darkcomet | b7b0545b9ade56f164be76aa14b663ae33fbcda16c032516c8ca0fff4f9ca4f1

General

Target
valo crack emulator.exe
Size 251KB
Sample260930-1ccrasaf77
SHA256 b7b0545b9ade56f164be76aa14b663ae33fbcda16c032516c8ca0fff4f9ca4f1
MD5 aee039f2ada4148327c9babf4026d252
SHA1 382d803418c23e5aec37b35c7c6f8519af9dfaf6
SHA512 ab779f1c96fe7ce04ec4f02d7c5558f86a35494c3d59bc37c9952286c8a687302154ddb25cc8665c2906b0a0b8878d5e9bf078abe2f6703ceb17fd7a16db0bec
SSDEEP 6144:PcNYS996KFifeVjBpeExgVTFSXFoMc5RhCaL37H:PcW7KEZlPzCy37H
TLSH
T1B54423E57BC59C43EAFAAEFC065C0B145B0533DF1EEE82A29F20034831A6A56135763D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

guest16 defense_evasion discovery execution darkcomet rat trojan upx

Malware Config

Extracted

Family

darkcomet

Botnet

Guest16

C2

gix3oy1fbr.localto.net:3700

Mutex

DC_MUTEX-BJ5Z3HT

Attributes

gencode
9dKtTkFoLU75
install
false
offline_keylogger
true
persistence
false

rc4.plain

Signatures

Family: Darkcomet
DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
trojan rat darkcomet

Modifies firewall policy service 3 TTPs 3 IoCs

defense_evasion

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

description	ioc	Process
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	valo crack emulator.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0"	valo crack emulator.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "0"	valo crack emulator.exe

Modifies security service 2 TTPs 1 IoCs

defense_evasion

Modify Registry

T1112

Windows Service

T1543.003

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wscsvc\Start = "4"	valo crack emulator.exe

Windows security bypass 2 TTPs 2 IoCs

defense_evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	valo crack emulator.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	valo crack emulator.exe

Disables RegEdit via registry modification 1 IoCs

defense_evasion

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	valo crack emulator.exe

Disables Task Manager via registry modification
defense_evasion

Sets file to hidden 1 TTPs 2 IoCs

Modifies file attributes to stop it showing in Explorer etc.

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
2648	attrib.exe
4124	attrib.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\Control Panel\International\Geo\Nation	valo crack emulator.exe

Windows security modification 2 TTPs 2 IoCs

defense_evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	valo crack emulator.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	valo crack emulator.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/5588-0-0x0000000000400000-0x00000000004B7000-memory.dmp	upx
behavioral1/memory/5588-2-0x0000000000400000-0x00000000004B7000-memory.dmp	upx
behavioral1/memory/5588-4-0x0000000000400000-0x00000000004B7000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 2 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
6052	cmd.exe
4992	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	valo crack emulator.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	valo crack emulator.exe

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	valo crack emulator.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious use of AdjustPrivilegeToken 24 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	5588	valo crack emulator.exe
Token: SeSecurityPrivilege	5588	valo crack emulator.exe
Token: SeTakeOwnershipPrivilege	5588	valo crack emulator.exe
Token: SeLoadDriverPrivilege	5588	valo crack emulator.exe
Token: SeSystemProfilePrivilege	5588	valo crack emulator.exe
Token: SeSystemtimePrivilege	5588	valo crack emulator.exe
Token: SeProfSingleProcessPrivilege	5588	valo crack emulator.exe
Token: SeIncBasePriorityPrivilege	5588	valo crack emulator.exe
Token: SeCreatePagefilePrivilege	5588	valo crack emulator.exe
Token: SeBackupPrivilege	5588	valo crack emulator.exe
Token: SeRestorePrivilege	5588	valo crack emulator.exe
Token: SeShutdownPrivilege	5588	valo crack emulator.exe
Token: SeDebugPrivilege	5588	valo crack emulator.exe
Token: SeSystemEnvironmentPrivilege	5588	valo crack emulator.exe
Token: SeChangeNotifyPrivilege	5588	valo crack emulator.exe
Token: SeRemoteShutdownPrivilege	5588	valo crack emulator.exe
Token: SeUndockPrivilege	5588	valo crack emulator.exe
Token: SeManageVolumePrivilege	5588	valo crack emulator.exe
Token: SeImpersonatePrivilege	5588	valo crack emulator.exe
Token: SeCreateGlobalPrivilege	5588	valo crack emulator.exe
Token: 33	5588	valo crack emulator.exe
Token: 34	5588	valo crack emulator.exe
Token: 35	5588	valo crack emulator.exe
Token: 36	5588	valo crack emulator.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
5588	valo crack emulator.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 5588 wrote to memory of 6052	5588	valo crack emulator.exe	88
PID 5588 wrote to memory of 4992	5588	valo crack emulator.exe	89
PID 5588 wrote to memory of 1396	5588	valo crack emulator.exe	91
PID 5588 wrote to memory of 1396	5588	valo crack emulator.exe	91
PID 6052 wrote to memory of 2648	6052	cmd.exe	93
PID 4992 wrote to memory of 4124	4992	cmd.exe	94

System policy modification 1 TTPs 3 IoCs

defense_evasion

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\CurrentVersion	valo crack emulator.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\CurrentVersion\Explorern	valo crack emulator.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\CurrentVersion\Explorern\NoControlPanel = "1"	valo crack emulator.exe

Views/modifies file attributes 1 TTPs 2 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
2648	attrib.exe
4124	attrib.exe

C:\Users\Admin\AppData\Local\Temp\valo crack emulator.exe
"C:\Users\Admin\AppData\Local\Temp\valo crack emulator.exe"
1⤵
- Modifies firewall policy service
- Modifies security service
- Windows security bypass
- Disables RegEdit via registry modification
- Checks computer location settings
- Windows security modification
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:5588
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp\valo crack emulator.exe" +s +h
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:6052
- - C:\Windows\SysWOW64\attrib.exe
    attrib "C:\Users\Admin\AppData\Local\Temp\valo crack emulator.exe" +s +h
    3⤵
    - Sets file to hidden
    - System Location Discovery: System Language Discovery
    - Views/modifies file attributes
    PID:2648
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp" +s +h
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4992
- - C:\Windows\SysWOW64\attrib.exe
    attrib "C:\Users\Admin\AppData\Local\Temp" +s +h
    3⤵
    - Sets file to hidden
    - System Location Discovery: System Language Discovery
    - Views/modifies file attributes
    PID:4124
- C:\Windows\SysWOW64\notepad.exe
  notepad
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1396