darkcomet | 3bf3f6b60a065cbeda9ce581212d19196b5c878f2b24a318091a8a9c166ac5e0

Analysis

max time kernel
150s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
30/05/2024, 20:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
3bf3f6b60a065cbeda9ce581212d19196b5c878f2b24a318091a8a9c166ac5e0.exe
Size 520KB
Sample240530-znffwsah89
SHA256 3bf3f6b60a065cbeda9ce581212d19196b5c878f2b24a318091a8a9c166ac5e0
MD5 d8975b1c619328381cd7d81e5555e520
SHA1 4dff3116ad54fa9a1eec66117f18cb43b4019dd8
SHA512 773cd3cd2f80ee4de742e07205d64f666ac084436ed1234c824d664b863654927ceb874db1e0905a6f649d363977f994864ad3ae6caa223d4ba2aa0de3620941
SSDEEP 6144:f9GGo2CwtGg6eeihEfph2CMvvqqSaYwpncOeC66AOa0aFtVEQfTo1ozVqMbp:f9fC3hh29Ya77A90aFtDfT5IMbp
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

darkcomet privateeye rat trojan upx

Malware Config

Extracted

Family

darkcomet

Botnet

PrivateEye

ratblackshades.no-ip.biz:1604

Mutex

DC_MUTEX-ACC1R98

Attributes

gencode
8GG5LVVGljSF
install
false
offline_keylogger
true
persistence
false

Signatures

Darkcomet
DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
trojan rat darkcomet

UPX dump on OEP (original entry point) 17 IoCs

resource	yara_rule
behavioral2/memory/4532-30-0x0000000000400000-0x00000000004B7000-memory.dmp	UPX
behavioral2/memory/4532-34-0x0000000000400000-0x00000000004B7000-memory.dmp	UPX
behavioral2/memory/4532-33-0x0000000000400000-0x00000000004B7000-memory.dmp	UPX
behavioral2/memory/4532-36-0x0000000000400000-0x00000000004B7000-memory.dmp	UPX
behavioral2/memory/4532-35-0x0000000000400000-0x00000000004B7000-memory.dmp	UPX
behavioral2/memory/4532-27-0x0000000000400000-0x00000000004B7000-memory.dmp	UPX
behavioral2/memory/4532-25-0x0000000000400000-0x00000000004B7000-memory.dmp	UPX
behavioral2/memory/4532-39-0x0000000000400000-0x00000000004B7000-memory.dmp	UPX
behavioral2/memory/4532-40-0x0000000000400000-0x00000000004B7000-memory.dmp	UPX
behavioral2/memory/4532-41-0x0000000000400000-0x00000000004B7000-memory.dmp	UPX
behavioral2/memory/4532-42-0x0000000000400000-0x00000000004B7000-memory.dmp	UPX
behavioral2/memory/4532-43-0x0000000000400000-0x00000000004B7000-memory.dmp	UPX
behavioral2/memory/4532-44-0x0000000000400000-0x00000000004B7000-memory.dmp	UPX
behavioral2/memory/4532-45-0x0000000000400000-0x00000000004B7000-memory.dmp	UPX
behavioral2/memory/4532-46-0x0000000000400000-0x00000000004B7000-memory.dmp	UPX
behavioral2/memory/4532-47-0x0000000000400000-0x00000000004B7000-memory.dmp	UPX
behavioral2/memory/4532-48-0x0000000000400000-0x00000000004B7000-memory.dmp	UPX

Executes dropped EXE 3 IoCs

pid	Process
1076	winupd.exe
2036	winupd.exe
4532	winupd.exe

UPX packed file 17 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4532-30-0x0000000000400000-0x00000000004B7000-memory.dmp	upx
behavioral2/memory/4532-34-0x0000000000400000-0x00000000004B7000-memory.dmp	upx
behavioral2/memory/4532-33-0x0000000000400000-0x00000000004B7000-memory.dmp	upx
behavioral2/memory/4532-36-0x0000000000400000-0x00000000004B7000-memory.dmp	upx
behavioral2/memory/4532-35-0x0000000000400000-0x00000000004B7000-memory.dmp	upx
behavioral2/memory/4532-27-0x0000000000400000-0x00000000004B7000-memory.dmp	upx
behavioral2/memory/4532-25-0x0000000000400000-0x00000000004B7000-memory.dmp	upx
behavioral2/memory/4532-39-0x0000000000400000-0x00000000004B7000-memory.dmp	upx
behavioral2/memory/4532-40-0x0000000000400000-0x00000000004B7000-memory.dmp	upx
behavioral2/memory/4532-41-0x0000000000400000-0x00000000004B7000-memory.dmp	upx
behavioral2/memory/4532-42-0x0000000000400000-0x00000000004B7000-memory.dmp	upx
behavioral2/memory/4532-43-0x0000000000400000-0x00000000004B7000-memory.dmp	upx
behavioral2/memory/4532-44-0x0000000000400000-0x00000000004B7000-memory.dmp	upx
behavioral2/memory/4532-45-0x0000000000400000-0x00000000004B7000-memory.dmp	upx
behavioral2/memory/4532-46-0x0000000000400000-0x00000000004B7000-memory.dmp	upx
behavioral2/memory/4532-47-0x0000000000400000-0x00000000004B7000-memory.dmp	upx
behavioral2/memory/4532-48-0x0000000000400000-0x00000000004B7000-memory.dmp	upx

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 4148 set thread context of 3724	4148	3bf3f6b60a065cbeda9ce581212d19196b5c878f2b24a318091a8a9c166ac5e0.exe	107
PID 1076 set thread context of 2036	1076	winupd.exe	111
PID 1076 set thread context of 4532	1076	winupd.exe	112

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process
4236	1688	WerFault.exe

Gathers network information 2 TTPs 1 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
1688	ipconfig.exe

Suspicious use of AdjustPrivilegeToken 24 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	4532	winupd.exe
Token: SeSecurityPrivilege	4532	winupd.exe
Token: SeTakeOwnershipPrivilege	4532	winupd.exe
Token: SeLoadDriverPrivilege	4532	winupd.exe
Token: SeSystemProfilePrivilege	4532	winupd.exe
Token: SeSystemtimePrivilege	4532	winupd.exe
Token: SeProfSingleProcessPrivilege	4532	winupd.exe
Token: SeIncBasePriorityPrivilege	4532	winupd.exe
Token: SeCreatePagefilePrivilege	4532	winupd.exe
Token: SeBackupPrivilege	4532	winupd.exe
Token: SeRestorePrivilege	4532	winupd.exe
Token: SeShutdownPrivilege	4532	winupd.exe
Token: SeDebugPrivilege	4532	winupd.exe
Token: SeSystemEnvironmentPrivilege	4532	winupd.exe
Token: SeChangeNotifyPrivilege	4532	winupd.exe
Token: SeRemoteShutdownPrivilege	4532	winupd.exe
Token: SeUndockPrivilege	4532	winupd.exe
Token: SeManageVolumePrivilege	4532	winupd.exe
Token: SeImpersonatePrivilege	4532	winupd.exe
Token: SeCreateGlobalPrivilege	4532	winupd.exe
Token: 33	4532	winupd.exe
Token: 34	4532	winupd.exe
Token: 35	4532	winupd.exe
Token: 36	4532	winupd.exe

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
4148	3bf3f6b60a065cbeda9ce581212d19196b5c878f2b24a318091a8a9c166ac5e0.exe
3724	3bf3f6b60a065cbeda9ce581212d19196b5c878f2b24a318091a8a9c166ac5e0.exe
1076	winupd.exe
2036	winupd.exe
4532	winupd.exe

Suspicious use of WriteProcessMemory 32 IoCs

description	pid	Process	procid_target
PID 4148 wrote to memory of 3724	4148	3bf3f6b60a065cbeda9ce581212d19196b5c878f2b24a318091a8a9c166ac5e0.exe	107
PID 4148 wrote to memory of 3724	4148	3bf3f6b60a065cbeda9ce581212d19196b5c878f2b24a318091a8a9c166ac5e0.exe	107
PID 4148 wrote to memory of 3724	4148	3bf3f6b60a065cbeda9ce581212d19196b5c878f2b24a318091a8a9c166ac5e0.exe	107
PID 4148 wrote to memory of 3724	4148	3bf3f6b60a065cbeda9ce581212d19196b5c878f2b24a318091a8a9c166ac5e0.exe	107
PID 4148 wrote to memory of 3724	4148	3bf3f6b60a065cbeda9ce581212d19196b5c878f2b24a318091a8a9c166ac5e0.exe	107
PID 4148 wrote to memory of 3724	4148	3bf3f6b60a065cbeda9ce581212d19196b5c878f2b24a318091a8a9c166ac5e0.exe	107
PID 4148 wrote to memory of 3724	4148	3bf3f6b60a065cbeda9ce581212d19196b5c878f2b24a318091a8a9c166ac5e0.exe	107
PID 4148 wrote to memory of 3724	4148	3bf3f6b60a065cbeda9ce581212d19196b5c878f2b24a318091a8a9c166ac5e0.exe	107
PID 3724 wrote to memory of 1076	3724	3bf3f6b60a065cbeda9ce581212d19196b5c878f2b24a318091a8a9c166ac5e0.exe	108
PID 3724 wrote to memory of 1076	3724	3bf3f6b60a065cbeda9ce581212d19196b5c878f2b24a318091a8a9c166ac5e0.exe	108
PID 3724 wrote to memory of 1076	3724	3bf3f6b60a065cbeda9ce581212d19196b5c878f2b24a318091a8a9c166ac5e0.exe	108
PID 1076 wrote to memory of 2036	1076	winupd.exe	111
PID 1076 wrote to memory of 2036	1076	winupd.exe	111
PID 1076 wrote to memory of 2036	1076	winupd.exe	111
PID 1076 wrote to memory of 2036	1076	winupd.exe	111
PID 1076 wrote to memory of 2036	1076	winupd.exe	111
PID 1076 wrote to memory of 2036	1076	winupd.exe	111
PID 1076 wrote to memory of 2036	1076	winupd.exe	111
PID 1076 wrote to memory of 2036	1076	winupd.exe	111
PID 1076 wrote to memory of 4532	1076	winupd.exe	112
PID 1076 wrote to memory of 4532	1076	winupd.exe	112
PID 1076 wrote to memory of 4532	1076	winupd.exe	112
PID 1076 wrote to memory of 4532	1076	winupd.exe	112
PID 1076 wrote to memory of 4532	1076	winupd.exe	112
PID 1076 wrote to memory of 4532	1076	winupd.exe	112
PID 1076 wrote to memory of 4532	1076	winupd.exe	112
PID 1076 wrote to memory of 4532	1076	winupd.exe	112
PID 2036 wrote to memory of 1688	2036	winupd.exe	113
PID 2036 wrote to memory of 1688	2036	winupd.exe	113
PID 2036 wrote to memory of 1688	2036	winupd.exe	113
PID 2036 wrote to memory of 1688	2036	winupd.exe	113
PID 2036 wrote to memory of 1688	2036	winupd.exe	113

C:\Users\Admin\AppData\Local\Temp\3bf3f6b60a065cbeda9ce581212d19196b5c878f2b24a318091a8a9c166ac5e0.exe
"C:\Users\Admin\AppData\Local\Temp\3bf3f6b60a065cbeda9ce581212d19196b5c878f2b24a318091a8a9c166ac5e0.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4148
- C:\Users\Admin\AppData\Local\Temp\3bf3f6b60a065cbeda9ce581212d19196b5c878f2b24a318091a8a9c166ac5e0.exe
  "C:\Users\Admin\AppData\Local\Temp\3bf3f6b60a065cbeda9ce581212d19196b5c878f2b24a318091a8a9c166ac5e0.exe"
  2⤵
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3724
- - C:\Users\Admin\AppData\Roaming\Microsoft\winupd.exe
    C:\Users\Admin\AppData\Roaming\Microsoft\winupd.exe -notray
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1076
  - - C:\Users\Admin\AppData\Roaming\Microsoft\winupd.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\winupd.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2036
    - - C:\Windows\SysWOW64\ipconfig.exe
        
        "C:\Windows\system32\ipconfig.exe"
        5⤵
        Gathers network information
        
        PID:1688
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1688 -s 272
        6⤵
        Program crash
        
        PID:4236
  - - C:\Users\Admin\AppData\Roaming\Microsoft\winupd.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\winupd.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of SetWindowsHookEx
      PID:4532

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4196,i,10373433614523925616,13586256558317053467,262144 --variations-seed-version --mojo-platform-channel-handle=3976 /prefetch:8
1⤵
PID:2156

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1688 -ip 1688
1⤵
PID:4332

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

winupd.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\winupd.exe
Size 520KB
SHA256 7298256315ab247f6094f0467d3f49410237d266880c578b7392491ed7def65a
MD5 3da0a256054f3cc1f05097dcbf164af6
SHA1 f24627df24776a45ad3c2e0d9a1c42f7f041ef40
SHA512 c401ea55884a2661d9896fa62fba99f7e1e0e55a7b8654640c57256235b80107b745adf0732a01d3ec0c0751dc6aedf6f58a0b04d6712d4227fb7bc569f9db06
SSDEEP 6144:f9GGo2CwtGg6eeihEfph2CMvvqqSaYwpncOeC66AOa0aFtVEQfTo1ozVqMbq:f9fC3hh29Ya77A90aFtDfT5IMbq
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1076-20-0x0000000000400000-0x0000000000483000-memory.dmp

Download

memory/1076-28-0x0000000000400000-0x0000000000483000-memory.dmp

Download

memory/2036-37-0x0000000000400000-0x0000000000407000-memory.dmp

Download

memory/3724-6-0x0000000000400000-0x0000000000407000-memory.dmp

Download

memory/3724-3-0x0000000000400000-0x0000000000407000-memory.dmp

Download

memory/3724-18-0x0000000000400000-0x0000000000407000-memory.dmp

Download

memory/4148-2-0x0000000000400000-0x0000000000414000-memory.dmp

Download

memory/4148-7-0x0000000000400000-0x0000000000483000-memory.dmp

Download

memory/4148-8-0x0000000000400000-0x0000000000414000-memory.dmp

Download

memory/4148-5-0x0000000000400000-0x0000000000483000-memory.dmp

Download

memory/4532-35-0x0000000000400000-0x00000000004B7000-memory.dmp

Download

memory/4532-41-0x0000000000400000-0x00000000004B7000-memory.dmp

Download

memory/4532-36-0x0000000000400000-0x00000000004B7000-memory.dmp

Download

memory/4532-34-0x0000000000400000-0x00000000004B7000-memory.dmp

Download

memory/4532-27-0x0000000000400000-0x00000000004B7000-memory.dmp

Download

memory/4532-25-0x0000000000400000-0x00000000004B7000-memory.dmp

Download

memory/4532-30-0x0000000000400000-0x00000000004B7000-memory.dmp

Download

memory/4532-39-0x0000000000400000-0x00000000004B7000-memory.dmp

Download

memory/4532-40-0x0000000000400000-0x00000000004B7000-memory.dmp

Download

memory/4532-33-0x0000000000400000-0x00000000004B7000-memory.dmp

Download

memory/4532-42-0x0000000000400000-0x00000000004B7000-memory.dmp

Download

memory/4532-43-0x0000000000400000-0x00000000004B7000-memory.dmp

Download

memory/4532-44-0x0000000000400000-0x00000000004B7000-memory.dmp

Download

memory/4532-45-0x0000000000400000-0x00000000004B7000-memory.dmp

Download

memory/4532-46-0x0000000000400000-0x00000000004B7000-memory.dmp

Download

memory/4532-47-0x0000000000400000-0x00000000004B7000-memory.dmp

Download

memory/4532-48-0x0000000000400000-0x00000000004B7000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads