darkcomet | e692f3db818f09c9f3fbc18cd52ac1ed492fe83e5f54559814be58160e3b8eec

Analysis

max time kernel
120s
max time network
120s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
26/12/2024, 17:15

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
e692f3db818f09c9f3fbc18cd52ac1ed492fe83e5f54559814be58160e3b8eec.exe
Size 520KB
Sample241226-vsn7dasjct
SHA256 e692f3db818f09c9f3fbc18cd52ac1ed492fe83e5f54559814be58160e3b8eec
MD5 defa927413115841c913a0dc61e33ece
SHA1 bc20f836b27a4b743c27f46ed598a1e35bed7243
SHA512 9a863e646167403c0bbd8345359e3386e87a3b45904d0f23867a4b25ab9060a940e81ebdbf4df3788be3eb8260dd27650c409cf945c16914d08f23b676296be4
SSDEEP 6144:f9GGo2CwtGg6eeihEfph2CMvvqqSaYwpncOeC66AOa0aFtVEQfTo1ozVqMbG:f9fC3hh29Ya77A90aFtDfT5IMbG
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

darkcomet privateeye discovery rat trojan upx

Malware Config

Extracted

Family

darkcomet

Botnet

PrivateEye

ratblackshades.no-ip.biz:1604

Mutex

DC_MUTEX-ACC1R98

Attributes

gencode
8GG5LVVGljSF
install
false
offline_keylogger
true
persistence
false

Signatures

Darkcomet
DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
trojan rat darkcomet
Darkcomet family
darkcomet

Executes dropped EXE 3 IoCs

pid	Process
2336	winupd.exe
924	winupd.exe
212	winupd.exe

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 2328 set thread context of 3880	2328	e692f3db818f09c9f3fbc18cd52ac1ed492fe83e5f54559814be58160e3b8eec.exe	88
PID 2336 set thread context of 924	2336	winupd.exe	91
PID 2336 set thread context of 212	2336	winupd.exe	92

UPX packed file 12 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/212-39-0x0000000000400000-0x00000000004B7000-memory.dmp	upx
behavioral2/memory/212-41-0x0000000000400000-0x00000000004B7000-memory.dmp	upx
behavioral2/memory/212-40-0x0000000000400000-0x00000000004B7000-memory.dmp	upx
behavioral2/memory/212-43-0x0000000000400000-0x00000000004B7000-memory.dmp	upx
behavioral2/memory/212-42-0x0000000000400000-0x00000000004B7000-memory.dmp	upx
behavioral2/memory/212-37-0x0000000000400000-0x00000000004B7000-memory.dmp	upx
behavioral2/memory/212-30-0x0000000000400000-0x00000000004B7000-memory.dmp	upx
behavioral2/memory/212-46-0x0000000000400000-0x00000000004B7000-memory.dmp	upx
behavioral2/memory/212-47-0x0000000000400000-0x00000000004B7000-memory.dmp	upx
behavioral2/memory/212-48-0x0000000000400000-0x00000000004B7000-memory.dmp	upx
behavioral2/memory/212-49-0x0000000000400000-0x00000000004B7000-memory.dmp	upx
behavioral2/memory/212-50-0x0000000000400000-0x00000000004B7000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process
4852	3084	WerFault.exe

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	e692f3db818f09c9f3fbc18cd52ac1ed492fe83e5f54559814be58160e3b8eec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	e692f3db818f09c9f3fbc18cd52ac1ed492fe83e5f54559814be58160e3b8eec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	winupd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	winupd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	winupd.exe

Gathers network information 2 TTPs 1 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
3084	ipconfig.exe

Suspicious use of AdjustPrivilegeToken 24 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	212	winupd.exe
Token: SeSecurityPrivilege	212	winupd.exe
Token: SeTakeOwnershipPrivilege	212	winupd.exe
Token: SeLoadDriverPrivilege	212	winupd.exe
Token: SeSystemProfilePrivilege	212	winupd.exe
Token: SeSystemtimePrivilege	212	winupd.exe
Token: SeProfSingleProcessPrivilege	212	winupd.exe
Token: SeIncBasePriorityPrivilege	212	winupd.exe
Token: SeCreatePagefilePrivilege	212	winupd.exe
Token: SeBackupPrivilege	212	winupd.exe
Token: SeRestorePrivilege	212	winupd.exe
Token: SeShutdownPrivilege	212	winupd.exe
Token: SeDebugPrivilege	212	winupd.exe
Token: SeSystemEnvironmentPrivilege	212	winupd.exe
Token: SeChangeNotifyPrivilege	212	winupd.exe
Token: SeRemoteShutdownPrivilege	212	winupd.exe
Token: SeUndockPrivilege	212	winupd.exe
Token: SeManageVolumePrivilege	212	winupd.exe
Token: SeImpersonatePrivilege	212	winupd.exe
Token: SeCreateGlobalPrivilege	212	winupd.exe
Token: 33	212	winupd.exe
Token: 34	212	winupd.exe
Token: 35	212	winupd.exe
Token: 36	212	winupd.exe

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
2328	e692f3db818f09c9f3fbc18cd52ac1ed492fe83e5f54559814be58160e3b8eec.exe
3880	e692f3db818f09c9f3fbc18cd52ac1ed492fe83e5f54559814be58160e3b8eec.exe
2336	winupd.exe
924	winupd.exe
212	winupd.exe

Suspicious use of WriteProcessMemory 32 IoCs

description	pid	Process	procid_target
PID 2328 wrote to memory of 3880	2328	e692f3db818f09c9f3fbc18cd52ac1ed492fe83e5f54559814be58160e3b8eec.exe	88
PID 2328 wrote to memory of 3880	2328	e692f3db818f09c9f3fbc18cd52ac1ed492fe83e5f54559814be58160e3b8eec.exe	88
PID 2328 wrote to memory of 3880	2328	e692f3db818f09c9f3fbc18cd52ac1ed492fe83e5f54559814be58160e3b8eec.exe	88
PID 2328 wrote to memory of 3880	2328	e692f3db818f09c9f3fbc18cd52ac1ed492fe83e5f54559814be58160e3b8eec.exe	88
PID 2328 wrote to memory of 3880	2328	e692f3db818f09c9f3fbc18cd52ac1ed492fe83e5f54559814be58160e3b8eec.exe	88
PID 2328 wrote to memory of 3880	2328	e692f3db818f09c9f3fbc18cd52ac1ed492fe83e5f54559814be58160e3b8eec.exe	88
PID 2328 wrote to memory of 3880	2328	e692f3db818f09c9f3fbc18cd52ac1ed492fe83e5f54559814be58160e3b8eec.exe	88
PID 2328 wrote to memory of 3880	2328	e692f3db818f09c9f3fbc18cd52ac1ed492fe83e5f54559814be58160e3b8eec.exe	88
PID 3880 wrote to memory of 2336	3880	e692f3db818f09c9f3fbc18cd52ac1ed492fe83e5f54559814be58160e3b8eec.exe	89
PID 3880 wrote to memory of 2336	3880	e692f3db818f09c9f3fbc18cd52ac1ed492fe83e5f54559814be58160e3b8eec.exe	89
PID 3880 wrote to memory of 2336	3880	e692f3db818f09c9f3fbc18cd52ac1ed492fe83e5f54559814be58160e3b8eec.exe	89
PID 2336 wrote to memory of 924	2336	winupd.exe	91
PID 2336 wrote to memory of 924	2336	winupd.exe	91
PID 2336 wrote to memory of 924	2336	winupd.exe	91
PID 2336 wrote to memory of 924	2336	winupd.exe	91
PID 2336 wrote to memory of 924	2336	winupd.exe	91
PID 2336 wrote to memory of 924	2336	winupd.exe	91
PID 2336 wrote to memory of 924	2336	winupd.exe	91
PID 2336 wrote to memory of 924	2336	winupd.exe	91
PID 2336 wrote to memory of 212	2336	winupd.exe	92
PID 2336 wrote to memory of 212	2336	winupd.exe	92
PID 2336 wrote to memory of 212	2336	winupd.exe	92
PID 2336 wrote to memory of 212	2336	winupd.exe	92
PID 2336 wrote to memory of 212	2336	winupd.exe	92
PID 2336 wrote to memory of 212	2336	winupd.exe	92
PID 2336 wrote to memory of 212	2336	winupd.exe	92
PID 2336 wrote to memory of 212	2336	winupd.exe	92
PID 924 wrote to memory of 3084	924	winupd.exe	93
PID 924 wrote to memory of 3084	924	winupd.exe	93
PID 924 wrote to memory of 3084	924	winupd.exe	93
PID 924 wrote to memory of 3084	924	winupd.exe	93
PID 924 wrote to memory of 3084	924	winupd.exe	93

C:\Users\Admin\AppData\Local\Temp\e692f3db818f09c9f3fbc18cd52ac1ed492fe83e5f54559814be58160e3b8eec.exe
"C:\Users\Admin\AppData\Local\Temp\e692f3db818f09c9f3fbc18cd52ac1ed492fe83e5f54559814be58160e3b8eec.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2328
- C:\Users\Admin\AppData\Local\Temp\e692f3db818f09c9f3fbc18cd52ac1ed492fe83e5f54559814be58160e3b8eec.exe
  "C:\Users\Admin\AppData\Local\Temp\e692f3db818f09c9f3fbc18cd52ac1ed492fe83e5f54559814be58160e3b8eec.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3880
- - C:\Users\Admin\AppData\Roaming\Microsoft\winupd.exe
    C:\Users\Admin\AppData\Roaming\Microsoft\winupd.exe -notray
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2336
  - - C:\Users\Admin\AppData\Roaming\Microsoft\winupd.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\winupd.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:924
    - - C:\Windows\SysWOW64\ipconfig.exe
        
        "C:\Windows\system32\ipconfig.exe"
        5⤵
        Gathers network information
        
        PID:3084
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3084 -s 272
        6⤵
        Program crash
        
        PID:4852
  - - C:\Users\Admin\AppData\Roaming\Microsoft\winupd.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\winupd.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of SetWindowsHookEx
      PID:212

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3084 -ip 3084
1⤵
PID:452

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

winupd.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\winupd.exe
Size 520KB
SHA256 3ed3decd048d402ab218fdaf7c2ac94b95761c4bab44b217c7d6ea7d8c825b51
MD5 611e8a4bc919a92fa46b85a3eb35a9e5
SHA1 235c3113481160699888bb4a48f83f148ac15b5e
SHA512 f360e1429447a7c26aec32a4a47a0b39a3ab794d03fea756962a61b423661f8178aa886e8fdf42578dd4de0f6d3d46ba5b77851fa2e012def70de4fbdd2525a5
SSDEEP 6144:f9GGo2CwtGg6eeihEfph2CMvvqqSaYwpncOeC66AOa0aFtVEQfTo1ozVqMb3:f9fC3hh29Ya77A90aFtDfT5IMb3
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/212-40-0x0000000000400000-0x00000000004B7000-memory.dmp

Download

memory/212-47-0x0000000000400000-0x00000000004B7000-memory.dmp

Download

memory/212-50-0x0000000000400000-0x00000000004B7000-memory.dmp

Download

memory/212-49-0x0000000000400000-0x00000000004B7000-memory.dmp

Download

memory/212-37-0x0000000000400000-0x00000000004B7000-memory.dmp

Download

memory/212-30-0x0000000000400000-0x00000000004B7000-memory.dmp

Download

memory/212-46-0x0000000000400000-0x00000000004B7000-memory.dmp

Download

memory/212-48-0x0000000000400000-0x00000000004B7000-memory.dmp

Download

memory/212-42-0x0000000000400000-0x00000000004B7000-memory.dmp

Download

memory/212-39-0x0000000000400000-0x00000000004B7000-memory.dmp

Download

memory/212-41-0x0000000000400000-0x00000000004B7000-memory.dmp

Download

memory/212-43-0x0000000000400000-0x00000000004B7000-memory.dmp

Download

memory/924-36-0x0000000000400000-0x0000000000407000-memory.dmp

Download

memory/924-44-0x0000000000400000-0x0000000000407000-memory.dmp

Download

memory/2328-9-0x0000000000400000-0x0000000000414000-memory.dmp

Download

memory/2328-2-0x0000000000400000-0x0000000000414000-memory.dmp

Download

memory/2328-3-0x0000000000400000-0x0000000000483000-memory.dmp

Download

memory/2328-10-0x0000000000400000-0x0000000000483000-memory.dmp

Download

memory/2328-4-0x0000000000400000-0x0000000000483000-memory.dmp

Download

memory/2336-24-0x0000000000400000-0x0000000000483000-memory.dmp

Download

memory/2336-34-0x0000000000400000-0x0000000000483000-memory.dmp

Download

memory/2336-29-0x0000000000400000-0x0000000000483000-memory.dmp

Download

memory/3880-23-0x0000000000400000-0x0000000000407000-memory.dmp

Download

memory/3880-20-0x0000000000400000-0x0000000000407000-memory.dmp

Download

memory/3880-5-0x0000000000400000-0x0000000000407000-memory.dmp

Download

memory/3880-7-0x0000000000400000-0x0000000000407000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads