darkcomet | f9c5331098f98af50128309a1af63977197619b3e272c7f246e6b873c16f5810

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
23-04-2024 05:59

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f9c5331098f98af50128309a1af63977197619b3e272c7f246e6b873c16f5810.exe
Size

911KB
MD5

18e4e38984edab5ab98764bb562beaac
SHA1

5a1cc294d0ab762d8caa26b4b880982e3ee26096
SHA256

f9c5331098f98af50128309a1af63977197619b3e272c7f246e6b873c16f5810
SHA512

e6afa794467c8183cc80c4570388bf50d8b64c0bbb2bbdeabdcebb59904343369f2434cdbb224215ce86a451b6e0f631edc82a02c295a5fc12ed93ef783f605e
SSDEEP

24576:0fQkTf4smJa44JspYmcis7jKvN8Pu/lHCHgYZgq3qXv:JkTgsLs+mcv8N8P8JCHgu6f

Score

10^/10

darkcomet slave persistence rat trojan

Malware Config

Extracted

Family

darkcomet

Botnet

Slave

runescape101.no-ip.biz:2000

Mutex

DCMIN_MUTEX-XQ22WE9

Attributes

gencode
N3uxyYQkFc3C
install
false
offline_keylogger
true
persistence
false

Signatures

Darkcomet
DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
trojan rat darkcomet
Uses the VBS compiler for execution 1 TTPs

Scripting
T1064

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

f9c5331098f98af50128309a1af63977197619b3e272c7f246e6b873c16f5810.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2177723727-746291240-1644359950-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\wuauserev = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\System\\Services\\wuauserev.exe"	f9c5331098f98af50128309a1af63977197619b3e272c7f246e6b873c16f5810.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

f9c5331098f98af50128309a1af63977197619b3e272c7f246e6b873c16f5810.exe

description	pid	process	target process
PID 2496 set thread context of 2512	2496	f9c5331098f98af50128309a1af63977197619b3e272c7f246e6b873c16f5810.exe	vbc.exe

Suspicious behavior: EnumeratesProcesses 7 IoCs

Processes:

f9c5331098f98af50128309a1af63977197619b3e272c7f246e6b873c16f5810.exe

pid	process
2496	f9c5331098f98af50128309a1af63977197619b3e272c7f246e6b873c16f5810.exe
2496	f9c5331098f98af50128309a1af63977197619b3e272c7f246e6b873c16f5810.exe
2496	f9c5331098f98af50128309a1af63977197619b3e272c7f246e6b873c16f5810.exe
2496	f9c5331098f98af50128309a1af63977197619b3e272c7f246e6b873c16f5810.exe
2496	f9c5331098f98af50128309a1af63977197619b3e272c7f246e6b873c16f5810.exe
2496	f9c5331098f98af50128309a1af63977197619b3e272c7f246e6b873c16f5810.exe
2496	f9c5331098f98af50128309a1af63977197619b3e272c7f246e6b873c16f5810.exe

Suspicious use of AdjustPrivilegeToken 25 IoCs

Processes:

f9c5331098f98af50128309a1af63977197619b3e272c7f246e6b873c16f5810.exevbc.exe

description	pid	process
Token: SeDebugPrivilege	2496	f9c5331098f98af50128309a1af63977197619b3e272c7f246e6b873c16f5810.exe
Token: SeIncreaseQuotaPrivilege	2512	vbc.exe
Token: SeSecurityPrivilege	2512	vbc.exe
Token: SeTakeOwnershipPrivilege	2512	vbc.exe
Token: SeLoadDriverPrivilege	2512	vbc.exe
Token: SeSystemProfilePrivilege	2512	vbc.exe
Token: SeSystemtimePrivilege	2512	vbc.exe
Token: SeProfSingleProcessPrivilege	2512	vbc.exe
Token: SeIncBasePriorityPrivilege	2512	vbc.exe
Token: SeCreatePagefilePrivilege	2512	vbc.exe
Token: SeBackupPrivilege	2512	vbc.exe
Token: SeRestorePrivilege	2512	vbc.exe
Token: SeShutdownPrivilege	2512	vbc.exe
Token: SeDebugPrivilege	2512	vbc.exe
Token: SeSystemEnvironmentPrivilege	2512	vbc.exe
Token: SeChangeNotifyPrivilege	2512	vbc.exe
Token: SeRemoteShutdownPrivilege	2512	vbc.exe
Token: SeUndockPrivilege	2512	vbc.exe
Token: SeManageVolumePrivilege	2512	vbc.exe
Token: SeImpersonatePrivilege	2512	vbc.exe
Token: SeCreateGlobalPrivilege	2512	vbc.exe
Token: 33	2512	vbc.exe
Token: 34	2512	vbc.exe
Token: 35	2512	vbc.exe
Token: 36	2512	vbc.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

vbc.exe

pid process

2512 vbc.exe

pid	process
2512	vbc.exe

Suspicious use of WriteProcessMemory 14 IoCs

Processes:

f9c5331098f98af50128309a1af63977197619b3e272c7f246e6b873c16f5810.exe

description	pid	process	target process
PID 2496 wrote to memory of 2512	2496	f9c5331098f98af50128309a1af63977197619b3e272c7f246e6b873c16f5810.exe	vbc.exe
PID 2496 wrote to memory of 2512	2496	f9c5331098f98af50128309a1af63977197619b3e272c7f246e6b873c16f5810.exe	vbc.exe
PID 2496 wrote to memory of 2512	2496	f9c5331098f98af50128309a1af63977197619b3e272c7f246e6b873c16f5810.exe	vbc.exe
PID 2496 wrote to memory of 2512	2496	f9c5331098f98af50128309a1af63977197619b3e272c7f246e6b873c16f5810.exe	vbc.exe
PID 2496 wrote to memory of 2512	2496	f9c5331098f98af50128309a1af63977197619b3e272c7f246e6b873c16f5810.exe	vbc.exe
PID 2496 wrote to memory of 2512	2496	f9c5331098f98af50128309a1af63977197619b3e272c7f246e6b873c16f5810.exe	vbc.exe
PID 2496 wrote to memory of 2512	2496	f9c5331098f98af50128309a1af63977197619b3e272c7f246e6b873c16f5810.exe	vbc.exe
PID 2496 wrote to memory of 2512	2496	f9c5331098f98af50128309a1af63977197619b3e272c7f246e6b873c16f5810.exe	vbc.exe
PID 2496 wrote to memory of 2512	2496	f9c5331098f98af50128309a1af63977197619b3e272c7f246e6b873c16f5810.exe	vbc.exe
PID 2496 wrote to memory of 2512	2496	f9c5331098f98af50128309a1af63977197619b3e272c7f246e6b873c16f5810.exe	vbc.exe
PID 2496 wrote to memory of 2512	2496	f9c5331098f98af50128309a1af63977197619b3e272c7f246e6b873c16f5810.exe	vbc.exe
PID 2496 wrote to memory of 2512	2496	f9c5331098f98af50128309a1af63977197619b3e272c7f246e6b873c16f5810.exe	vbc.exe
PID 2496 wrote to memory of 2512	2496	f9c5331098f98af50128309a1af63977197619b3e272c7f246e6b873c16f5810.exe	vbc.exe
PID 2496 wrote to memory of 2512	2496	f9c5331098f98af50128309a1af63977197619b3e272c7f246e6b873c16f5810.exe	vbc.exe

C:\Users\Admin\AppData\Local\Temp\f9c5331098f98af50128309a1af63977197619b3e272c7f246e6b873c16f5810.exe
"C:\Users\Admin\AppData\Local\Temp\f9c5331098f98af50128309a1af63977197619b3e272c7f246e6b873c16f5810.exe"
1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2496

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
2⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2512

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Scripting

T1064

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Scripting

T1064

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2496-0-0x00000000009D0000-0x0000000000A8C000-memory.dmp

Filesize
752KB

Download
memory/2496-9-0x0000000076E60000-0x0000000076F50000-memory.dmp

Filesize
960KB

Download
memory/2496-10-0x0000000076E60000-0x0000000076F50000-memory.dmp

Filesize
960KB

Download
memory/2496-11-0x0000000076E60000-0x0000000076F50000-memory.dmp

Filesize
960KB

Download
memory/2496-12-0x0000000076E60000-0x0000000076F50000-memory.dmp

Filesize
960KB

Download
memory/2496-13-0x00000000008F0000-0x0000000000900000-memory.dmp

Filesize
64KB

Download
memory/2496-14-0x00000000008F0000-0x0000000000900000-memory.dmp

Filesize
64KB

Download
memory/2496-15-0x00000000008F0000-0x0000000000900000-memory.dmp

Filesize
64KB

Download
memory/2496-16-0x0000000000ED0000-0x0000000000EE0000-memory.dmp

Filesize
64KB

Download
memory/2496-17-0x0000000074AD0000-0x0000000075081000-memory.dmp

Filesize
5.7MB

Download
memory/2496-18-0x0000000074AD0000-0x0000000075081000-memory.dmp

Filesize
5.7MB

Download
memory/2496-21-0x00000000009D0000-0x0000000000A8C000-memory.dmp

Filesize
752KB

Download
memory/2496-20-0x00000000009D0000-0x0000000000A8C000-memory.dmp

Filesize
752KB

Download
memory/2496-22-0x00000000009D0000-0x0000000000A8C000-memory.dmp

Filesize
752KB

Download
memory/2496-24-0x00000000009D0000-0x0000000000A8C000-memory.dmp

Filesize
752KB

Download
memory/2496-25-0x00000000009D0000-0x0000000000A8C000-memory.dmp

Filesize
752KB

Download
memory/2496-23-0x00000000009D0000-0x0000000000A8C000-memory.dmp

Filesize
752KB

Download
memory/2496-26-0x00000000009D0000-0x0000000000A8C000-memory.dmp

Filesize
752KB

Download
memory/2496-19-0x00000000009D0000-0x0000000000A8C000-memory.dmp

Filesize
752KB

Download
memory/2496-27-0x00000000009D0000-0x0000000000A8C000-memory.dmp

Filesize
752KB

Download
memory/2496-29-0x00000000009D0000-0x0000000000A8C000-memory.dmp

Filesize
752KB

Download
memory/2496-28-0x00000000009D0000-0x0000000000A8C000-memory.dmp

Filesize
752KB

Download
memory/2496-30-0x00000000009D0000-0x0000000000A8C000-memory.dmp

Filesize
752KB

Download
memory/2496-31-0x00000000009D0000-0x0000000000A8C000-memory.dmp

Filesize
752KB

Download
memory/2496-32-0x00000000009D0000-0x0000000000A8C000-memory.dmp

Filesize
752KB

Download
memory/2496-34-0x00000000009D0000-0x0000000000A8C000-memory.dmp

Filesize
752KB

Download
memory/2496-33-0x00000000009D0000-0x0000000000A8C000-memory.dmp

Filesize
752KB

Download
memory/2496-35-0x00000000009D0000-0x0000000000A8C000-memory.dmp

Filesize
752KB

Download
memory/2496-37-0x00000000009D0000-0x0000000000A8C000-memory.dmp

Filesize
752KB

Download
memory/2496-36-0x00000000009D0000-0x0000000000A8C000-memory.dmp

Filesize
752KB

Download
memory/2496-38-0x00000000009D0000-0x0000000000A8C000-memory.dmp

Filesize
752KB

Download
memory/2496-47-0x00000000009D0000-0x0000000000A8C000-memory.dmp

Filesize
752KB

Download
memory/2496-49-0x00000000009D0000-0x0000000000A8C000-memory.dmp

Filesize
752KB

Download
memory/2496-54-0x00000000009D0000-0x0000000000A8C000-memory.dmp

Filesize
752KB

Download
memory/2496-53-0x00000000009D0000-0x0000000000A8C000-memory.dmp

Filesize
752KB

Download
memory/2496-52-0x00000000009D0000-0x0000000000A8C000-memory.dmp

Filesize
752KB

Download
memory/2496-57-0x0000000000630000-0x0000000000730000-memory.dmp

Filesize
1024KB

Download
memory/2496-51-0x00000000009D0000-0x0000000000A8C000-memory.dmp

Filesize
752KB

Download
memory/2496-50-0x00000000009D0000-0x0000000000A8C000-memory.dmp

Filesize
752KB

Download
memory/2496-48-0x00000000009D0000-0x0000000000A8C000-memory.dmp

Filesize
752KB

Download
memory/2496-46-0x00000000009D0000-0x0000000000A8C000-memory.dmp

Filesize
752KB

Download
memory/2496-58-0x0000000000630000-0x0000000000730000-memory.dmp

Filesize
1024KB

Download
memory/2496-45-0x00000000009D0000-0x0000000000A8C000-memory.dmp

Filesize
752KB

Download
memory/2496-44-0x00000000009D0000-0x0000000000A8C000-memory.dmp

Filesize
752KB

Download
memory/2496-43-0x00000000009D0000-0x0000000000A8C000-memory.dmp

Filesize
752KB

Download
memory/2496-42-0x00000000009D0000-0x0000000000A8C000-memory.dmp

Filesize
752KB

Download
memory/2496-41-0x00000000009D0000-0x0000000000A8C000-memory.dmp

Filesize
752KB

Download
memory/2496-40-0x00000000009D0000-0x0000000000A8C000-memory.dmp

Filesize
752KB

Download
memory/2496-39-0x00000000009D0000-0x0000000000A8C000-memory.dmp

Filesize
752KB

Download
memory/2496-66-0x0000000076E60000-0x0000000076F50000-memory.dmp

Filesize
960KB

Download
memory/2496-69-0x0000000074AD0000-0x0000000075081000-memory.dmp

Filesize
5.7MB

Download
memory/2512-60-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/2512-62-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/2512-64-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/2512-68-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/2512-67-0x00000000006A0000-0x00000000006A1000-memory.dmp

Filesize
4KB

Download
memory/2512-65-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/2512-59-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/2512-70-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/2512-71-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/2512-72-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/2512-73-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/2512-74-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/2512-75-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/2512-76-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/2512-77-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/2512-78-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/2512-79-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/2512-80-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/2512-81-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/2512-82-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/2512-83-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download