darkcomet | 12651749cd4f3bca50cda8259ee2c82c52034b12ff03f08a985cd6b16b1177e1

General

Target

12651749cd4f3bca50cda8259ee2c82c52034b12ff03f08a985cd6b16b1177e1.exe
Size

658KB
MD5

894fdedb5b31d8c921e0c79f2cbb4c68
SHA1

2bba87a11fc4c117aaf7c6227ea11d4513376668
SHA256

12651749cd4f3bca50cda8259ee2c82c52034b12ff03f08a985cd6b16b1177e1
SHA512

3a32eb83f844b26fbd773872f657c427e1d7a69c44babc88b6f5fab0d6e41f031e3f365854e088a045d777172680628dc0367fd8f3b61d76baf228fe7a5f3e3e

Score

10^/10

darkcomet rat trojan

Malware Config

Signatures

Darkcomet
DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
trojan rat darkcomet
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 23 IoCs

Processes:

12651749cd4f3bca50cda8259ee2c82c52034b12ff03f08a985cd6b16b1177e1.exe

description	pid	process
Token: SeIncreaseQuotaPrivilege	1936	12651749cd4f3bca50cda8259ee2c82c52034b12ff03f08a985cd6b16b1177e1.exe
Token: SeSecurityPrivilege	1936	12651749cd4f3bca50cda8259ee2c82c52034b12ff03f08a985cd6b16b1177e1.exe
Token: SeTakeOwnershipPrivilege	1936	12651749cd4f3bca50cda8259ee2c82c52034b12ff03f08a985cd6b16b1177e1.exe
Token: SeLoadDriverPrivilege	1936	12651749cd4f3bca50cda8259ee2c82c52034b12ff03f08a985cd6b16b1177e1.exe
Token: SeSystemProfilePrivilege	1936	12651749cd4f3bca50cda8259ee2c82c52034b12ff03f08a985cd6b16b1177e1.exe
Token: SeSystemtimePrivilege	1936	12651749cd4f3bca50cda8259ee2c82c52034b12ff03f08a985cd6b16b1177e1.exe
Token: SeProfSingleProcessPrivilege	1936	12651749cd4f3bca50cda8259ee2c82c52034b12ff03f08a985cd6b16b1177e1.exe
Token: SeIncBasePriorityPrivilege	1936	12651749cd4f3bca50cda8259ee2c82c52034b12ff03f08a985cd6b16b1177e1.exe
Token: SeCreatePagefilePrivilege	1936	12651749cd4f3bca50cda8259ee2c82c52034b12ff03f08a985cd6b16b1177e1.exe
Token: SeBackupPrivilege	1936	12651749cd4f3bca50cda8259ee2c82c52034b12ff03f08a985cd6b16b1177e1.exe
Token: SeRestorePrivilege	1936	12651749cd4f3bca50cda8259ee2c82c52034b12ff03f08a985cd6b16b1177e1.exe
Token: SeShutdownPrivilege	1936	12651749cd4f3bca50cda8259ee2c82c52034b12ff03f08a985cd6b16b1177e1.exe
Token: SeDebugPrivilege	1936	12651749cd4f3bca50cda8259ee2c82c52034b12ff03f08a985cd6b16b1177e1.exe
Token: SeSystemEnvironmentPrivilege	1936	12651749cd4f3bca50cda8259ee2c82c52034b12ff03f08a985cd6b16b1177e1.exe
Token: SeChangeNotifyPrivilege	1936	12651749cd4f3bca50cda8259ee2c82c52034b12ff03f08a985cd6b16b1177e1.exe
Token: SeRemoteShutdownPrivilege	1936	12651749cd4f3bca50cda8259ee2c82c52034b12ff03f08a985cd6b16b1177e1.exe
Token: SeUndockPrivilege	1936	12651749cd4f3bca50cda8259ee2c82c52034b12ff03f08a985cd6b16b1177e1.exe
Token: SeManageVolumePrivilege	1936	12651749cd4f3bca50cda8259ee2c82c52034b12ff03f08a985cd6b16b1177e1.exe
Token: SeImpersonatePrivilege	1936	12651749cd4f3bca50cda8259ee2c82c52034b12ff03f08a985cd6b16b1177e1.exe
Token: SeCreateGlobalPrivilege	1936	12651749cd4f3bca50cda8259ee2c82c52034b12ff03f08a985cd6b16b1177e1.exe
Token: 33	1936	12651749cd4f3bca50cda8259ee2c82c52034b12ff03f08a985cd6b16b1177e1.exe
Token: 34	1936	12651749cd4f3bca50cda8259ee2c82c52034b12ff03f08a985cd6b16b1177e1.exe
Token: 35	1936	12651749cd4f3bca50cda8259ee2c82c52034b12ff03f08a985cd6b16b1177e1.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

12651749cd4f3bca50cda8259ee2c82c52034b12ff03f08a985cd6b16b1177e1.exe

pid process

1936 12651749cd4f3bca50cda8259ee2c82c52034b12ff03f08a985cd6b16b1177e1.exe

pid	process
1936	12651749cd4f3bca50cda8259ee2c82c52034b12ff03f08a985cd6b16b1177e1.exe

C:\Users\Admin\AppData\Local\Temp\12651749cd4f3bca50cda8259ee2c82c52034b12ff03f08a985cd6b16b1177e1.exe
"C:\Users\Admin\AppData\Local\Temp\12651749cd4f3bca50cda8259ee2c82c52034b12ff03f08a985cd6b16b1177e1.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1936

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1936-54-0x0000000074DD1000-0x0000000074DD3000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing