darkcomet | 4565983c56ad07456e1fedc689887813df0f0fbff3bb716e687347d53526d88b

General

Target

4565983c56ad07456e1fedc689887813df0f0fbff3bb716e687347d53526d88b.exe
Size

658KB
MD5

1a46d4fe75e27fd9f55e2e06bf9cdaac
SHA1

0733d98ea3e242015ff93f21083367e93c2f486b
SHA256

4565983c56ad07456e1fedc689887813df0f0fbff3bb716e687347d53526d88b
SHA512

aefc1eee00eab34386cba39c567357626b0a69bfd5f81cce8fb77cd168b2176f06e45e8d342ff4145ed1055ede37d0547252365ffb1159a851ea7bf1fdf1e807

Score

10^/10

darkcomet guest16 rat trojan

Malware Config

Extracted

Family

darkcomet

Botnet

Guest16

C2

4.tcp.ngrok.io:11187

Mutex

DC_MUTEX-2ZHKKS1

Attributes

gencode
0Jo5ooH7cVw6
install
false
offline_keylogger
true
persistence
false

Signatures

Darkcomet
DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
trojan rat darkcomet

Suspicious use of SetThreadContext 1 IoCs

Processes:

4565983c56ad07456e1fedc689887813df0f0fbff3bb716e687347d53526d88b.exe

description	pid	process	target process
PID 1596 set thread context of 1192	1596	4565983c56ad07456e1fedc689887813df0f0fbff3bb716e687347d53526d88b.exe	iexplore.exe

Suspicious use of AdjustPrivilegeToken 46 IoCs

Processes:

4565983c56ad07456e1fedc689887813df0f0fbff3bb716e687347d53526d88b.exeiexplore.exe

description	pid	process
Token: SeIncreaseQuotaPrivilege	1596	4565983c56ad07456e1fedc689887813df0f0fbff3bb716e687347d53526d88b.exe
Token: SeSecurityPrivilege	1596	4565983c56ad07456e1fedc689887813df0f0fbff3bb716e687347d53526d88b.exe
Token: SeTakeOwnershipPrivilege	1596	4565983c56ad07456e1fedc689887813df0f0fbff3bb716e687347d53526d88b.exe
Token: SeLoadDriverPrivilege	1596	4565983c56ad07456e1fedc689887813df0f0fbff3bb716e687347d53526d88b.exe
Token: SeSystemProfilePrivilege	1596	4565983c56ad07456e1fedc689887813df0f0fbff3bb716e687347d53526d88b.exe
Token: SeSystemtimePrivilege	1596	4565983c56ad07456e1fedc689887813df0f0fbff3bb716e687347d53526d88b.exe
Token: SeProfSingleProcessPrivilege	1596	4565983c56ad07456e1fedc689887813df0f0fbff3bb716e687347d53526d88b.exe
Token: SeIncBasePriorityPrivilege	1596	4565983c56ad07456e1fedc689887813df0f0fbff3bb716e687347d53526d88b.exe
Token: SeCreatePagefilePrivilege	1596	4565983c56ad07456e1fedc689887813df0f0fbff3bb716e687347d53526d88b.exe
Token: SeBackupPrivilege	1596	4565983c56ad07456e1fedc689887813df0f0fbff3bb716e687347d53526d88b.exe
Token: SeRestorePrivilege	1596	4565983c56ad07456e1fedc689887813df0f0fbff3bb716e687347d53526d88b.exe
Token: SeShutdownPrivilege	1596	4565983c56ad07456e1fedc689887813df0f0fbff3bb716e687347d53526d88b.exe
Token: SeDebugPrivilege	1596	4565983c56ad07456e1fedc689887813df0f0fbff3bb716e687347d53526d88b.exe
Token: SeSystemEnvironmentPrivilege	1596	4565983c56ad07456e1fedc689887813df0f0fbff3bb716e687347d53526d88b.exe
Token: SeChangeNotifyPrivilege	1596	4565983c56ad07456e1fedc689887813df0f0fbff3bb716e687347d53526d88b.exe
Token: SeRemoteShutdownPrivilege	1596	4565983c56ad07456e1fedc689887813df0f0fbff3bb716e687347d53526d88b.exe
Token: SeUndockPrivilege	1596	4565983c56ad07456e1fedc689887813df0f0fbff3bb716e687347d53526d88b.exe
Token: SeManageVolumePrivilege	1596	4565983c56ad07456e1fedc689887813df0f0fbff3bb716e687347d53526d88b.exe
Token: SeImpersonatePrivilege	1596	4565983c56ad07456e1fedc689887813df0f0fbff3bb716e687347d53526d88b.exe
Token: SeCreateGlobalPrivilege	1596	4565983c56ad07456e1fedc689887813df0f0fbff3bb716e687347d53526d88b.exe
Token: 33	1596	4565983c56ad07456e1fedc689887813df0f0fbff3bb716e687347d53526d88b.exe
Token: 34	1596	4565983c56ad07456e1fedc689887813df0f0fbff3bb716e687347d53526d88b.exe
Token: 35	1596	4565983c56ad07456e1fedc689887813df0f0fbff3bb716e687347d53526d88b.exe
Token: SeIncreaseQuotaPrivilege	1192	iexplore.exe
Token: SeSecurityPrivilege	1192	iexplore.exe
Token: SeTakeOwnershipPrivilege	1192	iexplore.exe
Token: SeLoadDriverPrivilege	1192	iexplore.exe
Token: SeSystemProfilePrivilege	1192	iexplore.exe
Token: SeSystemtimePrivilege	1192	iexplore.exe
Token: SeProfSingleProcessPrivilege	1192	iexplore.exe
Token: SeIncBasePriorityPrivilege	1192	iexplore.exe
Token: SeCreatePagefilePrivilege	1192	iexplore.exe
Token: SeBackupPrivilege	1192	iexplore.exe
Token: SeRestorePrivilege	1192	iexplore.exe
Token: SeShutdownPrivilege	1192	iexplore.exe
Token: SeDebugPrivilege	1192	iexplore.exe
Token: SeSystemEnvironmentPrivilege	1192	iexplore.exe
Token: SeChangeNotifyPrivilege	1192	iexplore.exe
Token: SeRemoteShutdownPrivilege	1192	iexplore.exe
Token: SeUndockPrivilege	1192	iexplore.exe
Token: SeManageVolumePrivilege	1192	iexplore.exe
Token: SeImpersonatePrivilege	1192	iexplore.exe
Token: SeCreateGlobalPrivilege	1192	iexplore.exe
Token: 33	1192	iexplore.exe
Token: 34	1192	iexplore.exe
Token: 35	1192	iexplore.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

iexplore.exe

pid process

1192 iexplore.exe

pid	process
1192	iexplore.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

4565983c56ad07456e1fedc689887813df0f0fbff3bb716e687347d53526d88b.exe

description	pid	process	target process
PID 1596 wrote to memory of 1192	1596	4565983c56ad07456e1fedc689887813df0f0fbff3bb716e687347d53526d88b.exe	iexplore.exe
PID 1596 wrote to memory of 1192	1596	4565983c56ad07456e1fedc689887813df0f0fbff3bb716e687347d53526d88b.exe	iexplore.exe
PID 1596 wrote to memory of 1192	1596	4565983c56ad07456e1fedc689887813df0f0fbff3bb716e687347d53526d88b.exe	iexplore.exe
PID 1596 wrote to memory of 1192	1596	4565983c56ad07456e1fedc689887813df0f0fbff3bb716e687347d53526d88b.exe	iexplore.exe
PID 1596 wrote to memory of 1192	1596	4565983c56ad07456e1fedc689887813df0f0fbff3bb716e687347d53526d88b.exe	iexplore.exe
PID 1596 wrote to memory of 1192	1596	4565983c56ad07456e1fedc689887813df0f0fbff3bb716e687347d53526d88b.exe	iexplore.exe

C:\Users\Admin\AppData\Local\Temp\4565983c56ad07456e1fedc689887813df0f0fbff3bb716e687347d53526d88b.exe
"C:\Users\Admin\AppData\Local\Temp\4565983c56ad07456e1fedc689887813df0f0fbff3bb716e687347d53526d88b.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1596

C:\Program Files (x86)\Internet Explorer\iexplore.exe
"C:\Program Files (x86)\Internet Explorer\iexplore.exe"
2⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1192

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1192-5-0x000000000048F888-mapping.dmp

Download
memory/1192-4-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/1596-2-0x0000000075781000-0x0000000075783000-memory.dmp

Filesize
8KB

Download
memory/1596-3-0x00000000001D0000-0x00000000001D1000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads