darkcomet | 317fa1c53cc4c6b6856870beb96c644ee502ccf3cee0eb680704a24ce19e87e0

Analysis

max time kernel
76s
max time network
126s
platform
windows10-2004_x64
resource
win10v2004-20220721-en
resource tags

arch:x64arch:x86image:win10v2004-20220721-enlocale:en-usos:windows10-2004-x64system
submitted
25-07-2022 00:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

317fa1c53cc4c6b6856870beb96c644ee502ccf3cee0eb680704a24ce19e87e0.exe
Size

658KB
MD5

511e143be757301d22af747e088652ca
SHA1

aa7bf912e10d369171312cbe51f972580853bc00
SHA256

317fa1c53cc4c6b6856870beb96c644ee502ccf3cee0eb680704a24ce19e87e0
SHA512

409fe87dec2fc21eb874557aeca9560d9218a74e9b78fac3341964cf0fd8108b3902c9775306797fa5e1c3816330098d94c2b039c947bd7dff613cf367952521

Score

10^/10

darkcomet rat trojan

Malware Config

Signatures

Darkcomet
DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
trojan rat darkcomet
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 24 IoCs

Processes:

317fa1c53cc4c6b6856870beb96c644ee502ccf3cee0eb680704a24ce19e87e0.exe

description	pid	process
Token: SeIncreaseQuotaPrivilege	3976	317fa1c53cc4c6b6856870beb96c644ee502ccf3cee0eb680704a24ce19e87e0.exe
Token: SeSecurityPrivilege	3976	317fa1c53cc4c6b6856870beb96c644ee502ccf3cee0eb680704a24ce19e87e0.exe
Token: SeTakeOwnershipPrivilege	3976	317fa1c53cc4c6b6856870beb96c644ee502ccf3cee0eb680704a24ce19e87e0.exe
Token: SeLoadDriverPrivilege	3976	317fa1c53cc4c6b6856870beb96c644ee502ccf3cee0eb680704a24ce19e87e0.exe
Token: SeSystemProfilePrivilege	3976	317fa1c53cc4c6b6856870beb96c644ee502ccf3cee0eb680704a24ce19e87e0.exe
Token: SeSystemtimePrivilege	3976	317fa1c53cc4c6b6856870beb96c644ee502ccf3cee0eb680704a24ce19e87e0.exe
Token: SeProfSingleProcessPrivilege	3976	317fa1c53cc4c6b6856870beb96c644ee502ccf3cee0eb680704a24ce19e87e0.exe
Token: SeIncBasePriorityPrivilege	3976	317fa1c53cc4c6b6856870beb96c644ee502ccf3cee0eb680704a24ce19e87e0.exe
Token: SeCreatePagefilePrivilege	3976	317fa1c53cc4c6b6856870beb96c644ee502ccf3cee0eb680704a24ce19e87e0.exe
Token: SeBackupPrivilege	3976	317fa1c53cc4c6b6856870beb96c644ee502ccf3cee0eb680704a24ce19e87e0.exe
Token: SeRestorePrivilege	3976	317fa1c53cc4c6b6856870beb96c644ee502ccf3cee0eb680704a24ce19e87e0.exe
Token: SeShutdownPrivilege	3976	317fa1c53cc4c6b6856870beb96c644ee502ccf3cee0eb680704a24ce19e87e0.exe
Token: SeDebugPrivilege	3976	317fa1c53cc4c6b6856870beb96c644ee502ccf3cee0eb680704a24ce19e87e0.exe
Token: SeSystemEnvironmentPrivilege	3976	317fa1c53cc4c6b6856870beb96c644ee502ccf3cee0eb680704a24ce19e87e0.exe
Token: SeChangeNotifyPrivilege	3976	317fa1c53cc4c6b6856870beb96c644ee502ccf3cee0eb680704a24ce19e87e0.exe
Token: SeRemoteShutdownPrivilege	3976	317fa1c53cc4c6b6856870beb96c644ee502ccf3cee0eb680704a24ce19e87e0.exe
Token: SeUndockPrivilege	3976	317fa1c53cc4c6b6856870beb96c644ee502ccf3cee0eb680704a24ce19e87e0.exe
Token: SeManageVolumePrivilege	3976	317fa1c53cc4c6b6856870beb96c644ee502ccf3cee0eb680704a24ce19e87e0.exe
Token: SeImpersonatePrivilege	3976	317fa1c53cc4c6b6856870beb96c644ee502ccf3cee0eb680704a24ce19e87e0.exe
Token: SeCreateGlobalPrivilege	3976	317fa1c53cc4c6b6856870beb96c644ee502ccf3cee0eb680704a24ce19e87e0.exe
Token: 33	3976	317fa1c53cc4c6b6856870beb96c644ee502ccf3cee0eb680704a24ce19e87e0.exe
Token: 34	3976	317fa1c53cc4c6b6856870beb96c644ee502ccf3cee0eb680704a24ce19e87e0.exe
Token: 35	3976	317fa1c53cc4c6b6856870beb96c644ee502ccf3cee0eb680704a24ce19e87e0.exe
Token: 36	3976	317fa1c53cc4c6b6856870beb96c644ee502ccf3cee0eb680704a24ce19e87e0.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

317fa1c53cc4c6b6856870beb96c644ee502ccf3cee0eb680704a24ce19e87e0.exe

pid process

3976 317fa1c53cc4c6b6856870beb96c644ee502ccf3cee0eb680704a24ce19e87e0.exe

pid	process
3976	317fa1c53cc4c6b6856870beb96c644ee502ccf3cee0eb680704a24ce19e87e0.exe

C:\Users\Admin\AppData\Local\Temp\317fa1c53cc4c6b6856870beb96c644ee502ccf3cee0eb680704a24ce19e87e0.exe
"C:\Users\Admin\AppData\Local\Temp\317fa1c53cc4c6b6856870beb96c644ee502ccf3cee0eb680704a24ce19e87e0.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:3976

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads