darkcomet | b7b0545b9ade56f164be76aa14b663ae33fbcda16c032516c8ca0fff4f9ca4f1

General

Target
valo crack emulator.exe
Size 251KB
Sample260930-1ccrasaf77
SHA256 b7b0545b9ade56f164be76aa14b663ae33fbcda16c032516c8ca0fff4f9ca4f1
MD5 aee039f2ada4148327c9babf4026d252
SHA1 382d803418c23e5aec37b35c7c6f8519af9dfaf6
SHA512 ab779f1c96fe7ce04ec4f02d7c5558f86a35494c3d59bc37c9952286c8a687302154ddb25cc8665c2906b0a0b8878d5e9bf078abe2f6703ceb17fd7a16db0bec
SSDEEP 6144:PcNYS996KFifeVjBpeExgVTFSXFoMc5RhCaL37H:PcW7KEZlPzCy37H
TLSH
T1B54423E57BC59C43EAFAAEFC065C0B145B0533DF1EEE82A29F20034831A6A56135763D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

guest16 defense_evasion discovery execution darkcomet rat trojan upx

Malware Config

Extracted

Family

darkcomet

Botnet

Guest16

C2

gix3oy1fbr.localto.net:3700

Mutex

DC_MUTEX-BJ5Z3HT

Attributes

gencode
9dKtTkFoLU75
install
false
offline_keylogger
true
persistence
false

rc4.plain

Signatures

Family: Darkcomet
DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
trojan rat darkcomet

Modifies firewall policy service 3 TTPs 3 IoCs

defense_evasion

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

description	ioc	Process
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	valo crack emulator.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0"	valo crack emulator.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "0"	valo crack emulator.exe

Windows security bypass 2 TTPs 2 IoCs

defense_evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	valo crack emulator.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	valo crack emulator.exe

Disables RegEdit via registry modification 1 IoCs

defense_evasion

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	valo crack emulator.exe

Disables Task Manager via registry modification
defense_evasion

Sets file to hidden 1 TTPs 2 IoCs

Modifies file attributes to stop it showing in Explorer etc.

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
4624	attrib.exe
1040	attrib.exe

Windows security modification 2 TTPs 2 IoCs

defense_evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	valo crack emulator.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	valo crack emulator.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/1324-0-0x0000000000400000-0x00000000004B7000-memory.dmp	upx
behavioral2/memory/1324-2-0x0000000000400000-0x00000000004B7000-memory.dmp	upx
behavioral2/memory/1324-4-0x0000000000400000-0x00000000004B7000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 2 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4016	cmd.exe
4876	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	valo crack emulator.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	valo crack emulator.exe

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	valo crack emulator.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1324	valo crack emulator.exe

Suspicious use of AdjustPrivilegeToken 24 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	1324	valo crack emulator.exe
Token: SeSecurityPrivilege	1324	valo crack emulator.exe
Token: SeTakeOwnershipPrivilege	1324	valo crack emulator.exe
Token: SeLoadDriverPrivilege	1324	valo crack emulator.exe
Token: SeSystemProfilePrivilege	1324	valo crack emulator.exe
Token: SeSystemtimePrivilege	1324	valo crack emulator.exe
Token: SeProfSingleProcessPrivilege	1324	valo crack emulator.exe
Token: SeIncBasePriorityPrivilege	1324	valo crack emulator.exe
Token: SeCreatePagefilePrivilege	1324	valo crack emulator.exe
Token: SeBackupPrivilege	1324	valo crack emulator.exe
Token: SeRestorePrivilege	1324	valo crack emulator.exe
Token: SeShutdownPrivilege	1324	valo crack emulator.exe
Token: SeDebugPrivilege	1324	valo crack emulator.exe
Token: SeSystemEnvironmentPrivilege	1324	valo crack emulator.exe
Token: SeChangeNotifyPrivilege	1324	valo crack emulator.exe
Token: SeRemoteShutdownPrivilege	1324	valo crack emulator.exe
Token: SeUndockPrivilege	1324	valo crack emulator.exe
Token: SeManageVolumePrivilege	1324	valo crack emulator.exe
Token: SeImpersonatePrivilege	1324	valo crack emulator.exe
Token: SeCreateGlobalPrivilege	1324	valo crack emulator.exe
Token: 33	1324	valo crack emulator.exe
Token: 34	1324	valo crack emulator.exe
Token: 35	1324	valo crack emulator.exe
Token: 36	1324	valo crack emulator.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1324	valo crack emulator.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1324 wrote to memory of 4016	1324	valo crack emulator.exe	88
PID 1324 wrote to memory of 4876	1324	valo crack emulator.exe	90
PID 1324 wrote to memory of 4052	1324	valo crack emulator.exe	91
PID 1324 wrote to memory of 4052	1324	valo crack emulator.exe	91
PID 4016 wrote to memory of 4624	4016	cmd.exe	93
PID 4876 wrote to memory of 1040	4876	cmd.exe	94

System policy modification 1 TTPs 3 IoCs

defense_evasion

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\CurrentVersion	valo crack emulator.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\CurrentVersion\Explorern	valo crack emulator.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\CurrentVersion\Explorern\NoControlPanel = "1"	valo crack emulator.exe

Views/modifies file attributes 1 TTPs 2 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
4624	attrib.exe
1040	attrib.exe

C:\Users\Admin\AppData\Local\Temp\valo crack emulator.exe
"C:\Users\Admin\AppData\Local\Temp\valo crack emulator.exe"
1⤵
- Modifies firewall policy service
- Windows security bypass
- Disables RegEdit via registry modification
- Windows security modification
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1324
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp\valo crack emulator.exe" +s +h
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4016
- - C:\Windows\SysWOW64\attrib.exe
    attrib "C:\Users\Admin\AppData\Local\Temp\valo crack emulator.exe" +s +h
    3⤵
    - Sets file to hidden
    - System Location Discovery: System Language Discovery
    - Views/modifies file attributes
    PID:4624
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp" +s +h
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4876
- - C:\Windows\SysWOW64\attrib.exe
    attrib "C:\Users\Admin\AppData\Local\Temp" +s +h
    3⤵
    - Sets file to hidden
    - System Location Discovery: System Language Discovery
    - Views/modifies file attributes
    PID:1040
- C:\Windows\SysWOW64\notepad.exe
  notepad
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4052