darkcomet | 998d98fbca6ae5d844debade10eeb73f58dbbf9f0f47eeffa0c05fcaa0dffb55

General

Target

NanoCore/NanoCore.exe
Size

1.1MB
MD5

e4aeb7b31d677a5a9a58a4762fab1321
SHA1

a5e7279b6d59236296031ff87976e33fbd8cf34d
SHA256

1111f013a010a57a6739a8d4d0891728547cbbf80e45e77369a05d3423a28915
SHA512

964dda5030a54493aeebb8b478a76ccd98456184224332e66d5b693d311c83da11c360355c8d73e539ebc7b6ed0d0d2e78f65eef0f75d48c64a63cf10411e1fa
SSDEEP

24576:sdZ1xuVVjfFoynPaVBUR8f+kN10EBIQXiClSI5tIkjh:snQDgok30Edb

Score

10^/10

darkcomet nanocore idman evasion keylogger persistence rat spyware stealer trojan

Malware Config

Extracted

Family

darkcomet

Botnet

IDMAN

C2

arrivals.ddns.net:2323

Mutex

DC_MUTEX-391X2ZJ

Attributes

InstallPath
MSDCSC\IDMAN.exe
gencode
CUWbhGwmWBMb
install
true
offline_keylogger
true
persistence
true
reg_key
IDMAN

Signatures

Darkcomet
DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
trojan rat darkcomet

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

Processes:

CRACKED.EXE

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Users\\Admin\\AppData\\Roaming\\MSDCSC\\IDMAN.exe"	CRACKED.EXE

Modifies firewall policy service 2 TTPs 3 IoCs

evasion

Modify Registry

T1112

Windows Service

T1543.003

Processes:

IDMAN.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	IDMAN.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0"	IDMAN.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "0"	IDMAN.exe

NanoCore
NanoCore is a remote access tool (RAT) with a variety of capabilities.
keylogger trojan stealer spyware nanocore
Executes dropped EXE 3 IoCs

Processes:

CRACKED.EXENANOCORE.EXEIDMAN.exe

pid process

1996 CRACKED.EXE
1448 NANOCORE.EXE
2592 IDMAN.exe
Loads dropped DLL 5 IoCs

Processes:

NanoCore.exeCRACKED.EXE

pid process

1420 NanoCore.exe
1420 NanoCore.exe
1420 NanoCore.exe
1996 CRACKED.EXE
1996 CRACKED.EXE

pid	process
1996	CRACKED.EXE
1448	NANOCORE.EXE
2592	IDMAN.exe

pid	process
1420	NanoCore.exe
1420	NanoCore.exe
1420	NanoCore.exe
1996	CRACKED.EXE
1996	CRACKED.EXE

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

CRACKED.EXEIDMAN.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\IDMAN = "C:\\Users\\Admin\\AppData\\Roaming\\MSDCSC\\IDMAN.exe"	CRACKED.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\IDMAN = "C:\\Users\\Admin\\AppData\\Roaming\\MSDCSC\\IDMAN.exe"	IDMAN.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 46 IoCs

Processes:

CRACKED.EXEIDMAN.exe

description	pid	process
Token: SeIncreaseQuotaPrivilege	1996	CRACKED.EXE
Token: SeSecurityPrivilege	1996	CRACKED.EXE
Token: SeTakeOwnershipPrivilege	1996	CRACKED.EXE
Token: SeLoadDriverPrivilege	1996	CRACKED.EXE
Token: SeSystemProfilePrivilege	1996	CRACKED.EXE
Token: SeSystemtimePrivilege	1996	CRACKED.EXE
Token: SeProfSingleProcessPrivilege	1996	CRACKED.EXE
Token: SeIncBasePriorityPrivilege	1996	CRACKED.EXE
Token: SeCreatePagefilePrivilege	1996	CRACKED.EXE
Token: SeBackupPrivilege	1996	CRACKED.EXE
Token: SeRestorePrivilege	1996	CRACKED.EXE
Token: SeShutdownPrivilege	1996	CRACKED.EXE
Token: SeDebugPrivilege	1996	CRACKED.EXE
Token: SeSystemEnvironmentPrivilege	1996	CRACKED.EXE
Token: SeChangeNotifyPrivilege	1996	CRACKED.EXE
Token: SeRemoteShutdownPrivilege	1996	CRACKED.EXE
Token: SeUndockPrivilege	1996	CRACKED.EXE
Token: SeManageVolumePrivilege	1996	CRACKED.EXE
Token: SeImpersonatePrivilege	1996	CRACKED.EXE
Token: SeCreateGlobalPrivilege	1996	CRACKED.EXE
Token: 33	1996	CRACKED.EXE
Token: 34	1996	CRACKED.EXE
Token: 35	1996	CRACKED.EXE
Token: SeIncreaseQuotaPrivilege	2592	IDMAN.exe
Token: SeSecurityPrivilege	2592	IDMAN.exe
Token: SeTakeOwnershipPrivilege	2592	IDMAN.exe
Token: SeLoadDriverPrivilege	2592	IDMAN.exe
Token: SeSystemProfilePrivilege	2592	IDMAN.exe
Token: SeSystemtimePrivilege	2592	IDMAN.exe
Token: SeProfSingleProcessPrivilege	2592	IDMAN.exe
Token: SeIncBasePriorityPrivilege	2592	IDMAN.exe
Token: SeCreatePagefilePrivilege	2592	IDMAN.exe
Token: SeBackupPrivilege	2592	IDMAN.exe
Token: SeRestorePrivilege	2592	IDMAN.exe
Token: SeShutdownPrivilege	2592	IDMAN.exe
Token: SeDebugPrivilege	2592	IDMAN.exe
Token: SeSystemEnvironmentPrivilege	2592	IDMAN.exe
Token: SeChangeNotifyPrivilege	2592	IDMAN.exe
Token: SeRemoteShutdownPrivilege	2592	IDMAN.exe
Token: SeUndockPrivilege	2592	IDMAN.exe
Token: SeManageVolumePrivilege	2592	IDMAN.exe
Token: SeImpersonatePrivilege	2592	IDMAN.exe
Token: SeCreateGlobalPrivilege	2592	IDMAN.exe
Token: 33	2592	IDMAN.exe
Token: 34	2592	IDMAN.exe
Token: 35	2592	IDMAN.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

IDMAN.exe

pid process

2592 IDMAN.exe

pid	process
2592	IDMAN.exe

Suspicious use of WriteProcessMemory 38 IoCs

Processes:

NanoCore.exeCRACKED.EXEIDMAN.exeNANOCORE.EXE

description	pid	process	target process
PID 1420 wrote to memory of 1996	1420	NanoCore.exe	CRACKED.EXE
PID 1420 wrote to memory of 1996	1420	NanoCore.exe	CRACKED.EXE
PID 1420 wrote to memory of 1996	1420	NanoCore.exe	CRACKED.EXE
PID 1420 wrote to memory of 1996	1420	NanoCore.exe	CRACKED.EXE
PID 1420 wrote to memory of 1448	1420	NanoCore.exe	NANOCORE.EXE
PID 1420 wrote to memory of 1448	1420	NanoCore.exe	NANOCORE.EXE
PID 1420 wrote to memory of 1448	1420	NanoCore.exe	NANOCORE.EXE
PID 1420 wrote to memory of 1448	1420	NanoCore.exe	NANOCORE.EXE
PID 1996 wrote to memory of 2592	1996	CRACKED.EXE	IDMAN.exe
PID 1996 wrote to memory of 2592	1996	CRACKED.EXE	IDMAN.exe
PID 1996 wrote to memory of 2592	1996	CRACKED.EXE	IDMAN.exe
PID 1996 wrote to memory of 2592	1996	CRACKED.EXE	IDMAN.exe
PID 2592 wrote to memory of 2608	2592	IDMAN.exe	notepad.exe
PID 2592 wrote to memory of 2608	2592	IDMAN.exe	notepad.exe
PID 2592 wrote to memory of 2608	2592	IDMAN.exe	notepad.exe
PID 2592 wrote to memory of 2608	2592	IDMAN.exe	notepad.exe
PID 2592 wrote to memory of 2608	2592	IDMAN.exe	notepad.exe
PID 2592 wrote to memory of 2608	2592	IDMAN.exe	notepad.exe
PID 2592 wrote to memory of 2608	2592	IDMAN.exe	notepad.exe
PID 2592 wrote to memory of 2608	2592	IDMAN.exe	notepad.exe
PID 2592 wrote to memory of 2608	2592	IDMAN.exe	notepad.exe
PID 2592 wrote to memory of 2608	2592	IDMAN.exe	notepad.exe
PID 2592 wrote to memory of 2608	2592	IDMAN.exe	notepad.exe
PID 2592 wrote to memory of 2608	2592	IDMAN.exe	notepad.exe
PID 2592 wrote to memory of 2608	2592	IDMAN.exe	notepad.exe
PID 2592 wrote to memory of 2608	2592	IDMAN.exe	notepad.exe
PID 2592 wrote to memory of 2608	2592	IDMAN.exe	notepad.exe
PID 2592 wrote to memory of 2608	2592	IDMAN.exe	notepad.exe
PID 2592 wrote to memory of 2608	2592	IDMAN.exe	notepad.exe
PID 2592 wrote to memory of 2608	2592	IDMAN.exe	notepad.exe
PID 2592 wrote to memory of 2608	2592	IDMAN.exe	notepad.exe
PID 2592 wrote to memory of 2608	2592	IDMAN.exe	notepad.exe
PID 2592 wrote to memory of 2608	2592	IDMAN.exe	notepad.exe
PID 2592 wrote to memory of 2608	2592	IDMAN.exe	notepad.exe
PID 2592 wrote to memory of 2608	2592	IDMAN.exe	notepad.exe
PID 1448 wrote to memory of 2412	1448	NANOCORE.EXE	dw20.exe
PID 1448 wrote to memory of 2412	1448	NANOCORE.EXE	dw20.exe
PID 1448 wrote to memory of 2412	1448	NANOCORE.EXE	dw20.exe

C:\Users\Admin\AppData\Local\Temp\NanoCore\NanoCore.exe
"C:\Users\Admin\AppData\Local\Temp\NanoCore\NanoCore.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1420

C:\Users\Admin\AppData\Roaming\CRACKED.EXE
"C:\Users\Admin\AppData\Roaming\CRACKED.EXE"
2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1996

C:\Users\Admin\AppData\Roaming\MSDCSC\IDMAN.exe
"C:\Users\Admin\AppData\Roaming\MSDCSC\IDMAN.exe"
3⤵
- Modifies firewall policy service
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2592

C:\Windows\SysWOW64\notepad.exe
notepad
4⤵
PID:2608

C:\Users\Admin\AppData\Roaming\NANOCORE.EXE
"C:\Users\Admin\AppData\Roaming\NANOCORE.EXE"
2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1448

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe
dw20.exe -x -s 392
3⤵
PID:2412

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

2

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Winlogon Helper DLL

1

T1547.004

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

2

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Winlogon Helper DLL

1

T1547.004

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Defense Evasion

Modify Registry

3

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Roaming\CRACKED.EXE

Filesize
659KB

MD5
94c5b3199414b8fca9f134724acdd88e

SHA1
6c95291364476fc10c4e343120225dae72d11233

SHA256
dacd09444e389359d406450312e5fe66a2eb62c5c03948c8e7890303a43ee536

SHA512
5fdbaf9ede009cbfdb13a92ba5c409b1a590b1bc1ddccec45c551deb5e7b7f9ecc57ed0dd1a66c7a38666bd5eb2cab9fc52a18056a5e676c292bab871aa343e1

Download Submit
\Users\Admin\AppData\Roaming\NANOCORE.EXE

Filesize
403KB

MD5
d902fb22b92a7455eeac95712e9c2179

SHA1
8e4e0d0965055517c1ddef8442cf74c4f3d700af

SHA256
58f962401b52e043325cec66d88ad73032165cd0b8c3de1ec95292d83416b81f

SHA512
d097b22e30c20322c30f464dabf5bffeedc3e3728b82911db5f3ba79735915a3bb0fbc4bce65a153f665dc5e04ba93b6000d4230f8610bd17dbe3d625dff4269

Download Submit
memory/1448-15-0x000007FEF593E000-0x000007FEF593F000-memory.dmp

Filesize
4KB

Download
memory/1448-68-0x000007FEF5680000-0x000007FEF601D000-memory.dmp

Filesize
9.6MB

Download
memory/1448-69-0x000007FEF5680000-0x000007FEF601D000-memory.dmp

Filesize
9.6MB

Download
memory/1996-70-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/2592-71-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/2608-67-0x0000000000250000-0x0000000000251000-memory.dmp

Filesize
4KB

Download
memory/2608-29-0x0000000000080000-0x0000000000081000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads