Analysis
-
max time kernel
150s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
12-06-2022 17:56
General
-
Target
22.exe
-
Size
658KB
-
MD5
ba8d307d8fd150133b061ab78879bc55
-
SHA1
461b6f6590d864b2de8747b623136a3d2b7f670d
-
SHA256
d5b1183cad103ba8d1e8ac590ec9d9af8f29cf4b386957b4a94bb6070d17ba34
-
SHA512
96dec94e4d5e55e8aae149be8d0f09eef837aaec798a003f05f3bfead2bef9c4b65f4e047f597a5eeef12fc4e8f14d2570d88ee3a9db01908df011587479e724
Score
10/10
Malware Config
Signatures
-
Darkcomet
DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of AdjustPrivilegeToken 24 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\22.exe"C:\Users\Admin\AppData\Local\Temp\22.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx