0x0000000000400000-0x00000000004B8000-memory.dmp	upx
behavioral2/memory/2836-14-0x0000000000400000-0x00000000004B8000-memory.dmp	upx
behavioral2/memory/2836-15-0x0000000000400000-0x00000000004B8000-memory.dmp	upx
behavioral2/memory/2836-18-0x0000000000400000-0x00000000004B8000-memory.dmp	upx
behavioral2/memory/2836-17-0x0000000000400000-0x00000000004B8000-memory.dmp	upx
behavioral2/memory/2836-19-0x0000000000400000-0x00000000004B8000-memory.dmp	upx
behavioral2/memory/2836-20-0x0000000000400000-0x00000000004B8000-memory.dmp	upx
behavioral2/memory/2836-22-0x0000000000400000-0x00000000004B8000-memory.dmp	upx
behavioral2/memory/2836-27-0x0000000000400000-0x00000000004B8000-memory.dmp	upx
behavioral2/memory/2836-30-0x0000000000400000-0x00000000004B8000-memory.dmp	upx
behavioral2/memory/2836-34-0x0000000000400000-0x00000000004B8000-memory.dmp	upx
behavioral2/memory/2836-38-0x0000000000400000-0x00000000004B8000-memory.dmp	upx
behavioral2/memory/2836-41-0x0000000000400000-0x00000000004B8000-memory.dmp	upx
behavioral2/memory/2836-45-0x0000000000400000-0x00000000004B8000-memory.dmp	upx
behavioral2/memory/2836-48-0x0000000000400000-0x00000000004B8000-memory.dmp	upx

Suspicious use of SetThreadContext 1 IoCs

Processes:

.exe

description	pid	Process	procid_target
PID 3916 set thread context of 2836	3916	.exe	90

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 24 IoCs

Processes:

.exe

description	pid	Process
Token: SeIncreaseQuotaPrivilege	2836	.exe
Token: SeSecurityPrivilege	2836	.exe
Token: SeTakeOwnershipPrivilege	2836	.exe
Token: SeLoadDriverPrivilege	2836	.exe
Token: SeSystemProfilePrivilege	2836	.exe
Token: SeSystemtimePrivilege	2836	.exe
Token: SeProfSingleProcessPrivilege	2836	.exe
Token: SeIncBasePriorityPrivilege	2836	.exe
Token: SeCreatePagefilePrivilege	2836	.exe
Token: SeBackupPrivilege	2836	.exe
Token: SeRestorePrivilege	2836	.exe
Token: SeShutdownPrivilege	2836	.exe
Token: SeDebugPrivilege	2836	.exe
Token: SeSystemEnvironmentPrivilege	2836	.exe
Token: SeChangeNotifyPrivilege	2836	.exe
Token: SeRemoteShutdownPrivilege	2836	.exe
Token: SeUndockPrivilege	2836	.exe
Token: SeManageVolumePrivilege	2836	.exe
Token: SeImpersonatePrivilege	2836	.exe
Token: SeCreateGlobalPrivilege	2836	.exe
Token: 33	2836	.exe
Token: 34	2836	.exe
Token: 35	2836	.exe
Token: 36	2836	.exe

Suspicious use of SetWindowsHookEx 3 IoCs

Processes:

acf05449c06970a54cc36fc7412f025f2c80c577d7ce3073b18fba70b39fb7f6.exe.exe.exe

pid	Process
5036	acf05449c06970a54cc36fc7412f025f2c80c577d7ce3073b18fba70b39fb7f6.exe
3916	.exe
2836	.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

acf05449c06970a54cc36fc7412f025f2c80c577d7ce3073b18fba70b39fb7f6.exe.exe

description	pid	Process	procid_target
PID 5036 wrote to memory of 3916	5036	acf05449c06970a54cc36fc7412f025f2c80c577d7ce3073b18fba70b39fb7f6.exe	86
PID 5036 wrote to memory of 3916	5036	acf05449c06970a54cc36fc7412f025f2c80c577d7ce3073b18fba70b39fb7f6.exe	86
PID 5036 wrote to memory of 3916	5036	acf05449c06970a54cc36fc7412f025f2c80c577d7ce3073b18fba70b39fb7f6.exe	86
PID 3916 wrote to memory of 2836	3916	.exe	90
PID 3916 wrote to memory of 2836	3916	.exe	90
PID 3916 wrote to memory of 2836	3916	.exe	90
PID 3916 wrote to memory of 2836	3916	.exe	90
PID 3916 wrote to memory of 2836	3916	.exe	90
PID 3916 wrote to memory of 2836	3916	.exe	90
PID 3916 wrote to memory of 2836	3916	.exe	90
PID 3916 wrote to memory of 2836	3916	.exe	90

C:\Users\Admin\AppData\Local\Temp\acf05449c06970a54cc36fc7412f025f2c80c577d7ce3073b18fba70b39fb7f6.exe
"C:\Users\Admin\AppData\Local\Temp\acf05449c06970a54cc36fc7412f025f2c80c577d7ce3073b18fba70b39fb7f6.exe"
1⤵
- Drops startup file
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5036
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\.exe"
  2⤵
  - Drops startup file
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3916
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    PID:2836

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\.exe

Filesize
852KB

MD5
142b6a00a17c3f7853f4cfeebfe72c13

SHA1
799ea8e4a8295d0018e81fa910fe3e3e734237da

SHA256
acf05449c06970a54cc36fc7412f025f2c80c577d7ce3073b18fba70b39fb7f6

SHA512
761fb7c01fc53a2e260876d3e51e48b740ed86562e3505a4195fc2e89cd86762f76b725a7c267c439986515a7ca3b194f3367da3fdefafb47dd852b264f2d521

Download Submit
memory/2836-9-0x0000000000400000-0x00000000004B8000-memory.dmp

Filesize
736KB

Download
memory/2836-12-0x0000000000400000-0x00000000004B8000-memory.dmp

Filesize
736KB

Download
memory/2836-13-0x0000000000400000-0x00000000004B8000-memory.dmp

Filesize
736KB

Download
memory/2836-14-0x0000000000400000-0x00000000004B8000-memory.dmp

Filesize
736KB

Download
memory/2836-15-0x0000000000400000-0x00000000004B8000-memory.dmp

Filesize
736KB

Download
memory/2836-16-0x00000000022C0000-0x00000000022C1000-memory.dmp

Filesize
4KB

Download
memory/2836-18-0x0000000000400000-0x00000000004B8000-memory.dmp

Filesize
736KB

Download
memory/2836-17-0x0000000000400000-0x00000000004B8000-memory.dmp

Filesize
736KB

Download
memory/2836-19-0x0000000000400000-0x00000000004B8000-memory.dmp

Filesize
736KB

Download
memory/2836-20-0x0000000000400000-0x00000000004B8000-memory.dmp

Filesize
736KB

Download
memory/2836-22-0x0000000000400000-0x00000000004B8000-memory.dmp

Filesize
736KB

Download
memory/2836-24-0x00000000022C0000-0x00000000022C1000-memory.dmp

Filesize
4KB

Download
memory/2836-27-0x0000000000400000-0x00000000004B8000-memory.dmp

Filesize
736KB

Download
memory/2836-30-0x0000000000400000-0x00000000004B8000-memory.dmp

Filesize
736KB

Download
memory/2836-34-0x0000000000400000-0x00000000004B8000-memory.dmp

Filesize
736KB

Download
memory/2836-38-0x0000000000400000-0x00000000004B8000-memory.dmp

Filesize
736KB

Download
memory/2836-41-0x0000000000400000-0x00000000004B8000-memory.dmp

Filesize
736KB

Download
memory/2836-45-0x0000000000400000-0x00000000004B8000-memory.dmp

Filesize
736KB

Download
memory/2836-48-0x0000000000400000-0x00000000004B8000-memory.dmp

Filesize
736KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads