darkcomet | 8658550bc56469ef02c69d7ac3f0749e173fca486d09298bd3c305f352b07e45

General

Target

8658550bc56469ef02c69d7ac3f0749e173fca486d09298bd3c305f352b07e45.exe
Size

658KB
MD5

30c9f541275eafce10bd119505bed37c
SHA1

b1bb5fd7c85dba4bd2b233a73f9327e60118d297
SHA256

8658550bc56469ef02c69d7ac3f0749e173fca486d09298bd3c305f352b07e45
SHA512

2e5f01de124f7dad83dd55a34f3312d0a0b8320ae28bd2a5f0984c476e42e72a59199f6df7dfacf3b9f27f700273ae8c86a1b1d6f510e86ba104e3bc3a6d8261

Score

10^/10

darkcomet rat trojan

Malware Config

Signatures

Darkcomet
DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
trojan rat darkcomet
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 23 IoCs

Processes:

8658550bc56469ef02c69d7ac3f0749e173fca486d09298bd3c305f352b07e45.exe

description	pid	process
Token: SeIncreaseQuotaPrivilege	1076	8658550bc56469ef02c69d7ac3f0749e173fca486d09298bd3c305f352b07e45.exe
Token: SeSecurityPrivilege	1076	8658550bc56469ef02c69d7ac3f0749e173fca486d09298bd3c305f352b07e45.exe
Token: SeTakeOwnershipPrivilege	1076	8658550bc56469ef02c69d7ac3f0749e173fca486d09298bd3c305f352b07e45.exe
Token: SeLoadDriverPrivilege	1076	8658550bc56469ef02c69d7ac3f0749e173fca486d09298bd3c305f352b07e45.exe
Token: SeSystemProfilePrivilege	1076	8658550bc56469ef02c69d7ac3f0749e173fca486d09298bd3c305f352b07e45.exe
Token: SeSystemtimePrivilege	1076	8658550bc56469ef02c69d7ac3f0749e173fca486d09298bd3c305f352b07e45.exe
Token: SeProfSingleProcessPrivilege	1076	8658550bc56469ef02c69d7ac3f0749e173fca486d09298bd3c305f352b07e45.exe
Token: SeIncBasePriorityPrivilege	1076	8658550bc56469ef02c69d7ac3f0749e173fca486d09298bd3c305f352b07e45.exe
Token: SeCreatePagefilePrivilege	1076	8658550bc56469ef02c69d7ac3f0749e173fca486d09298bd3c305f352b07e45.exe
Token: SeBackupPrivilege	1076	8658550bc56469ef02c69d7ac3f0749e173fca486d09298bd3c305f352b07e45.exe
Token: SeRestorePrivilege	1076	8658550bc56469ef02c69d7ac3f0749e173fca486d09298bd3c305f352b07e45.exe
Token: SeShutdownPrivilege	1076	8658550bc56469ef02c69d7ac3f0749e173fca486d09298bd3c305f352b07e45.exe
Token: SeDebugPrivilege	1076	8658550bc56469ef02c69d7ac3f0749e173fca486d09298bd3c305f352b07e45.exe
Token: SeSystemEnvironmentPrivilege	1076	8658550bc56469ef02c69d7ac3f0749e173fca486d09298bd3c305f352b07e45.exe
Token: SeChangeNotifyPrivilege	1076	8658550bc56469ef02c69d7ac3f0749e173fca486d09298bd3c305f352b07e45.exe
Token: SeRemoteShutdownPrivilege	1076	8658550bc56469ef02c69d7ac3f0749e173fca486d09298bd3c305f352b07e45.exe
Token: SeUndockPrivilege	1076	8658550bc56469ef02c69d7ac3f0749e173fca486d09298bd3c305f352b07e45.exe
Token: SeManageVolumePrivilege	1076	8658550bc56469ef02c69d7ac3f0749e173fca486d09298bd3c305f352b07e45.exe
Token: SeImpersonatePrivilege	1076	8658550bc56469ef02c69d7ac3f0749e173fca486d09298bd3c305f352b07e45.exe
Token: SeCreateGlobalPrivilege	1076	8658550bc56469ef02c69d7ac3f0749e173fca486d09298bd3c305f352b07e45.exe
Token: 33	1076	8658550bc56469ef02c69d7ac3f0749e173fca486d09298bd3c305f352b07e45.exe
Token: 34	1076	8658550bc56469ef02c69d7ac3f0749e173fca486d09298bd3c305f352b07e45.exe
Token: 35	1076	8658550bc56469ef02c69d7ac3f0749e173fca486d09298bd3c305f352b07e45.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

8658550bc56469ef02c69d7ac3f0749e173fca486d09298bd3c305f352b07e45.exe

pid process

1076 8658550bc56469ef02c69d7ac3f0749e173fca486d09298bd3c305f352b07e45.exe

pid	process
1076	8658550bc56469ef02c69d7ac3f0749e173fca486d09298bd3c305f352b07e45.exe

C:\Users\Admin\AppData\Local\Temp\8658550bc56469ef02c69d7ac3f0749e173fca486d09298bd3c305f352b07e45.exe
"C:\Users\Admin\AppData\Local\Temp\8658550bc56469ef02c69d7ac3f0749e173fca486d09298bd3c305f352b07e45.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1076

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1076-59-0x00000000766D1000-0x00000000766D3000-memory.dmp

Filesize
8KB

Download
memory/1076-60-0x00000000005D0000-0x00000000005D1000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing