darkcomet | 4de3c9059ad7bba0d41c6884ecb885638dd0860bc7712f1f6367bb75f4fd2307

Analysis

max time kernel
134s
max time network
148s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
23-05-2024 01:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

NingaliNET-RAT 1.0.2.1/NingaliNET 1.0.2.1/NingaliNET Cracked [VersionPremium].exe
Size

2.9MB
MD5

451b1dd1b12dbd70f3cf580deae0696d
SHA1

81024d91d94c302e85455badb21e3a2e4f694eda
SHA256

ade39b5cb7124f165ed933e8e7f45469aebe1bb85cec8aadff7fee8ae99e499e
SHA512

7fc86b44a02d47f6b577d93ff81c0ba7239995b2d4f1e02475d963f593d9d2ac6ab451770ab4a7fefc9d440e33eeff494d6274fab66f4033f97bd0bb9a57d802
SSDEEP

49152:P4+T1crpOB3pVPnBaTOhm5PbQqKpcYeD4K2CqFXBSLlTJcGXDlp/yBFwvP:xT1crpY5zWOEB4qYeSCq2Ll93YFq

Score

10^/10

darkcomet a1client rat trojan

Malware Config

Extracted

Family

darkcomet

Botnet

A1Client

subdomain-dns.duckdns.org:3725

Mutex

DC_MUTEX-9WL5KMH

Attributes

gencode
F7b2NJbuPvt9
install
false
offline_keylogger
true
persistence
false

Signatures

Darkcomet
DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
trojan rat darkcomet

Drops startup file 2 IoCs

Processes:

cmd.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dllhost.exe	cmd.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dllhost.exe	cmd.exe

Executes dropped EXE 2 IoCs

Processes:

NingaliNET.exedllhost.exe

pid process

2128 NingaliNET.exe
2928 dllhost.exe

pid	process
2128	NingaliNET.exe
2928	dllhost.exe

Loads dropped DLL 7 IoCs

Processes:

NingaliNET Cracked [VersionPremium].exeWerFault.exe

pid	process
2176	NingaliNET Cracked [VersionPremium].exe
2176	NingaliNET Cracked [VersionPremium].exe
2384	WerFault.exe
2384	WerFault.exe
2384	WerFault.exe
2384	WerFault.exe
2384	WerFault.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

NingaliNET Cracked [VersionPremium].exe

description pid process target process

PID 2176 set thread context of 2928 2176 NingaliNET Cracked [VersionPremium].exe dllhost.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2384 2128 WerFault.exe NingaliNET.exe
Delays execution with timeout.exe 1 IoCs
evasion

Processes:

timeout.exe

pid process

2064 timeout.exe

description	pid	process	target process
PID 2176 set thread context of 2928	2176	NingaliNET Cracked [VersionPremium].exe	dllhost.exe

pid	pid_target	process	target process
2384	2128	WerFault.exe	NingaliNET.exe

pid	process
2064	timeout.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

NingaliNET Cracked [VersionPremium].exe

pid	process
2176	NingaliNET Cracked [VersionPremium].exe
2176	NingaliNET Cracked [VersionPremium].exe
2176	NingaliNET Cracked [VersionPremium].exe
2176	NingaliNET Cracked [VersionPremium].exe

Suspicious use of AdjustPrivilegeToken 24 IoCs

Processes:

NingaliNET Cracked [VersionPremium].exedllhost.exe

description	pid	process
Token: SeDebugPrivilege	2176	NingaliNET Cracked [VersionPremium].exe
Token: SeIncreaseQuotaPrivilege	2928	dllhost.exe
Token: SeSecurityPrivilege	2928	dllhost.exe
Token: SeTakeOwnershipPrivilege	2928	dllhost.exe
Token: SeLoadDriverPrivilege	2928	dllhost.exe
Token: SeSystemProfilePrivilege	2928	dllhost.exe
Token: SeSystemtimePrivilege	2928	dllhost.exe
Token: SeProfSingleProcessPrivilege	2928	dllhost.exe
Token: SeIncBasePriorityPrivilege	2928	dllhost.exe
Token: SeCreatePagefilePrivilege	2928	dllhost.exe
Token: SeBackupPrivilege	2928	dllhost.exe
Token: SeRestorePrivilege	2928	dllhost.exe
Token: SeShutdownPrivilege	2928	dllhost.exe
Token: SeDebugPrivilege	2928	dllhost.exe
Token: SeSystemEnvironmentPrivilege	2928	dllhost.exe
Token: SeChangeNotifyPrivilege	2928	dllhost.exe
Token: SeRemoteShutdownPrivilege	2928	dllhost.exe
Token: SeUndockPrivilege	2928	dllhost.exe
Token: SeManageVolumePrivilege	2928	dllhost.exe
Token: SeImpersonatePrivilege	2928	dllhost.exe
Token: SeCreateGlobalPrivilege	2928	dllhost.exe
Token: 33	2928	dllhost.exe
Token: 34	2928	dllhost.exe
Token: 35	2928	dllhost.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

dllhost.exe

pid process

2928 dllhost.exe

pid	process
2928	dllhost.exe

Suspicious use of WriteProcessMemory 37 IoCs

Processes:

NingaliNET Cracked [VersionPremium].execmd.execmd.exeNingaliNET.exe

description	pid	process	target process
PID 2176 wrote to memory of 2128	2176	NingaliNET Cracked [VersionPremium].exe	NingaliNET.exe
PID 2176 wrote to memory of 2128	2176	NingaliNET Cracked [VersionPremium].exe	NingaliNET.exe
PID 2176 wrote to memory of 2128	2176	NingaliNET Cracked [VersionPremium].exe	NingaliNET.exe
PID 2176 wrote to memory of 2128	2176	NingaliNET Cracked [VersionPremium].exe	NingaliNET.exe
PID 2176 wrote to memory of 2160	2176	NingaliNET Cracked [VersionPremium].exe	cmd.exe
PID 2176 wrote to memory of 2160	2176	NingaliNET Cracked [VersionPremium].exe	cmd.exe
PID 2176 wrote to memory of 2160	2176	NingaliNET Cracked [VersionPremium].exe	cmd.exe
PID 2176 wrote to memory of 2160	2176	NingaliNET Cracked [VersionPremium].exe	cmd.exe
PID 2160 wrote to memory of 2312	2160	cmd.exe	reg.exe
PID 2160 wrote to memory of 2312	2160	cmd.exe	reg.exe
PID 2160 wrote to memory of 2312	2160	cmd.exe	reg.exe
PID 2160 wrote to memory of 2312	2160	cmd.exe	reg.exe
PID 2176 wrote to memory of 2928	2176	NingaliNET Cracked [VersionPremium].exe	dllhost.exe
PID 2176 wrote to memory of 2928	2176	NingaliNET Cracked [VersionPremium].exe	dllhost.exe
PID 2176 wrote to memory of 2928	2176	NingaliNET Cracked [VersionPremium].exe	dllhost.exe
PID 2176 wrote to memory of 2928	2176	NingaliNET Cracked [VersionPremium].exe	dllhost.exe
PID 2176 wrote to memory of 2928	2176	NingaliNET Cracked [VersionPremium].exe	dllhost.exe
PID 2176 wrote to memory of 2928	2176	NingaliNET Cracked [VersionPremium].exe	dllhost.exe
PID 2176 wrote to memory of 2928	2176	NingaliNET Cracked [VersionPremium].exe	dllhost.exe
PID 2176 wrote to memory of 2928	2176	NingaliNET Cracked [VersionPremium].exe	dllhost.exe
PID 2176 wrote to memory of 2928	2176	NingaliNET Cracked [VersionPremium].exe	dllhost.exe
PID 2176 wrote to memory of 2928	2176	NingaliNET Cracked [VersionPremium].exe	dllhost.exe
PID 2176 wrote to memory of 2928	2176	NingaliNET Cracked [VersionPremium].exe	dllhost.exe
PID 2176 wrote to memory of 2928	2176	NingaliNET Cracked [VersionPremium].exe	dllhost.exe
PID 2176 wrote to memory of 2928	2176	NingaliNET Cracked [VersionPremium].exe	dllhost.exe
PID 2176 wrote to memory of 2520	2176	NingaliNET Cracked [VersionPremium].exe	cmd.exe
PID 2176 wrote to memory of 2520	2176	NingaliNET Cracked [VersionPremium].exe	cmd.exe
PID 2176 wrote to memory of 2520	2176	NingaliNET Cracked [VersionPremium].exe	cmd.exe
PID 2176 wrote to memory of 2520	2176	NingaliNET Cracked [VersionPremium].exe	cmd.exe
PID 2520 wrote to memory of 2064	2520	cmd.exe	timeout.exe
PID 2520 wrote to memory of 2064	2520	cmd.exe	timeout.exe
PID 2520 wrote to memory of 2064	2520	cmd.exe	timeout.exe
PID 2520 wrote to memory of 2064	2520	cmd.exe	timeout.exe
PID 2128 wrote to memory of 2384	2128	NingaliNET.exe	WerFault.exe
PID 2128 wrote to memory of 2384	2128	NingaliNET.exe	WerFault.exe
PID 2128 wrote to memory of 2384	2128	NingaliNET.exe	WerFault.exe
PID 2128 wrote to memory of 2384	2128	NingaliNET.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\NingaliNET-RAT 1.0.2.1\NingaliNET 1.0.2.1\NingaliNET Cracked [VersionPremium].exe
"C:\Users\Admin\AppData\Local\Temp\NingaliNET-RAT 1.0.2.1\NingaliNET 1.0.2.1\NingaliNET Cracked [VersionPremium].exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2176

C:\Users\Admin\AppData\Local\Temp\NingaliNET.exe
"C:\Users\Admin\AppData\Local\Temp\NingaliNET.exe"
2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2128

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2128 -s 732
3⤵
- Loads dropped DLL
- Program crash
PID:2384

C:\Windows\SysWOW64\cmd.exe
"cmd.exe"
2⤵
- Drops startup file
- Suspicious use of WriteProcessMemory
PID:2160

C:\Windows\SysWOW64\reg.exe
reg add "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows" /v Load /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\AdobeAAMUpdater-1.0\dllhost.exe" /f
3⤵
PID:2312

C:\Users\Admin\AppData\Local\Temp\dllhost.exe
"C:\Users\Admin\AppData\Local\Temp\dllhost.exe"
2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2928

C:\Windows\SysWOW64\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\AdobeAAMUpdater-1.0\dllhost.exe.bat
2⤵
- Suspicious use of WriteProcessMemory
PID:2520

C:\Windows\SysWOW64\timeout.exe
timeout /t 300
3⤵
- Delays execution with timeout.exe
PID:2064

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\AdobeAAMUpdater-1.0\dllhost.exe.bat
Filesize
221B

MD5
77ab9076e2d81a6f6c59c0f14f8e2509

SHA1
d1d036271ccbfe3354a99aba0689a3345d1eea82

SHA256
90f097dac23f30ffdcd3e680703511d5467fc2e19be8045759ec45c52e959214

SHA512
7a8978ffbd5313a06d1ab1700f4916e5a54f1fa8d709d221292bf6d21f8f48225ed6959b9d93f05c02a5c62f87a502d6810babfb195d3860d83851f097e05b6b

Download Submit
C:\Users\Admin\AppData\Local\Temp\dllhost.exe
Filesize
54KB

MD5
0f01571a3e4c71eb4313175aae86488e

SHA1
2ba648afe2cd52edf5f25e304f77d457abf7ac0e

SHA256
8cc51c4c2efc8c6a401aa83a0aeced0925d5d9d2a43192f35561893cdf704022

SHA512
159dfbb7d385bf92f4fc48ca389b89d69f6c2616e90dfa056e725d7da78a3702694a28f9c5cab7b55adc4d4dbd7bfe5d272c8b1c9931e3ac95f6326d74576794

Download Submit
\Users\Admin\AppData\Local\Temp\NingaliNET.exe
Filesize
1.4MB

MD5
eeda9e3dba1a866465f817af9e7c8212

SHA1
b78966eb20fdd1c9b4c22c409b2bb9a9a071d680

SHA256
f656b5b6736911a787fc4f3374ff247cfbcb277c7c2945c9c5c462354fea968c

SHA512
7a7b008b23d1164cfb851c1dc5aa8545b1a76764c331c41cb7de18647f103ac99b138dd7fad20823c90362e17efa043b5517aa8ba11cb5cf836423ace430eccc

Download Submit
memory/2128-44-0x0000000000A70000-0x0000000000BE6000-memory.dmp

Filesize
1.5MB

Download
memory/2128-55-0x0000000071ABE000-0x0000000071ABF000-memory.dmp

Filesize
4KB

Download
memory/2128-14-0x0000000071ABE000-0x0000000071ABF000-memory.dmp

Filesize
4KB

Download
memory/2176-1-0x0000000074DD0000-0x000000007537B000-memory.dmp

Filesize
5.7MB

Download
memory/2176-2-0x0000000074DD0000-0x000000007537B000-memory.dmp

Filesize
5.7MB

Download
memory/2176-54-0x0000000074DD0000-0x000000007537B000-memory.dmp

Filesize
5.7MB

Download
memory/2176-0-0x0000000074DD1000-0x0000000074DD2000-memory.dmp

Filesize
4KB

Download
memory/2928-27-0x0000000000400000-0x00000000004B1000-memory.dmp

Filesize
708KB

Download
memory/2928-29-0x0000000000400000-0x00000000004B1000-memory.dmp

Filesize
708KB

Download
memory/2928-43-0x0000000000400000-0x00000000004B1000-memory.dmp

Filesize
708KB

Download
memory/2928-28-0x0000000000400000-0x00000000004B1000-memory.dmp

Filesize
708KB

Download
memory/2928-26-0x0000000000400000-0x00000000004B1000-memory.dmp

Filesize
708KB

Download
memory/2928-48-0x0000000000400000-0x00000000004B1000-memory.dmp

Filesize
708KB

Download
memory/2928-47-0x0000000000400000-0x00000000004B1000-memory.dmp

Filesize
708KB

Download
memory/2928-45-0x0000000000400000-0x00000000004B1000-memory.dmp

Filesize
708KB

Download
memory/2928-24-0x0000000000400000-0x00000000004B1000-memory.dmp

Filesize
708KB

Download
memory/2928-23-0x0000000000400000-0x00000000004B1000-memory.dmp

Filesize
708KB

Download
memory/2928-21-0x0000000000400000-0x00000000004B1000-memory.dmp

Filesize
708KB

Download
memory/2928-30-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2928-32-0x0000000000400000-0x00000000004B1000-memory.dmp

Filesize
708KB

Download
memory/2928-41-0x0000000000400000-0x00000000004B1000-memory.dmp

Filesize
708KB

Download
memory/2928-20-0x0000000000400000-0x00000000004B1000-memory.dmp

Filesize
708KB

Download
memory/2928-56-0x0000000000400000-0x00000000004B1000-memory.dmp

Filesize
708KB

Download