darkcomet | 4f12b16b29502e793037b26141f99a2272965bbe237a3475243c5f19f6e6c898

General

Target

4f12b16b29502e793037b26141f99a2272965bbe237a3475243c5f19f6e6c898.exe
Size

722KB
MD5

744907fcecbf352318db5953d862fe98
SHA1

22cc67f8374704fb18b0fc7693ef39e41373abcb
SHA256

4f12b16b29502e793037b26141f99a2272965bbe237a3475243c5f19f6e6c898
SHA512

36f7163f5e53abedf7c92c31b70e8d02e9bb22ded2c9bdeb4e696c64b35e42c0f40f79b16949c6b4b4d262c7de05a1fa9780ff22b781d98574217806cdfcbaab

Score

10^/10

darkcomet rat trojan

Malware Config

Signatures

Darkcomet
DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
trojan rat darkcomet

Drops file in Drivers directory 1 IoCs

Processes:

4f12b16b29502e793037b26141f99a2272965bbe237a3475243c5f19f6e6c898.exe

description	ioc	process
File opened for modification	C:\Windows\system32\drivers\etc\hosts	4f12b16b29502e793037b26141f99a2272965bbe237a3475243c5f19f6e6c898.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

4f12b16b29502e793037b26141f99a2272965bbe237a3475243c5f19f6e6c898.exe

description	pid	process	target process
PID 1892 set thread context of 2220	1892	4f12b16b29502e793037b26141f99a2272965bbe237a3475243c5f19f6e6c898.exe	iexplore.exe

Suspicious use of AdjustPrivilegeToken 48 IoCs

Processes:

4f12b16b29502e793037b26141f99a2272965bbe237a3475243c5f19f6e6c898.exeiexplore.exe

description	pid	process
Token: SeIncreaseQuotaPrivilege	1892	4f12b16b29502e793037b26141f99a2272965bbe237a3475243c5f19f6e6c898.exe
Token: SeSecurityPrivilege	1892	4f12b16b29502e793037b26141f99a2272965bbe237a3475243c5f19f6e6c898.exe
Token: SeTakeOwnershipPrivilege	1892	4f12b16b29502e793037b26141f99a2272965bbe237a3475243c5f19f6e6c898.exe
Token: SeLoadDriverPrivilege	1892	4f12b16b29502e793037b26141f99a2272965bbe237a3475243c5f19f6e6c898.exe
Token: SeSystemProfilePrivilege	1892	4f12b16b29502e793037b26141f99a2272965bbe237a3475243c5f19f6e6c898.exe
Token: SeSystemtimePrivilege	1892	4f12b16b29502e793037b26141f99a2272965bbe237a3475243c5f19f6e6c898.exe
Token: SeProfSingleProcessPrivilege	1892	4f12b16b29502e793037b26141f99a2272965bbe237a3475243c5f19f6e6c898.exe
Token: SeIncBasePriorityPrivilege	1892	4f12b16b29502e793037b26141f99a2272965bbe237a3475243c5f19f6e6c898.exe
Token: SeCreatePagefilePrivilege	1892	4f12b16b29502e793037b26141f99a2272965bbe237a3475243c5f19f6e6c898.exe
Token: SeBackupPrivilege	1892	4f12b16b29502e793037b26141f99a2272965bbe237a3475243c5f19f6e6c898.exe
Token: SeRestorePrivilege	1892	4f12b16b29502e793037b26141f99a2272965bbe237a3475243c5f19f6e6c898.exe
Token: SeShutdownPrivilege	1892	4f12b16b29502e793037b26141f99a2272965bbe237a3475243c5f19f6e6c898.exe
Token: SeDebugPrivilege	1892	4f12b16b29502e793037b26141f99a2272965bbe237a3475243c5f19f6e6c898.exe
Token: SeSystemEnvironmentPrivilege	1892	4f12b16b29502e793037b26141f99a2272965bbe237a3475243c5f19f6e6c898.exe
Token: SeChangeNotifyPrivilege	1892	4f12b16b29502e793037b26141f99a2272965bbe237a3475243c5f19f6e6c898.exe
Token: SeRemoteShutdownPrivilege	1892	4f12b16b29502e793037b26141f99a2272965bbe237a3475243c5f19f6e6c898.exe
Token: SeUndockPrivilege	1892	4f12b16b29502e793037b26141f99a2272965bbe237a3475243c5f19f6e6c898.exe
Token: SeManageVolumePrivilege	1892	4f12b16b29502e793037b26141f99a2272965bbe237a3475243c5f19f6e6c898.exe
Token: SeImpersonatePrivilege	1892	4f12b16b29502e793037b26141f99a2272965bbe237a3475243c5f19f6e6c898.exe
Token: SeCreateGlobalPrivilege	1892	4f12b16b29502e793037b26141f99a2272965bbe237a3475243c5f19f6e6c898.exe
Token: 33	1892	4f12b16b29502e793037b26141f99a2272965bbe237a3475243c5f19f6e6c898.exe
Token: 34	1892	4f12b16b29502e793037b26141f99a2272965bbe237a3475243c5f19f6e6c898.exe
Token: 35	1892	4f12b16b29502e793037b26141f99a2272965bbe237a3475243c5f19f6e6c898.exe
Token: 36	1892	4f12b16b29502e793037b26141f99a2272965bbe237a3475243c5f19f6e6c898.exe
Token: SeIncreaseQuotaPrivilege	2220	iexplore.exe
Token: SeSecurityPrivilege	2220	iexplore.exe
Token: SeTakeOwnershipPrivilege	2220	iexplore.exe
Token: SeLoadDriverPrivilege	2220	iexplore.exe
Token: SeSystemProfilePrivilege	2220	iexplore.exe
Token: SeSystemtimePrivilege	2220	iexplore.exe
Token: SeProfSingleProcessPrivilege	2220	iexplore.exe
Token: SeIncBasePriorityPrivilege	2220	iexplore.exe
Token: SeCreatePagefilePrivilege	2220	iexplore.exe
Token: SeBackupPrivilege	2220	iexplore.exe
Token: SeRestorePrivilege	2220	iexplore.exe
Token: SeShutdownPrivilege	2220	iexplore.exe
Token: SeDebugPrivilege	2220	iexplore.exe
Token: SeSystemEnvironmentPrivilege	2220	iexplore.exe
Token: SeChangeNotifyPrivilege	2220	iexplore.exe
Token: SeRemoteShutdownPrivilege	2220	iexplore.exe
Token: SeUndockPrivilege	2220	iexplore.exe
Token: SeManageVolumePrivilege	2220	iexplore.exe
Token: SeImpersonatePrivilege	2220	iexplore.exe
Token: SeCreateGlobalPrivilege	2220	iexplore.exe
Token: 33	2220	iexplore.exe
Token: 34	2220	iexplore.exe
Token: 35	2220	iexplore.exe
Token: 36	2220	iexplore.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

iexplore.exe

pid process

2220 iexplore.exe

pid	process
2220	iexplore.exe

Suspicious use of WriteProcessMemory 5 IoCs

Processes:

4f12b16b29502e793037b26141f99a2272965bbe237a3475243c5f19f6e6c898.exe

description	pid	process	target process
PID 1892 wrote to memory of 2220	1892	4f12b16b29502e793037b26141f99a2272965bbe237a3475243c5f19f6e6c898.exe	iexplore.exe
PID 1892 wrote to memory of 2220	1892	4f12b16b29502e793037b26141f99a2272965bbe237a3475243c5f19f6e6c898.exe	iexplore.exe
PID 1892 wrote to memory of 2220	1892	4f12b16b29502e793037b26141f99a2272965bbe237a3475243c5f19f6e6c898.exe	iexplore.exe
PID 1892 wrote to memory of 2220	1892	4f12b16b29502e793037b26141f99a2272965bbe237a3475243c5f19f6e6c898.exe	iexplore.exe
PID 1892 wrote to memory of 2220	1892	4f12b16b29502e793037b26141f99a2272965bbe237a3475243c5f19f6e6c898.exe	iexplore.exe

C:\Users\Admin\AppData\Local\Temp\4f12b16b29502e793037b26141f99a2272965bbe237a3475243c5f19f6e6c898.exe
"C:\Users\Admin\AppData\Local\Temp\4f12b16b29502e793037b26141f99a2272965bbe237a3475243c5f19f6e6c898.exe"
1⤵
- Drops file in Drivers directory
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1892

C:\Program Files (x86)\Internet Explorer\iexplore.exe
"C:\Program Files (x86)\Internet Explorer\iexplore.exe"
2⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2220

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1892-118-0x00000000007A0000-0x00000000007A1000-memory.dmp

Filesize
4KB

Download
memory/2220-115-0x000000000049F92C-mapping.dmp

Download
memory/2220-114-0x0000000000400000-0x00000000004C3000-memory.dmp

Filesize
780KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads