darkcomet | 038531d52fb5fc61c11beabcc05b8ae3f0a988cddbfab0db2f1e99bcb3c6757d

General

Target

038531d52fb5fc61c11beabcc05b8ae3f0a988cddbfab0db2f1e99bcb3c6757d.exe
Size

4.5MB
MD5

ac9e4c837b4617a8f76b8f06f23d3c68
SHA1

d210f651d289a8e8b7b984735eb9b0df1b25278d
SHA256

038531d52fb5fc61c11beabcc05b8ae3f0a988cddbfab0db2f1e99bcb3c6757d
SHA512

45c3714e2b8f828e7b72bffc882801e3682f23bfb2abb5a8685550b710542cad31c1f902d906e32c0f9acb97e14e38da6cd93d171643925543a231adfe90b9b4
SSDEEP

49152:VNkIeCY8EHOEoYzTny4X6gO0DA4HlEzD4ft7:d4ft7

Score

10^/10

darkcomet crypter_t411 discovery rat trojan upx

Malware Config

Extracted

Family

darkcomet

Botnet

crypter_t411

C2

milanilou007.ddns.me:1604

Mutex

DC_MUTEX-92C3TY1

Attributes

gencode
KpEHFrlns92y
install
false
offline_keylogger
true
persistence
false

Signatures

Darkcomet
DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
trojan rat darkcomet
Darkcomet family
darkcomet

Executes dropped EXE 3 IoCs

Processes:

installerfile.exeMINILYRICS02.EXEMINILYRICS02.EXE

pid	Process
2340	installerfile.exe
2456	MINILYRICS02.EXE
2868	MINILYRICS02.EXE

Loads dropped DLL 15 IoCs

Processes:

installerfile.exeMINILYRICS02.EXEMINILYRICS02.EXE

pid	Process
2340	installerfile.exe
2340	installerfile.exe
2340	installerfile.exe
2340	installerfile.exe
2456	MINILYRICS02.EXE
2456	MINILYRICS02.EXE
2456	MINILYRICS02.EXE
2456	MINILYRICS02.EXE
2340	installerfile.exe
2868	MINILYRICS02.EXE
2868	MINILYRICS02.EXE
2868	MINILYRICS02.EXE
2868	MINILYRICS02.EXE
2456	MINILYRICS02.EXE
2868	MINILYRICS02.EXE

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral1/files/0x0007000000012118-7.dat	upx
behavioral1/memory/2340-9-0x0000000000400000-0x0000000000613000-memory.dmp	upx
behavioral1/memory/2340-120-0x0000000000400000-0x0000000000613000-memory.dmp	upx
behavioral1/memory/2340-125-0x0000000000400000-0x0000000000613000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

installerfile.exeMINILYRICS02.EXEMINILYRICS02.EXE

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	installerfile.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MINILYRICS02.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MINILYRICS02.EXE

NSIS installer 1 IoCs

installer

Processes:

resource	yara_rule
behavioral1/files/0x0009000000016d47-19.dat	nsis_installer_1

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

Processes:

MINILYRICS02.EXEMINILYRICS02.EXE

pid	Process
2868	MINILYRICS02.EXE
2456	MINILYRICS02.EXE

Suspicious use of AdjustPrivilegeToken 24 IoCs

Processes:

038531d52fb5fc61c11beabcc05b8ae3f0a988cddbfab0db2f1e99bcb3c6757d.exeinstallerfile.exe

description	pid	Process
Token: SeDebugPrivilege	2348	038531d52fb5fc61c11beabcc05b8ae3f0a988cddbfab0db2f1e99bcb3c6757d.exe
Token: SeIncreaseQuotaPrivilege	2340	installerfile.exe
Token: SeSecurityPrivilege	2340	installerfile.exe
Token: SeTakeOwnershipPrivilege	2340	installerfile.exe
Token: SeLoadDriverPrivilege	2340	installerfile.exe
Token: SeSystemProfilePrivilege	2340	installerfile.exe
Token: SeSystemtimePrivilege	2340	installerfile.exe
Token: SeProfSingleProcessPrivilege	2340	installerfile.exe
Token: SeIncBasePriorityPrivilege	2340	installerfile.exe
Token: SeCreatePagefilePrivilege	2340	installerfile.exe
Token: SeBackupPrivilege	2340	installerfile.exe
Token: SeRestorePrivilege	2340	installerfile.exe
Token: SeShutdownPrivilege	2340	installerfile.exe
Token: SeDebugPrivilege	2340	installerfile.exe
Token: SeSystemEnvironmentPrivilege	2340	installerfile.exe
Token: SeChangeNotifyPrivilege	2340	installerfile.exe
Token: SeRemoteShutdownPrivilege	2340	installerfile.exe
Token: SeUndockPrivilege	2340	installerfile.exe
Token: SeManageVolumePrivilege	2340	installerfile.exe
Token: SeImpersonatePrivilege	2340	installerfile.exe
Token: SeCreateGlobalPrivilege	2340	installerfile.exe
Token: 33	2340	installerfile.exe
Token: 34	2340	installerfile.exe
Token: 35	2340	installerfile.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

installerfile.exe

pid	Process
2340	installerfile.exe

Suspicious use of WriteProcessMemory 21 IoCs

Processes:

038531d52fb5fc61c11beabcc05b8ae3f0a988cddbfab0db2f1e99bcb3c6757d.exeinstallerfile.exe

description	pid	Process	procid_target
PID 2348 wrote to memory of 2340	2348	038531d52fb5fc61c11beabcc05b8ae3f0a988cddbfab0db2f1e99bcb3c6757d.exe	30
PID 2348 wrote to memory of 2340	2348	038531d52fb5fc61c11beabcc05b8ae3f0a988cddbfab0db2f1e99bcb3c6757d.exe	30
PID 2348 wrote to memory of 2340	2348	038531d52fb5fc61c11beabcc05b8ae3f0a988cddbfab0db2f1e99bcb3c6757d.exe	30
PID 2348 wrote to memory of 2340	2348	038531d52fb5fc61c11beabcc05b8ae3f0a988cddbfab0db2f1e99bcb3c6757d.exe	30
PID 2348 wrote to memory of 2340	2348	038531d52fb5fc61c11beabcc05b8ae3f0a988cddbfab0db2f1e99bcb3c6757d.exe	30
PID 2348 wrote to memory of 2340	2348	038531d52fb5fc61c11beabcc05b8ae3f0a988cddbfab0db2f1e99bcb3c6757d.exe	30
PID 2348 wrote to memory of 2340	2348	038531d52fb5fc61c11beabcc05b8ae3f0a988cddbfab0db2f1e99bcb3c6757d.exe	30
PID 2340 wrote to memory of 2456	2340	installerfile.exe	31
PID 2340 wrote to memory of 2456	2340	installerfile.exe	31
PID 2340 wrote to memory of 2456	2340	installerfile.exe	31
PID 2340 wrote to memory of 2456	2340	installerfile.exe	31
PID 2340 wrote to memory of 2456	2340	installerfile.exe	31
PID 2340 wrote to memory of 2456	2340	installerfile.exe	31
PID 2340 wrote to memory of 2456	2340	installerfile.exe	31
PID 2340 wrote to memory of 2868	2340	installerfile.exe	32
PID 2340 wrote to memory of 2868	2340	installerfile.exe	32
PID 2340 wrote to memory of 2868	2340	installerfile.exe	32
PID 2340 wrote to memory of 2868	2340	installerfile.exe	32
PID 2340 wrote to memory of 2868	2340	installerfile.exe	32
PID 2340 wrote to memory of 2868	2340	installerfile.exe	32
PID 2340 wrote to memory of 2868	2340	installerfile.exe	32

C:\Users\Admin\AppData\Local\Temp\038531d52fb5fc61c11beabcc05b8ae3f0a988cddbfab0db2f1e99bcb3c6757d.exe
"C:\Users\Admin\AppData\Local\Temp\038531d52fb5fc61c11beabcc05b8ae3f0a988cddbfab0db2f1e99bcb3c6757d.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2348
- C:\Users\Admin\AppData\Local\Temp\installerfile.exe
  "C:\Users\Admin\AppData\Local\Temp\installerfile.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2340
- - C:\Users\Admin\AppData\Local\Temp\MINILYRICS02.EXE
    "C:\Users\Admin\AppData\Local\Temp\MINILYRICS02.EXE"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: GetForegroundWindowSpam
    PID:2456
- - C:\Users\Admin\AppData\Local\Temp\MINILYRICS02.EXE
    "C:\Users\Admin\AppData\Local\Temp\MINILYRICS02.EXE"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: GetForegroundWindowSpam
    PID:2868

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\installerfile.exe

Filesize
1.6MB

MD5
4a163c1e8faa4e78b56d25b2366aade5

SHA1
08a2acb90974547404ed68cbbd5f6670e3492503

SHA256
733847379f65033335aefb8ee2ff26a97d2261dc1a7e32af764a879986909108

SHA512
c644be8665dceddb987518feeb8af31e313e55003352a6e2525421fefa056670ab3d74fdab683ff2d977780200ccfe48268dedd76a080cce1d05147cfa7a11b7

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsdC7D3.tmp\instopt.ini

Filesize
785B

MD5
6e56f023c89ea7930c869514c1c3df6e

SHA1
ca80af91b6aea9d89a0ddfbf08f64d14203ecbdf

SHA256
7bf32323012c92f989b24d2ad75153f256d0ab44009854fb989b9470ed81d84f

SHA512
04b1b46a5506ca38f591b09dd53c384299dedddbbe636fb26c3226e21386a5e19ddb389123d0af7cf444881b7b07384d64dffed4513f4044b1afd79c01dda606

Download Submit
\Users\Admin\AppData\Local\Temp\MINILYRICS02.EXE

Filesize
1.2MB

MD5
b300638f24c0673f9734585935fe5767

SHA1
feef51aa5c64d785be87c9c1ac4fbbc476e86dee

SHA256
8bdeb231f5a78e83ef8851ccbd76c530f8c0c88470da463953d03ed3acb8efea

SHA512
a8339d0298685273e77ff0640dd49df3f3da616d744adcd529ca5953900452b1dfe4963b9c7215a2c05e711f90b82839adb44d17098eef17842f57e067c980ad

Download Submit
\Users\Admin\AppData\Local\Temp\nsdC7D3.tmp\Installopt.dll

Filesize
27KB

MD5
e920530682d8a447f5eff132ead4d869

SHA1
d3336dd91694398f93434f4416247c01acb3b81d

SHA256
d828c804bdd845d95292038c5d90413b51625378e9df83dec49af70a76880323

SHA512
6b0b02fcad48d74be850e9fb3d18c7f3dd76e09e2fd024389a397d51cfaac8b65b2abd83b96b88d23f1a5fbae1b02641d0b947604841d1fbaa6adbb1dd00c03d

Download Submit
\Users\Admin\AppData\Local\Temp\nsdC7D3.tmp\LangDLL.dll

Filesize
5KB

MD5
fbbf9da918557aba6fa6e166a95ee8dd

SHA1
abbd02abae00172971a2e9cef62dab3b562f90c7

SHA256
dc7daec6f47e63b5d001cd648d40d93c29be6f2c95fe8b212dbb4d94d31cb12d

SHA512
0f877a9e5c6eb06374f0f19f92a6ea55b09998c42c67b16db680918e3e0c2023d511893173f76dde60a47ffe916b0d9af09b6255a158fa3e0743dc54d2a35a65

Download Submit
memory/2340-9-0x0000000000400000-0x0000000000613000-memory.dmp

Filesize
2.1MB

Download
memory/2340-16-0x0000000000D60000-0x0000000000F73000-memory.dmp

Filesize
2.1MB

Download
memory/2340-15-0x0000000000D60000-0x0000000000F73000-memory.dmp

Filesize
2.1MB

Download
memory/2340-13-0x0000000000D60000-0x0000000000F73000-memory.dmp

Filesize
2.1MB

Download
memory/2340-120-0x0000000000400000-0x0000000000613000-memory.dmp

Filesize
2.1MB

Download
memory/2340-121-0x0000000000D60000-0x0000000000F73000-memory.dmp

Filesize
2.1MB

Download
memory/2340-122-0x0000000000D60000-0x0000000000F73000-memory.dmp

Filesize
2.1MB

Download
memory/2340-124-0x0000000000D60000-0x0000000000F73000-memory.dmp

Filesize
2.1MB

Download
memory/2340-125-0x0000000000400000-0x0000000000613000-memory.dmp

Filesize
2.1MB

Download
memory/2348-8-0x000007FEF5400000-0x000007FEF5D9D000-memory.dmp

Filesize
9.6MB

Download
memory/2348-0-0x000007FEF56BE000-0x000007FEF56BF000-memory.dmp

Filesize
4KB

Download
memory/2348-3-0x000007FEF5400000-0x000007FEF5D9D000-memory.dmp

Filesize
9.6MB

Download
memory/2348-1-0x000007FEF5400000-0x000007FEF5D9D000-memory.dmp

Filesize
9.6MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads