darkcomet | 56b237b519bf0ff53cde47321e1420800ef7f8d1f29739e8137db59050837d56

General

Target

56b237b519bf0ff53cde47321e1420800ef7f8d1f29739e8137db59050837d56.exe
Size

658KB
MD5

9a10fd9402f430eaf52a7dbb562997c9
SHA1

7c2978c9229eb9b1a85235d164d002f84e99f005
SHA256

56b237b519bf0ff53cde47321e1420800ef7f8d1f29739e8137db59050837d56
SHA512

e8d3d11dd79bef2beaa2acc69198b5089b402fbbb1397db8a54995cb6bdea8b970c78376c77ca6810ab68bb1bf282eae34f8d6f22959952ab853aa9691602080

Score

10^/10

darkcomet evasion rat trojan

Malware Config

Signatures

Darkcomet
DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
trojan rat darkcomet

Modifies firewall policy service 2 TTPs 3 IoCs

evasion

Modify Registry

T1112

Modify Existing Service

T1031

Processes:

56b237b519bf0ff53cde47321e1420800ef7f8d1f29739e8137db59050837d56.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "0"	56b237b519bf0ff53cde47321e1420800ef7f8d1f29739e8137db59050837d56.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	56b237b519bf0ff53cde47321e1420800ef7f8d1f29739e8137db59050837d56.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0"	56b237b519bf0ff53cde47321e1420800ef7f8d1f29739e8137db59050837d56.exe

Disables RegEdit via registry modification
evasion
Disables Task Manager via registry modification
evasion
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

56b237b519bf0ff53cde47321e1420800ef7f8d1f29739e8137db59050837d56.exe

pid process

4140 56b237b519bf0ff53cde47321e1420800ef7f8d1f29739e8137db59050837d56.exe

pid	process
4140	56b237b519bf0ff53cde47321e1420800ef7f8d1f29739e8137db59050837d56.exe

Suspicious use of AdjustPrivilegeToken 24 IoCs

Processes:

56b237b519bf0ff53cde47321e1420800ef7f8d1f29739e8137db59050837d56.exe

description	pid	process
Token: SeIncreaseQuotaPrivilege	4140	56b237b519bf0ff53cde47321e1420800ef7f8d1f29739e8137db59050837d56.exe
Token: SeSecurityPrivilege	4140	56b237b519bf0ff53cde47321e1420800ef7f8d1f29739e8137db59050837d56.exe
Token: SeTakeOwnershipPrivilege	4140	56b237b519bf0ff53cde47321e1420800ef7f8d1f29739e8137db59050837d56.exe
Token: SeLoadDriverPrivilege	4140	56b237b519bf0ff53cde47321e1420800ef7f8d1f29739e8137db59050837d56.exe
Token: SeSystemProfilePrivilege	4140	56b237b519bf0ff53cde47321e1420800ef7f8d1f29739e8137db59050837d56.exe
Token: SeSystemtimePrivilege	4140	56b237b519bf0ff53cde47321e1420800ef7f8d1f29739e8137db59050837d56.exe
Token: SeProfSingleProcessPrivilege	4140	56b237b519bf0ff53cde47321e1420800ef7f8d1f29739e8137db59050837d56.exe
Token: SeIncBasePriorityPrivilege	4140	56b237b519bf0ff53cde47321e1420800ef7f8d1f29739e8137db59050837d56.exe
Token: SeCreatePagefilePrivilege	4140	56b237b519bf0ff53cde47321e1420800ef7f8d1f29739e8137db59050837d56.exe
Token: SeBackupPrivilege	4140	56b237b519bf0ff53cde47321e1420800ef7f8d1f29739e8137db59050837d56.exe
Token: SeRestorePrivilege	4140	56b237b519bf0ff53cde47321e1420800ef7f8d1f29739e8137db59050837d56.exe
Token: SeShutdownPrivilege	4140	56b237b519bf0ff53cde47321e1420800ef7f8d1f29739e8137db59050837d56.exe
Token: SeDebugPrivilege	4140	56b237b519bf0ff53cde47321e1420800ef7f8d1f29739e8137db59050837d56.exe
Token: SeSystemEnvironmentPrivilege	4140	56b237b519bf0ff53cde47321e1420800ef7f8d1f29739e8137db59050837d56.exe
Token: SeChangeNotifyPrivilege	4140	56b237b519bf0ff53cde47321e1420800ef7f8d1f29739e8137db59050837d56.exe
Token: SeRemoteShutdownPrivilege	4140	56b237b519bf0ff53cde47321e1420800ef7f8d1f29739e8137db59050837d56.exe
Token: SeUndockPrivilege	4140	56b237b519bf0ff53cde47321e1420800ef7f8d1f29739e8137db59050837d56.exe
Token: SeManageVolumePrivilege	4140	56b237b519bf0ff53cde47321e1420800ef7f8d1f29739e8137db59050837d56.exe
Token: SeImpersonatePrivilege	4140	56b237b519bf0ff53cde47321e1420800ef7f8d1f29739e8137db59050837d56.exe
Token: SeCreateGlobalPrivilege	4140	56b237b519bf0ff53cde47321e1420800ef7f8d1f29739e8137db59050837d56.exe
Token: 33	4140	56b237b519bf0ff53cde47321e1420800ef7f8d1f29739e8137db59050837d56.exe
Token: 34	4140	56b237b519bf0ff53cde47321e1420800ef7f8d1f29739e8137db59050837d56.exe
Token: 35	4140	56b237b519bf0ff53cde47321e1420800ef7f8d1f29739e8137db59050837d56.exe
Token: 36	4140	56b237b519bf0ff53cde47321e1420800ef7f8d1f29739e8137db59050837d56.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

56b237b519bf0ff53cde47321e1420800ef7f8d1f29739e8137db59050837d56.exe

pid process

4140 56b237b519bf0ff53cde47321e1420800ef7f8d1f29739e8137db59050837d56.exe

pid	process
4140	56b237b519bf0ff53cde47321e1420800ef7f8d1f29739e8137db59050837d56.exe

C:\Users\Admin\AppData\Local\Temp\56b237b519bf0ff53cde47321e1420800ef7f8d1f29739e8137db59050837d56.exe
"C:\Users\Admin\AppData\Local\Temp\56b237b519bf0ff53cde47321e1420800ef7f8d1f29739e8137db59050837d56.exe"
1⤵
- Modifies firewall policy service
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:4140

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Modify Existing Service

1

T1031

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads