darkcomet | 2a1a8df37dbbac87d0cf4c9ab81e94562847ed60a688960a648fe16353bf0492

Analysis

max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
02-01-2025 21:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2a1a8df37dbbac87d0cf4c9ab81e94562847ed60a688960a648fe16353bf0492.exe
Size

520KB
MD5

5e0b2bc839de9893f2c78ecd5d53ab88
SHA1

588785a0d25f6a34e9fc1499364e10f9e0b83338
SHA256

2a1a8df37dbbac87d0cf4c9ab81e94562847ed60a688960a648fe16353bf0492
SHA512

5b8556aaeaa8fb0c9626e546dc5f7a0b4f39a4e92b0973b4a896e0a595cf424a46d37024ccefed641c582d31ee448df95c77d07b2a2f52441d507f8ba3124a3d
SSDEEP

6144:f9GGo2CwtGg6eeihEfph2CMvvqqSaYwpncOeC66AOa0aFtVEQfTo1ozVqMbq:f9fC3hh29Ya77A90aFtDfT5IMbq

Score

10^/10

darkcomet privateeye discovery rat trojan upx

Malware Config

Extracted

Family

darkcomet

Botnet

PrivateEye

ratblackshades.no-ip.biz:1604

Mutex

DC_MUTEX-ACC1R98

Attributes

gencode
8GG5LVVGljSF
install
false
offline_keylogger
true
persistence
false

Signatures

Darkcomet
DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
trojan rat darkcomet
Darkcomet family
darkcomet

Executes dropped EXE 3 IoCs

pid	Process
4116	winupd.exe
2844	winupd.exe
3308	winupd.exe

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 4776 set thread context of 1444	4776	2a1a8df37dbbac87d0cf4c9ab81e94562847ed60a688960a648fe16353bf0492.exe	93
PID 4116 set thread context of 2844	4116	winupd.exe	98
PID 4116 set thread context of 3308	4116	winupd.exe	99

UPX packed file 18 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3308-36-0x0000000000400000-0x00000000004B7000-memory.dmp	upx
behavioral2/memory/3308-38-0x0000000000400000-0x00000000004B7000-memory.dmp	upx
behavioral2/memory/3308-40-0x0000000000400000-0x00000000004B7000-memory.dmp	upx
behavioral2/memory/3308-42-0x0000000000400000-0x00000000004B7000-memory.dmp	upx
behavioral2/memory/3308-41-0x0000000000400000-0x00000000004B7000-memory.dmp	upx
behavioral2/memory/3308-39-0x0000000000400000-0x00000000004B7000-memory.dmp	upx
behavioral2/memory/3308-35-0x0000000000400000-0x00000000004B7000-memory.dmp	upx
behavioral2/memory/3308-46-0x0000000000400000-0x00000000004B7000-memory.dmp	upx
behavioral2/memory/3308-47-0x0000000000400000-0x00000000004B7000-memory.dmp	upx
behavioral2/memory/3308-48-0x0000000000400000-0x00000000004B7000-memory.dmp	upx
behavioral2/memory/3308-49-0x0000000000400000-0x00000000004B7000-memory.dmp	upx
behavioral2/memory/3308-50-0x0000000000400000-0x00000000004B7000-memory.dmp	upx
behavioral2/memory/3308-51-0x0000000000400000-0x00000000004B7000-memory.dmp	upx
behavioral2/memory/3308-52-0x0000000000400000-0x00000000004B7000-memory.dmp	upx
behavioral2/memory/3308-53-0x0000000000400000-0x00000000004B7000-memory.dmp	upx
behavioral2/memory/3308-54-0x0000000000400000-0x00000000004B7000-memory.dmp	upx
behavioral2/memory/3308-55-0x0000000000400000-0x00000000004B7000-memory.dmp	upx
behavioral2/memory/3308-56-0x0000000000400000-0x00000000004B7000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3508	2768	WerFault.exe	100

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	winupd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2a1a8df37dbbac87d0cf4c9ab81e94562847ed60a688960a648fe16353bf0492.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2a1a8df37dbbac87d0cf4c9ab81e94562847ed60a688960a648fe16353bf0492.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	winupd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	winupd.exe

Gathers network information 2 TTPs 1 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
2768	ipconfig.exe

Suspicious use of AdjustPrivilegeToken 24 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	3308	winupd.exe
Token: SeSecurityPrivilege	3308	winupd.exe
Token: SeTakeOwnershipPrivilege	3308	winupd.exe
Token: SeLoadDriverPrivilege	3308	winupd.exe
Token: SeSystemProfilePrivilege	3308	winupd.exe
Token: SeSystemtimePrivilege	3308	winupd.exe
Token: SeProfSingleProcessPrivilege	3308	winupd.exe
Token: SeIncBasePriorityPrivilege	3308	winupd.exe
Token: SeCreatePagefilePrivilege	3308	winupd.exe
Token: SeBackupPrivilege	3308	winupd.exe
Token: SeRestorePrivilege	3308	winupd.exe
Token: SeShutdownPrivilege	3308	winupd.exe
Token: SeDebugPrivilege	3308	winupd.exe
Token: SeSystemEnvironmentPrivilege	3308	winupd.exe
Token: SeChangeNotifyPrivilege	3308	winupd.exe
Token: SeRemoteShutdownPrivilege	3308	winupd.exe
Token: SeUndockPrivilege	3308	winupd.exe
Token: SeManageVolumePrivilege	3308	winupd.exe
Token: SeImpersonatePrivilege	3308	winupd.exe
Token: SeCreateGlobalPrivilege	3308	winupd.exe
Token: 33	3308	winupd.exe
Token: 34	3308	winupd.exe
Token: 35	3308	winupd.exe
Token: 36	3308	winupd.exe

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
4776	2a1a8df37dbbac87d0cf4c9ab81e94562847ed60a688960a648fe16353bf0492.exe
1444	2a1a8df37dbbac87d0cf4c9ab81e94562847ed60a688960a648fe16353bf0492.exe
4116	winupd.exe
2844	winupd.exe
3308	winupd.exe

Suspicious use of WriteProcessMemory 32 IoCs

description	pid	Process	procid_target
PID 4776 wrote to memory of 1444	4776	2a1a8df37dbbac87d0cf4c9ab81e94562847ed60a688960a648fe16353bf0492.exe	93
PID 4776 wrote to memory of 1444	4776	2a1a8df37dbbac87d0cf4c9ab81e94562847ed60a688960a648fe16353bf0492.exe	93
PID 4776 wrote to memory of 1444	4776	2a1a8df37dbbac87d0cf4c9ab81e94562847ed60a688960a648fe16353bf0492.exe	93
PID 4776 wrote to memory of 1444	4776	2a1a8df37dbbac87d0cf4c9ab81e94562847ed60a688960a648fe16353bf0492.exe	93
PID 4776 wrote to memory of 1444	4776	2a1a8df37dbbac87d0cf4c9ab81e94562847ed60a688960a648fe16353bf0492.exe	93
PID 4776 wrote to memory of 1444	4776	2a1a8df37dbbac87d0cf4c9ab81e94562847ed60a688960a648fe16353bf0492.exe	93
PID 4776 wrote to memory of 1444	4776	2a1a8df37dbbac87d0cf4c9ab81e94562847ed60a688960a648fe16353bf0492.exe	93
PID 4776 wrote to memory of 1444	4776	2a1a8df37dbbac87d0cf4c9ab81e94562847ed60a688960a648fe16353bf0492.exe	93
PID 1444 wrote to memory of 4116	1444	2a1a8df37dbbac87d0cf4c9ab81e94562847ed60a688960a648fe16353bf0492.exe	94
PID 1444 wrote to memory of 4116	1444	2a1a8df37dbbac87d0cf4c9ab81e94562847ed60a688960a648fe16353bf0492.exe	94
PID 1444 wrote to memory of 4116	1444	2a1a8df37dbbac87d0cf4c9ab81e94562847ed60a688960a648fe16353bf0492.exe	94
PID 4116 wrote to memory of 2844	4116	winupd.exe	98
PID 4116 wrote to memory of 2844	4116	winupd.exe	98
PID 4116 wrote to memory of 2844	4116	winupd.exe	98
PID 4116 wrote to memory of 2844	4116	winupd.exe	98
PID 4116 wrote to memory of 2844	4116	winupd.exe	98
PID 4116 wrote to memory of 2844	4116	winupd.exe	98
PID 4116 wrote to memory of 2844	4116	winupd.exe	98
PID 4116 wrote to memory of 2844	4116	winupd.exe	98
PID 4116 wrote to memory of 3308	4116	winupd.exe	99
PID 4116 wrote to memory of 3308	4116	winupd.exe	99
PID 4116 wrote to memory of 3308	4116	winupd.exe	99
PID 4116 wrote to memory of 3308	4116	winupd.exe	99
PID 4116 wrote to memory of 3308	4116	winupd.exe	99
PID 4116 wrote to memory of 3308	4116	winupd.exe	99
PID 4116 wrote to memory of 3308	4116	winupd.exe	99
PID 4116 wrote to memory of 3308	4116	winupd.exe	99
PID 2844 wrote to memory of 2768	2844	winupd.exe	100
PID 2844 wrote to memory of 2768	2844	winupd.exe	100
PID 2844 wrote to memory of 2768	2844	winupd.exe	100
PID 2844 wrote to memory of 2768	2844	winupd.exe	100
PID 2844 wrote to memory of 2768	2844	winupd.exe	100

C:\Users\Admin\AppData\Local\Temp\2a1a8df37dbbac87d0cf4c9ab81e94562847ed60a688960a648fe16353bf0492.exe
"C:\Users\Admin\AppData\Local\Temp\2a1a8df37dbbac87d0cf4c9ab81e94562847ed60a688960a648fe16353bf0492.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4776
- C:\Users\Admin\AppData\Local\Temp\2a1a8df37dbbac87d0cf4c9ab81e94562847ed60a688960a648fe16353bf0492.exe
  "C:\Users\Admin\AppData\Local\Temp\2a1a8df37dbbac87d0cf4c9ab81e94562847ed60a688960a648fe16353bf0492.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1444
- - C:\Users\Admin\AppData\Roaming\Microsoft\winupd.exe
    C:\Users\Admin\AppData\Roaming\Microsoft\winupd.exe -notray
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4116
  - - C:\Users\Admin\AppData\Roaming\Microsoft\winupd.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\winupd.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2844
    - - C:\Windows\SysWOW64\ipconfig.exe
        
        "C:\Windows\system32\ipconfig.exe"
        5⤵
        Gathers network information
        
        PID:2768
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2768 -s 272
        6⤵
        Program crash
        
        PID:3508
  - - C:\Users\Admin\AppData\Roaming\Microsoft\winupd.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\winupd.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of SetWindowsHookEx
      PID:3308

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2768 -ip 2768
1⤵
PID:1008

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\winupd.exe

Filesize
520KB

MD5
7591d2875526408cb5e8249f26808a4e

SHA1
3d1d8ad4c0a6ab7f8ae7ae4a043eb6a4dffc5e07

SHA256
d1f0c3d0eae41a915ff5ee61782808142698d53fa6543ed80592be2906ef7032

SHA512
7e3bd06885979ab8c5e5f3606fb28e03ac40c74815ee0dac5e86a7c434b6c20eadf7fd77f5fc4299adc1db87b97eacf7a2d3ed1ea8268b299e9df30c4e965d20

Download Submit
memory/1444-5-0x0000000000400000-0x0000000000407000-memory.dmp

Filesize
28KB

Download
memory/1444-7-0x0000000000400000-0x0000000000407000-memory.dmp

Filesize
28KB

Download
memory/1444-21-0x0000000000400000-0x0000000000407000-memory.dmp

Filesize
28KB

Download
memory/1444-20-0x0000000000400000-0x0000000000407000-memory.dmp

Filesize
28KB

Download
memory/2844-45-0x0000000000400000-0x0000000000407000-memory.dmp

Filesize
28KB

Download
memory/2844-34-0x0000000000400000-0x0000000000407000-memory.dmp

Filesize
28KB

Download
memory/3308-41-0x0000000000400000-0x00000000004B7000-memory.dmp

Filesize
732KB

Download
memory/3308-50-0x0000000000400000-0x00000000004B7000-memory.dmp

Filesize
732KB

Download
memory/3308-56-0x0000000000400000-0x00000000004B7000-memory.dmp

Filesize
732KB

Download
memory/3308-36-0x0000000000400000-0x00000000004B7000-memory.dmp

Filesize
732KB

Download
memory/3308-55-0x0000000000400000-0x00000000004B7000-memory.dmp

Filesize
732KB

Download
memory/3308-38-0x0000000000400000-0x00000000004B7000-memory.dmp

Filesize
732KB

Download
memory/3308-54-0x0000000000400000-0x00000000004B7000-memory.dmp

Filesize
732KB

Download
memory/3308-40-0x0000000000400000-0x00000000004B7000-memory.dmp

Filesize
732KB

Download
memory/3308-42-0x0000000000400000-0x00000000004B7000-memory.dmp

Filesize
732KB

Download
memory/3308-53-0x0000000000400000-0x00000000004B7000-memory.dmp

Filesize
732KB

Download
memory/3308-39-0x0000000000400000-0x00000000004B7000-memory.dmp

Filesize
732KB

Download
memory/3308-35-0x0000000000400000-0x00000000004B7000-memory.dmp

Filesize
732KB

Download
memory/3308-52-0x0000000000400000-0x00000000004B7000-memory.dmp

Filesize
732KB

Download
memory/3308-51-0x0000000000400000-0x00000000004B7000-memory.dmp

Filesize
732KB

Download
memory/3308-49-0x0000000000400000-0x00000000004B7000-memory.dmp

Filesize
732KB

Download
memory/3308-46-0x0000000000400000-0x00000000004B7000-memory.dmp

Filesize
732KB

Download
memory/3308-47-0x0000000000400000-0x00000000004B7000-memory.dmp

Filesize
732KB

Download
memory/3308-48-0x0000000000400000-0x00000000004B7000-memory.dmp

Filesize
732KB

Download
memory/4116-23-0x0000000000400000-0x0000000000483000-memory.dmp

Filesize
524KB

Download
memory/4116-25-0x0000000000400000-0x0000000000483000-memory.dmp

Filesize
524KB

Download
memory/4116-37-0x0000000000400000-0x0000000000483000-memory.dmp

Filesize
524KB

Download
memory/4776-3-0x0000000000400000-0x0000000000483000-memory.dmp

Filesize
524KB

Download
memory/4776-11-0x0000000000400000-0x0000000000483000-memory.dmp

Filesize
524KB

Download
memory/4776-2-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/4776-4-0x0000000000400000-0x0000000000483000-memory.dmp

Filesize
524KB

Download
memory/4776-9-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download