darkcomet | a3a877d52fb6aa2a33a0d85893c73fdbe0621be7aeb4efeda42e05addfcc1a90

General

Target

Techno-Scape Client/run.exe
Size

430KB
MD5

e0d6a1a9287d1408cd21559123d7b240
SHA1

6bf371c744dcbafa061a3566e1e99c91ff134178
SHA256

0a62af46dcf7072571e40cd9d6091bb04b62e88e043496127b36871fb07b534a
SHA512

03bc5cd56f73fb1592544a719ca79cc8d867b3e0b0f4fc3e042ab3b4e4352417f37a4e9a8c3ba23df0c0d15d177fd9c2abf702c0310d04550f3f0bec9b24c3b8
SSDEEP

6144:WYmHLKxXSSe9bGVGy4AmQ9ayfHBAfmhX5mggooeP3jvWmzi3MizYqI/xhrv9:TUmgb5Amma6BAf+5mOjvW13XIh79

Score

10^/10

darkcomet guest16 discovery rat trojan upx

Malware Config

Extracted

Family

darkcomet

Botnet

Guest16

C2

anonymous.no-ip.biz:1604

Mutex

DC_MUTEX-584KTPC

Attributes

gencode
bynBHQc30zXD
install
false
offline_keylogger
true
persistence
false

Signatures

Darkcomet
DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
trojan rat darkcomet

Executes dropped EXE 1 IoCs

pid	Process
2960	run.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4948 set thread context of 2960	4948	run.exe	85

UPX packed file 21 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral10/memory/2960-4-0x0000000000400000-0x00000000004E8000-memory.dmp	upx
behavioral10/memory/2960-1-0x0000000000400000-0x00000000004E8000-memory.dmp	upx
behavioral10/memory/2960-5-0x0000000000400000-0x00000000004E8000-memory.dmp	upx
behavioral10/memory/2960-7-0x0000000000400000-0x00000000004E8000-memory.dmp	upx
behavioral10/memory/2960-6-0x0000000000400000-0x00000000004E8000-memory.dmp	upx
behavioral10/memory/2960-8-0x0000000000400000-0x00000000004E8000-memory.dmp	upx
behavioral10/memory/2960-10-0x0000000000400000-0x00000000004E8000-memory.dmp	upx
behavioral10/memory/2960-9-0x0000000000400000-0x00000000004E8000-memory.dmp	upx
behavioral10/memory/2960-11-0x0000000000400000-0x00000000004E8000-memory.dmp	upx
behavioral10/memory/2960-12-0x0000000000400000-0x00000000004E8000-memory.dmp	upx
behavioral10/memory/2960-14-0x0000000000400000-0x00000000004E8000-memory.dmp	upx
behavioral10/memory/2960-15-0x0000000000400000-0x00000000004E8000-memory.dmp	upx
behavioral10/memory/2960-16-0x0000000000400000-0x00000000004E8000-memory.dmp	upx
behavioral10/memory/2960-17-0x0000000000400000-0x00000000004E8000-memory.dmp	upx
behavioral10/memory/2960-18-0x0000000000400000-0x00000000004E8000-memory.dmp	upx
behavioral10/memory/2960-19-0x0000000000400000-0x00000000004E8000-memory.dmp	upx
behavioral10/memory/2960-20-0x0000000000400000-0x00000000004E8000-memory.dmp	upx
behavioral10/memory/2960-21-0x0000000000400000-0x00000000004E8000-memory.dmp	upx
behavioral10/memory/2960-24-0x0000000000400000-0x00000000004E8000-memory.dmp	upx
behavioral10/memory/2960-26-0x0000000000400000-0x00000000004E8000-memory.dmp	upx
behavioral10/memory/2960-27-0x0000000000400000-0x00000000004E8000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	run.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	run.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4948	run.exe
4948	run.exe

Suspicious use of AdjustPrivilegeToken 24 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	2960	run.exe
Token: SeSecurityPrivilege	2960	run.exe
Token: SeTakeOwnershipPrivilege	2960	run.exe
Token: SeLoadDriverPrivilege	2960	run.exe
Token: SeSystemProfilePrivilege	2960	run.exe
Token: SeSystemtimePrivilege	2960	run.exe
Token: SeProfSingleProcessPrivilege	2960	run.exe
Token: SeIncBasePriorityPrivilege	2960	run.exe
Token: SeCreatePagefilePrivilege	2960	run.exe
Token: SeBackupPrivilege	2960	run.exe
Token: SeRestorePrivilege	2960	run.exe
Token: SeShutdownPrivilege	2960	run.exe
Token: SeDebugPrivilege	2960	run.exe
Token: SeSystemEnvironmentPrivilege	2960	run.exe
Token: SeChangeNotifyPrivilege	2960	run.exe
Token: SeRemoteShutdownPrivilege	2960	run.exe
Token: SeUndockPrivilege	2960	run.exe
Token: SeManageVolumePrivilege	2960	run.exe
Token: SeImpersonatePrivilege	2960	run.exe
Token: SeCreateGlobalPrivilege	2960	run.exe
Token: 33	2960	run.exe
Token: 34	2960	run.exe
Token: 35	2960	run.exe
Token: 36	2960	run.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2960	run.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 4948 wrote to memory of 2960	4948	run.exe	85
PID 4948 wrote to memory of 2960	4948	run.exe	85
PID 4948 wrote to memory of 2960	4948	run.exe	85
PID 4948 wrote to memory of 2960	4948	run.exe	85
PID 4948 wrote to memory of 2960	4948	run.exe	85
PID 4948 wrote to memory of 2960	4948	run.exe	85
PID 4948 wrote to memory of 2960	4948	run.exe	85
PID 4948 wrote to memory of 2960	4948	run.exe	85

C:\Users\Admin\AppData\Local\Temp\Techno-Scape Client\run.exe
"C:\Users\Admin\AppData\Local\Temp\Techno-Scape Client\run.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4948
- C:\Users\Admin\AppData\Local\Temp\Techno-Scape Client\run.exe
  "C:\Users\Admin\AppData\Local\Temp\Techno-Scape Client\run.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:2960

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Techno-Scape Client\run.exe

Filesize
430KB

MD5
e0d6a1a9287d1408cd21559123d7b240

SHA1
6bf371c744dcbafa061a3566e1e99c91ff134178

SHA256
0a62af46dcf7072571e40cd9d6091bb04b62e88e043496127b36871fb07b534a

SHA512
03bc5cd56f73fb1592544a719ca79cc8d867b3e0b0f4fc3e042ab3b4e4352417f37a4e9a8c3ba23df0c0d15d177fd9c2abf702c0310d04550f3f0bec9b24c3b8

Download Submit
memory/2960-11-0x0000000000400000-0x00000000004E8000-memory.dmp

Filesize
928KB

Download
memory/2960-14-0x0000000000400000-0x00000000004E8000-memory.dmp

Filesize
928KB

Download
memory/2960-1-0x0000000000400000-0x00000000004E8000-memory.dmp

Filesize
928KB

Download
memory/2960-5-0x0000000000400000-0x00000000004E8000-memory.dmp

Filesize
928KB

Download
memory/2960-7-0x0000000000400000-0x00000000004E8000-memory.dmp

Filesize
928KB

Download
memory/2960-6-0x0000000000400000-0x00000000004E8000-memory.dmp

Filesize
928KB

Download
memory/2960-8-0x0000000000400000-0x00000000004E8000-memory.dmp

Filesize
928KB

Download
memory/2960-10-0x0000000000400000-0x00000000004E8000-memory.dmp

Filesize
928KB

Download
memory/2960-9-0x0000000000400000-0x00000000004E8000-memory.dmp

Filesize
928KB

Download
memory/2960-15-0x0000000000400000-0x00000000004E8000-memory.dmp

Filesize
928KB

Download
memory/2960-4-0x0000000000400000-0x00000000004E8000-memory.dmp

Filesize
928KB

Download
memory/2960-12-0x0000000000400000-0x00000000004E8000-memory.dmp

Filesize
928KB

Download
memory/2960-27-0x0000000000400000-0x00000000004E8000-memory.dmp

Filesize
928KB

Download
memory/2960-16-0x0000000000400000-0x00000000004E8000-memory.dmp

Filesize
928KB

Download
memory/2960-17-0x0000000000400000-0x00000000004E8000-memory.dmp

Filesize
928KB

Download
memory/2960-18-0x0000000000400000-0x00000000004E8000-memory.dmp

Filesize
928KB

Download
memory/2960-19-0x0000000000400000-0x00000000004E8000-memory.dmp

Filesize
928KB

Download
memory/2960-20-0x0000000000400000-0x00000000004E8000-memory.dmp

Filesize
928KB

Download
memory/2960-21-0x0000000000400000-0x00000000004E8000-memory.dmp

Filesize
928KB

Download
memory/2960-24-0x0000000000400000-0x00000000004E8000-memory.dmp

Filesize
928KB

Download
memory/2960-26-0x0000000000400000-0x00000000004E8000-memory.dmp

Filesize
928KB

Download
memory/4948-0-0x0000000000620000-0x0000000000626000-memory.dmp

Filesize
24KB

Download

Analysis

Sharing