darkcomet | 3cacb629c55b9b35d59d26ff6f83e3048f00393662bc6e01d86234e6c71f405a

Analysis

max time kernel
132s
max time network
133s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
01/06/2024, 06:59

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
91c8735206c303614509bc25b9c20c80_NeikiAnalytics.exe
Size 658KB
Sample240601-hr2pvsdd2z
SHA256 3cacb629c55b9b35d59d26ff6f83e3048f00393662bc6e01d86234e6c71f405a
MD5 91c8735206c303614509bc25b9c20c80
SHA1 c0a264b4ca9ad356a638da6e10f5a969cad30517
SHA512 0aad2904764e916eae9b7cc50670f96093df77eaadc8134683e088dd27d0df6e863adfdd8125688ceb3821e0eb467aa940803227674b9ab20055fcb635f2552a
SSDEEP 12288:S9HFJ9rJxRX1uVVjoaWSoynxdO1FVBaOiRZTERfIhNkNCCLo9EkNC/K:+Z1xuVVjfFoynPaVBUR8f+kN10EdK
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

darkcomet nb evasion rat trojan

Malware Config

Extracted

Family

darkcomet

Botnet

zaaik.sytes.net:2000

Mutex

DC_MUTEX-BU30AP4

Attributes

gencode
7UzX5KiLSh1a
install
false
offline_keylogger
true
persistence
false

Signatures

Darkcomet
DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
trojan rat darkcomet

Modifies firewall policy service 2 TTPs 6 IoCs

evasion

Modify Registry

T1112

Windows Service

T1543.003

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "0"	iexplore.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	91c8735206c303614509bc25b9c20c80_NeikiAnalytics.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0"	91c8735206c303614509bc25b9c20c80_NeikiAnalytics.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "0"	91c8735206c303614509bc25b9c20c80_NeikiAnalytics.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	iexplore.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0"	iexplore.exe

Modifies security service 2 TTPs 2 IoCs

evasion

Modify Registry

T1112

Windows Service

T1543.003

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wscsvc\Start = "4"	91c8735206c303614509bc25b9c20c80_NeikiAnalytics.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wscsvc\Start = "4"	iexplore.exe

Windows security bypass 2 TTPs 4 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	91c8735206c303614509bc25b9c20c80_NeikiAnalytics.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	91c8735206c303614509bc25b9c20c80_NeikiAnalytics.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	iexplore.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	iexplore.exe

Disables RegEdit via registry modification 2 IoCs

evasion

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	91c8735206c303614509bc25b9c20c80_NeikiAnalytics.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	iexplore.exe

Disables Task Manager via registry modification
evasion

Sets file to hidden 1 TTPs 2 IoCs

Modifies file attributes to stop it showing in Explorer etc.

evasion

Hidden Files and Directories

T1564.001

pid	Process
1060	attrib.exe
2404	attrib.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\International\Geo\Nation	91c8735206c303614509bc25b9c20c80_NeikiAnalytics.exe

Windows security modification 2 TTPs 2 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	91c8735206c303614509bc25b9c20c80_NeikiAnalytics.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	91c8735206c303614509bc25b9c20c80_NeikiAnalytics.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4888 set thread context of 696	4888	91c8735206c303614509bc25b9c20c80_NeikiAnalytics.exe	104

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 48 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	4888	91c8735206c303614509bc25b9c20c80_NeikiAnalytics.exe
Token: SeSecurityPrivilege	4888	91c8735206c303614509bc25b9c20c80_NeikiAnalytics.exe
Token: SeTakeOwnershipPrivilege	4888	91c8735206c303614509bc25b9c20c80_NeikiAnalytics.exe
Token: SeLoadDriverPrivilege	4888	91c8735206c303614509bc25b9c20c80_NeikiAnalytics.exe
Token: SeSystemProfilePrivilege	4888	91c8735206c303614509bc25b9c20c80_NeikiAnalytics.exe
Token: SeSystemtimePrivilege	4888	91c8735206c303614509bc25b9c20c80_NeikiAnalytics.exe
Token: SeProfSingleProcessPrivilege	4888	91c8735206c303614509bc25b9c20c80_NeikiAnalytics.exe
Token: SeIncBasePriorityPrivilege	4888	91c8735206c303614509bc25b9c20c80_NeikiAnalytics.exe
Token: SeCreatePagefilePrivilege	4888	91c8735206c303614509bc25b9c20c80_NeikiAnalytics.exe
Token: SeBackupPrivilege	4888	91c8735206c303614509bc25b9c20c80_NeikiAnalytics.exe
Token: SeRestorePrivilege	4888	91c8735206c303614509bc25b9c20c80_NeikiAnalytics.exe
Token: SeShutdownPrivilege	4888	91c8735206c303614509bc25b9c20c80_NeikiAnalytics.exe
Token: SeDebugPrivilege	4888	91c8735206c303614509bc25b9c20c80_NeikiAnalytics.exe
Token: SeSystemEnvironmentPrivilege	4888	91c8735206c303614509bc25b9c20c80_NeikiAnalytics.exe
Token: SeChangeNotifyPrivilege	4888	91c8735206c303614509bc25b9c20c80_NeikiAnalytics.exe
Token: SeRemoteShutdownPrivilege	4888	91c8735206c303614509bc25b9c20c80_NeikiAnalytics.exe
Token: SeUndockPrivilege	4888	91c8735206c303614509bc25b9c20c80_NeikiAnalytics.exe
Token: SeManageVolumePrivilege	4888	91c8735206c303614509bc25b9c20c80_NeikiAnalytics.exe
Token: SeImpersonatePrivilege	4888	91c8735206c303614509bc25b9c20c80_NeikiAnalytics.exe
Token: SeCreateGlobalPrivilege	4888	91c8735206c303614509bc25b9c20c80_NeikiAnalytics.exe
Token: 33	4888	91c8735206c303614509bc25b9c20c80_NeikiAnalytics.exe
Token: 34	4888	91c8735206c303614509bc25b9c20c80_NeikiAnalytics.exe
Token: 35	4888	91c8735206c303614509bc25b9c20c80_NeikiAnalytics.exe
Token: 36	4888	91c8735206c303614509bc25b9c20c80_NeikiAnalytics.exe
Token: SeIncreaseQuotaPrivilege	696	iexplore.exe
Token: SeSecurityPrivilege	696	iexplore.exe
Token: SeTakeOwnershipPrivilege	696	iexplore.exe
Token: SeLoadDriverPrivilege	696	iexplore.exe
Token: SeSystemProfilePrivilege	696	iexplore.exe
Token: SeSystemtimePrivilege	696	iexplore.exe
Token: SeProfSingleProcessPrivilege	696	iexplore.exe
Token: SeIncBasePriorityPrivilege	696	iexplore.exe
Token: SeCreatePagefilePrivilege	696	iexplore.exe
Token: SeBackupPrivilege	696	iexplore.exe
Token: SeRestorePrivilege	696	iexplore.exe
Token: SeShutdownPrivilege	696	iexplore.exe
Token: SeDebugPrivilege	696	iexplore.exe
Token: SeSystemEnvironmentPrivilege	696	iexplore.exe
Token: SeChangeNotifyPrivilege	696	iexplore.exe
Token: SeRemoteShutdownPrivilege	696	iexplore.exe
Token: SeUndockPrivilege	696	iexplore.exe
Token: SeManageVolumePrivilege	696	iexplore.exe
Token: SeImpersonatePrivilege	696	iexplore.exe
Token: SeCreateGlobalPrivilege	696	iexplore.exe
Token: 33	696	iexplore.exe
Token: 34	696	iexplore.exe
Token: 35	696	iexplore.exe
Token: 36	696	iexplore.exe

Suspicious use of WriteProcessMemory 17 IoCs

description	pid	Process	procid_target
PID 4888 wrote to memory of 3280	4888	91c8735206c303614509bc25b9c20c80_NeikiAnalytics.exe	101
PID 4888 wrote to memory of 3280	4888	91c8735206c303614509bc25b9c20c80_NeikiAnalytics.exe	101
PID 4888 wrote to memory of 3280	4888	91c8735206c303614509bc25b9c20c80_NeikiAnalytics.exe	101
PID 4888 wrote to memory of 1388	4888	91c8735206c303614509bc25b9c20c80_NeikiAnalytics.exe	103
PID 4888 wrote to memory of 1388	4888	91c8735206c303614509bc25b9c20c80_NeikiAnalytics.exe	103
PID 4888 wrote to memory of 1388	4888	91c8735206c303614509bc25b9c20c80_NeikiAnalytics.exe	103
PID 4888 wrote to memory of 696	4888	91c8735206c303614509bc25b9c20c80_NeikiAnalytics.exe	104
PID 4888 wrote to memory of 696	4888	91c8735206c303614509bc25b9c20c80_NeikiAnalytics.exe	104
PID 4888 wrote to memory of 696	4888	91c8735206c303614509bc25b9c20c80_NeikiAnalytics.exe	104
PID 4888 wrote to memory of 696	4888	91c8735206c303614509bc25b9c20c80_NeikiAnalytics.exe	104
PID 4888 wrote to memory of 696	4888	91c8735206c303614509bc25b9c20c80_NeikiAnalytics.exe	104
PID 3280 wrote to memory of 1060	3280	cmd.exe	106
PID 3280 wrote to memory of 1060	3280	cmd.exe	106
PID 3280 wrote to memory of 1060	3280	cmd.exe	106
PID 1388 wrote to memory of 2404	1388	cmd.exe	107
PID 1388 wrote to memory of 2404	1388	cmd.exe	107
PID 1388 wrote to memory of 2404	1388	cmd.exe	107

System policy modification 1 TTPs 3 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\CurrentVersion\Explorern	91c8735206c303614509bc25b9c20c80_NeikiAnalytics.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\CurrentVersion\Explorern\NoControlPanel = "1"	91c8735206c303614509bc25b9c20c80_NeikiAnalytics.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\CurrentVersion	91c8735206c303614509bc25b9c20c80_NeikiAnalytics.exe

Views/modifies file attributes 1 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1564.001

pid	Process
1060	attrib.exe
2404	attrib.exe

C:\Users\Admin\AppData\Local\Temp\91c8735206c303614509bc25b9c20c80_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\91c8735206c303614509bc25b9c20c80_NeikiAnalytics.exe"
1⤵
- Modifies firewall policy service
- Modifies security service
- Windows security bypass
- Disables RegEdit via registry modification
- Checks computer location settings
- Windows security modification
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:4888
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp\91c8735206c303614509bc25b9c20c80_NeikiAnalytics.exe" +s +h
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3280
- - C:\Windows\SysWOW64\attrib.exe
    attrib "C:\Users\Admin\AppData\Local\Temp\91c8735206c303614509bc25b9c20c80_NeikiAnalytics.exe" +s +h
    3⤵
    - Sets file to hidden
    - Views/modifies file attributes
    PID:1060
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp" +s +h
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1388
- - C:\Windows\SysWOW64\attrib.exe
    attrib "C:\Users\Admin\AppData\Local\Temp" +s +h
    3⤵
    - Sets file to hidden
    - Views/modifies file attributes
    PID:2404
- C:\Program Files (x86)\Internet Explorer\iexplore.exe
  "C:\Program Files (x86)\Internet Explorer\iexplore.exe"
  2⤵
  - Modifies firewall policy service
  - Modifies security service
  - Windows security bypass
  - Disables RegEdit via registry modification
  - Suspicious use of AdjustPrivilegeToken
  PID:696

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=1428,i,6576818814118437872,11004518367271063231,262144 --variations-seed-version --mojo-platform-channel-handle=3756 /prefetch:8
1⤵
PID:464