darkcomet | 5784b9741f4e919bcf200b94753640ec34fe0ab10435c2b26e580c41db326e59

General

Target

5784b9741f4e919bcf200b94753640ec34fe0ab10435c2b26e580c41db326e59N.exe
Size

3.8MB
MD5

1e349275288f530d34234aa37e72d4a0
SHA1

67f2d33cdee5e54cc34477dcc441cc54bc6d2584
SHA256

5784b9741f4e919bcf200b94753640ec34fe0ab10435c2b26e580c41db326e59
SHA512

4e2a087495f0da2b6c6de3d25082f83cc6c5c7c2eef9a59f8a51b4300701f1139963035205bf23a0ce15b9037ee3f64dc6bb6d1b3f8057ff5b04179252a8a481
SSDEEP

98304:3i4hTLOMtHDMlANqnfVGPyhcMYg4lSiSLCQrdGLcjFjj/eWKS5h7EleIljztU/qN:3i4hTLOMtHDMlANqnfVGPyhcMYg4lSiP

Score

10^/10

darkcomet discovery persistence rat trojan upx

Malware Config

Signatures

Darkcomet
DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
trojan rat darkcomet
Darkcomet family
darkcomet
Checks BIOS information in registry 2 TTPs 1 IoCs
BIOS information is often read in order to detect sandboxing environments.

Query Registry
T1012

System Information Discovery
T1082

Processes:

mcsft.exe

description ioc process

Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate mcsft.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate	mcsft.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

5784b9741f4e919bcf200b94753640ec34fe0ab10435c2b26e580c41db326e59N.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation	5784b9741f4e919bcf200b94753640ec34fe0ab10435c2b26e580c41db326e59N.exe

Executes dropped EXE 2 IoCs

Processes:

mcsft.exemcsft.exe

pid process

2328 mcsft.exe
1812 mcsft.exe

pid	process
2328	mcsft.exe
1812	mcsft.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

reg.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Mcrosoft = "C:\\Users\\Admin\\AppData\\Roaming\\mcsft.exe"	reg.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

mcsft.exe

description pid process target process

PID 2328 set thread context of 1812 2328 mcsft.exe mcsft.exe

description	pid	process	target process
PID 2328 set thread context of 1812	2328	mcsft.exe	mcsft.exe

UPX packed file 26 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral2/memory/3068-0-0x0000000000400000-0x00000000007C9000-memory.dmp	upx
C:\Users\Admin\AppData\Roaming\mcsft.txt	upx
behavioral2/memory/3068-28-0x0000000000400000-0x00000000007C9000-memory.dmp	upx
behavioral2/memory/1812-34-0x0000000000400000-0x00000000004B5000-memory.dmp	upx
behavioral2/memory/1812-35-0x0000000000400000-0x00000000004B5000-memory.dmp	upx
behavioral2/memory/2328-36-0x0000000000400000-0x00000000007C9000-memory.dmp	upx
behavioral2/memory/1812-31-0x0000000000400000-0x00000000004B5000-memory.dmp	upx
behavioral2/memory/1812-38-0x0000000000400000-0x00000000004B5000-memory.dmp	upx
behavioral2/memory/1812-37-0x0000000000400000-0x00000000004B5000-memory.dmp	upx
behavioral2/memory/1812-39-0x0000000000400000-0x00000000004B5000-memory.dmp	upx
behavioral2/memory/1812-42-0x0000000000400000-0x00000000004B5000-memory.dmp	upx
behavioral2/memory/1812-41-0x0000000000400000-0x00000000004B5000-memory.dmp	upx
behavioral2/memory/1812-40-0x0000000000400000-0x00000000004B5000-memory.dmp	upx
behavioral2/memory/1812-43-0x0000000000400000-0x00000000004B5000-memory.dmp	upx
behavioral2/memory/1812-44-0x0000000000400000-0x00000000004B5000-memory.dmp	upx
behavioral2/memory/1812-45-0x0000000000400000-0x00000000004B5000-memory.dmp	upx
behavioral2/memory/1812-46-0x0000000000400000-0x00000000004B5000-memory.dmp	upx
behavioral2/memory/1812-47-0x0000000000400000-0x00000000004B5000-memory.dmp	upx
behavioral2/memory/1812-48-0x0000000000400000-0x00000000004B5000-memory.dmp	upx
behavioral2/memory/1812-49-0x0000000000400000-0x00000000004B5000-memory.dmp	upx
behavioral2/memory/1812-50-0x0000000000400000-0x00000000004B5000-memory.dmp	upx
behavioral2/memory/1812-51-0x0000000000400000-0x00000000004B5000-memory.dmp	upx
behavioral2/memory/1812-52-0x0000000000400000-0x00000000004B5000-memory.dmp	upx
behavioral2/memory/1812-53-0x0000000000400000-0x00000000004B5000-memory.dmp	upx
behavioral2/memory/1812-54-0x0000000000400000-0x00000000004B5000-memory.dmp	upx
behavioral2/memory/1812-55-0x0000000000400000-0x00000000004B5000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

5784b9741f4e919bcf200b94753640ec34fe0ab10435c2b26e580c41db326e59N.execmd.exereg.exemcsft.exemcsft.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	5784b9741f4e919bcf200b94753640ec34fe0ab10435c2b26e580c41db326e59N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mcsft.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mcsft.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

mcsft.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	mcsft.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	mcsft.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	mcsft.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	mcsft.exe

Enumerates system info in registry 2 TTPs 1 IoCs

Query Registry
T1012

System Information Discovery
T1082

Processes:

mcsft.exe

description ioc process

Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier mcsft.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	mcsft.exe

Suspicious use of AdjustPrivilegeToken 24 IoCs

Processes:

mcsft.exe

description	pid	process
Token: SeIncreaseQuotaPrivilege	1812	mcsft.exe
Token: SeSecurityPrivilege	1812	mcsft.exe
Token: SeTakeOwnershipPrivilege	1812	mcsft.exe
Token: SeLoadDriverPrivilege	1812	mcsft.exe
Token: SeSystemProfilePrivilege	1812	mcsft.exe
Token: SeSystemtimePrivilege	1812	mcsft.exe
Token: SeProfSingleProcessPrivilege	1812	mcsft.exe
Token: SeIncBasePriorityPrivilege	1812	mcsft.exe
Token: SeCreatePagefilePrivilege	1812	mcsft.exe
Token: SeBackupPrivilege	1812	mcsft.exe
Token: SeRestorePrivilege	1812	mcsft.exe
Token: SeShutdownPrivilege	1812	mcsft.exe
Token: SeDebugPrivilege	1812	mcsft.exe
Token: SeSystemEnvironmentPrivilege	1812	mcsft.exe
Token: SeChangeNotifyPrivilege	1812	mcsft.exe
Token: SeRemoteShutdownPrivilege	1812	mcsft.exe
Token: SeUndockPrivilege	1812	mcsft.exe
Token: SeManageVolumePrivilege	1812	mcsft.exe
Token: SeImpersonatePrivilege	1812	mcsft.exe
Token: SeCreateGlobalPrivilege	1812	mcsft.exe
Token: 33	1812	mcsft.exe
Token: 34	1812	mcsft.exe
Token: 35	1812	mcsft.exe
Token: 36	1812	mcsft.exe

Suspicious use of SetWindowsHookEx 3 IoCs

Processes:

5784b9741f4e919bcf200b94753640ec34fe0ab10435c2b26e580c41db326e59N.exemcsft.exemcsft.exe

pid process

3068 5784b9741f4e919bcf200b94753640ec34fe0ab10435c2b26e580c41db326e59N.exe
2328 mcsft.exe
1812 mcsft.exe

pid	process
3068	5784b9741f4e919bcf200b94753640ec34fe0ab10435c2b26e580c41db326e59N.exe
2328	mcsft.exe
1812	mcsft.exe

Suspicious use of WriteProcessMemory 17 IoCs

Processes:

5784b9741f4e919bcf200b94753640ec34fe0ab10435c2b26e580c41db326e59N.execmd.exemcsft.exe

description	pid	process	target process
PID 3068 wrote to memory of 2312	3068	5784b9741f4e919bcf200b94753640ec34fe0ab10435c2b26e580c41db326e59N.exe	cmd.exe
PID 3068 wrote to memory of 2312	3068	5784b9741f4e919bcf200b94753640ec34fe0ab10435c2b26e580c41db326e59N.exe	cmd.exe
PID 3068 wrote to memory of 2312	3068	5784b9741f4e919bcf200b94753640ec34fe0ab10435c2b26e580c41db326e59N.exe	cmd.exe
PID 2312 wrote to memory of 4896	2312	cmd.exe	reg.exe
PID 2312 wrote to memory of 4896	2312	cmd.exe	reg.exe
PID 2312 wrote to memory of 4896	2312	cmd.exe	reg.exe
PID 3068 wrote to memory of 2328	3068	5784b9741f4e919bcf200b94753640ec34fe0ab10435c2b26e580c41db326e59N.exe	mcsft.exe
PID 3068 wrote to memory of 2328	3068	5784b9741f4e919bcf200b94753640ec34fe0ab10435c2b26e580c41db326e59N.exe	mcsft.exe
PID 3068 wrote to memory of 2328	3068	5784b9741f4e919bcf200b94753640ec34fe0ab10435c2b26e580c41db326e59N.exe	mcsft.exe
PID 2328 wrote to memory of 1812	2328	mcsft.exe	mcsft.exe
PID 2328 wrote to memory of 1812	2328	mcsft.exe	mcsft.exe
PID 2328 wrote to memory of 1812	2328	mcsft.exe	mcsft.exe
PID 2328 wrote to memory of 1812	2328	mcsft.exe	mcsft.exe
PID 2328 wrote to memory of 1812	2328	mcsft.exe	mcsft.exe
PID 2328 wrote to memory of 1812	2328	mcsft.exe	mcsft.exe
PID 2328 wrote to memory of 1812	2328	mcsft.exe	mcsft.exe
PID 2328 wrote to memory of 1812	2328	mcsft.exe	mcsft.exe

C:\Users\Admin\AppData\Local\Temp\5784b9741f4e919bcf200b94753640ec34fe0ab10435c2b26e580c41db326e59N.exe
"C:\Users\Admin\AppData\Local\Temp\5784b9741f4e919bcf200b94753640ec34fe0ab10435c2b26e580c41db326e59N.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3068
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\EDned.bat" "
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2312
- - C:\Windows\SysWOW64\reg.exe
    REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "Mcrosoft" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\mcsft.exe" /f
    3⤵
    - Adds Run key to start application
    - System Location Discovery: System Language Discovery
    PID:4896
- C:\Users\Admin\AppData\Roaming\mcsft.exe
  "C:\Users\Admin\AppData\Roaming\mcsft.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2328
- - C:\Users\Admin\AppData\Roaming\mcsft.exe
    C:\Users\Admin\AppData\Roaming\mcsft.exe
    3⤵
    - Checks BIOS information in registry
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Checks processor information in registry
    - Enumerates system info in registry
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    PID:1812

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

4

T1012

System Information Discovery

5

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\EDned.txt

Filesize
135B

MD5
a5feca573884d76f559b996d45e8ad9a

SHA1
0e81a993f3af4e31d60653dc2513186f0495f1c8

SHA256
c98e20d46d6465febb5d29cfab51241521ea5d6cd621f5e18b9b7d6fbfac3f0f

SHA512
a9239648b5f15eac4d4151b6e1bdc81065eeaeb101404c2a0126f03bc87f1e6a57206bfa07a44379e9d3bba889e4497a9991ff41fb109099b01512df3dc3cbda

Download Submit
C:\Users\Admin\AppData\Roaming\mcsft.txt

Filesize
3.8MB

MD5
e01070480413f241bef5cf059538ab4a

SHA1
ee16d9df363fbd532429a021af9f3abe812df55d

SHA256
0e3be6e2a13cdd491918972ff665fdc7fb7370d00b5a9e0ff27d7f867b72b23f

SHA512
d381501199e0ad66cb1db18518a6fed0d449431d551a37c2dfdfea4c00099582ef0f4daa89bcb1cfe89cb461dbdae2d80f86c6dcda2c4ba495b51199c8d2fdd8

Download Submit
memory/1812-47-0x0000000000400000-0x00000000004B5000-memory.dmp

Filesize
724KB

Download
memory/1812-50-0x0000000000400000-0x00000000004B5000-memory.dmp

Filesize
724KB

Download
memory/1812-43-0x0000000000400000-0x00000000004B5000-memory.dmp

Filesize
724KB

Download
memory/1812-35-0x0000000000400000-0x00000000004B5000-memory.dmp

Filesize
724KB

Download
memory/1812-44-0x0000000000400000-0x00000000004B5000-memory.dmp

Filesize
724KB

Download
memory/1812-31-0x0000000000400000-0x00000000004B5000-memory.dmp

Filesize
724KB

Download
memory/1812-38-0x0000000000400000-0x00000000004B5000-memory.dmp

Filesize
724KB

Download
memory/1812-45-0x0000000000400000-0x00000000004B5000-memory.dmp

Filesize
724KB

Download
memory/1812-39-0x0000000000400000-0x00000000004B5000-memory.dmp

Filesize
724KB

Download
memory/1812-42-0x0000000000400000-0x00000000004B5000-memory.dmp

Filesize
724KB

Download
memory/1812-41-0x0000000000400000-0x00000000004B5000-memory.dmp

Filesize
724KB

Download
memory/1812-40-0x0000000000400000-0x00000000004B5000-memory.dmp

Filesize
724KB

Download
memory/1812-34-0x0000000000400000-0x00000000004B5000-memory.dmp

Filesize
724KB

Download
memory/1812-55-0x0000000000400000-0x00000000004B5000-memory.dmp

Filesize
724KB

Download
memory/1812-37-0x0000000000400000-0x00000000004B5000-memory.dmp

Filesize
724KB

Download
memory/1812-46-0x0000000000400000-0x00000000004B5000-memory.dmp

Filesize
724KB

Download
memory/1812-54-0x0000000000400000-0x00000000004B5000-memory.dmp

Filesize
724KB

Download
memory/1812-48-0x0000000000400000-0x00000000004B5000-memory.dmp

Filesize
724KB

Download
memory/1812-49-0x0000000000400000-0x00000000004B5000-memory.dmp

Filesize
724KB

Download
memory/1812-53-0x0000000000400000-0x00000000004B5000-memory.dmp

Filesize
724KB

Download
memory/1812-51-0x0000000000400000-0x00000000004B5000-memory.dmp

Filesize
724KB

Download
memory/1812-52-0x0000000000400000-0x00000000004B5000-memory.dmp

Filesize
724KB

Download
memory/2328-36-0x0000000000400000-0x00000000007C9000-memory.dmp

Filesize
3.8MB

Download
memory/3068-28-0x0000000000400000-0x00000000007C9000-memory.dmp

Filesize
3.8MB

Download
memory/3068-0-0x0000000000400000-0x00000000007C9000-memory.dmp

Filesize
3.8MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads