darkcomet | 8658550bc56469ef02c69d7ac3f0749e173fca486d09298bd3c305f352b07e45

General

Target

8658550bc56469ef02c69d7ac3f0749e173fca486d09298bd3c305f352b07e45.exe
Size

658KB
MD5

30c9f541275eafce10bd119505bed37c
SHA1

b1bb5fd7c85dba4bd2b233a73f9327e60118d297
SHA256

8658550bc56469ef02c69d7ac3f0749e173fca486d09298bd3c305f352b07e45
SHA512

2e5f01de124f7dad83dd55a34f3312d0a0b8320ae28bd2a5f0984c476e42e72a59199f6df7dfacf3b9f27f700273ae8c86a1b1d6f510e86ba104e3bc3a6d8261

Score

10^/10

darkcomet rat trojan

Malware Config

Signatures

Darkcomet
DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
trojan rat darkcomet
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 24 IoCs

Processes:

8658550bc56469ef02c69d7ac3f0749e173fca486d09298bd3c305f352b07e45.exe

description	pid	process
Token: SeIncreaseQuotaPrivilege	648	8658550bc56469ef02c69d7ac3f0749e173fca486d09298bd3c305f352b07e45.exe
Token: SeSecurityPrivilege	648	8658550bc56469ef02c69d7ac3f0749e173fca486d09298bd3c305f352b07e45.exe
Token: SeTakeOwnershipPrivilege	648	8658550bc56469ef02c69d7ac3f0749e173fca486d09298bd3c305f352b07e45.exe
Token: SeLoadDriverPrivilege	648	8658550bc56469ef02c69d7ac3f0749e173fca486d09298bd3c305f352b07e45.exe
Token: SeSystemProfilePrivilege	648	8658550bc56469ef02c69d7ac3f0749e173fca486d09298bd3c305f352b07e45.exe
Token: SeSystemtimePrivilege	648	8658550bc56469ef02c69d7ac3f0749e173fca486d09298bd3c305f352b07e45.exe
Token: SeProfSingleProcessPrivilege	648	8658550bc56469ef02c69d7ac3f0749e173fca486d09298bd3c305f352b07e45.exe
Token: SeIncBasePriorityPrivilege	648	8658550bc56469ef02c69d7ac3f0749e173fca486d09298bd3c305f352b07e45.exe
Token: SeCreatePagefilePrivilege	648	8658550bc56469ef02c69d7ac3f0749e173fca486d09298bd3c305f352b07e45.exe
Token: SeBackupPrivilege	648	8658550bc56469ef02c69d7ac3f0749e173fca486d09298bd3c305f352b07e45.exe
Token: SeRestorePrivilege	648	8658550bc56469ef02c69d7ac3f0749e173fca486d09298bd3c305f352b07e45.exe
Token: SeShutdownPrivilege	648	8658550bc56469ef02c69d7ac3f0749e173fca486d09298bd3c305f352b07e45.exe
Token: SeDebugPrivilege	648	8658550bc56469ef02c69d7ac3f0749e173fca486d09298bd3c305f352b07e45.exe
Token: SeSystemEnvironmentPrivilege	648	8658550bc56469ef02c69d7ac3f0749e173fca486d09298bd3c305f352b07e45.exe
Token: SeChangeNotifyPrivilege	648	8658550bc56469ef02c69d7ac3f0749e173fca486d09298bd3c305f352b07e45.exe
Token: SeRemoteShutdownPrivilege	648	8658550bc56469ef02c69d7ac3f0749e173fca486d09298bd3c305f352b07e45.exe
Token: SeUndockPrivilege	648	8658550bc56469ef02c69d7ac3f0749e173fca486d09298bd3c305f352b07e45.exe
Token: SeManageVolumePrivilege	648	8658550bc56469ef02c69d7ac3f0749e173fca486d09298bd3c305f352b07e45.exe
Token: SeImpersonatePrivilege	648	8658550bc56469ef02c69d7ac3f0749e173fca486d09298bd3c305f352b07e45.exe
Token: SeCreateGlobalPrivilege	648	8658550bc56469ef02c69d7ac3f0749e173fca486d09298bd3c305f352b07e45.exe
Token: 33	648	8658550bc56469ef02c69d7ac3f0749e173fca486d09298bd3c305f352b07e45.exe
Token: 34	648	8658550bc56469ef02c69d7ac3f0749e173fca486d09298bd3c305f352b07e45.exe
Token: 35	648	8658550bc56469ef02c69d7ac3f0749e173fca486d09298bd3c305f352b07e45.exe
Token: 36	648	8658550bc56469ef02c69d7ac3f0749e173fca486d09298bd3c305f352b07e45.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

8658550bc56469ef02c69d7ac3f0749e173fca486d09298bd3c305f352b07e45.exe

pid process

648 8658550bc56469ef02c69d7ac3f0749e173fca486d09298bd3c305f352b07e45.exe

pid	process
648	8658550bc56469ef02c69d7ac3f0749e173fca486d09298bd3c305f352b07e45.exe

C:\Users\Admin\AppData\Local\Temp\8658550bc56469ef02c69d7ac3f0749e173fca486d09298bd3c305f352b07e45.exe
"C:\Users\Admin\AppData\Local\Temp\8658550bc56469ef02c69d7ac3f0749e173fca486d09298bd3c305f352b07e45.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:648

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/648-114-0x00000000022E0000-0x00000000022E1000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing