darkcomet | a5534269c31ad45388e95500ca5189387e9dfeb9ce67976713064f217e006f47

General

Target

a5534269c31ad45388e95500ca5189387e9dfeb9ce67976713064f217e006f47.exe
Size

2.0MB
MD5

8ddd5abd984211d9c01cbfe753d7febb
SHA1

b86b0d991a42d9d636b6e63e566e09541cd4ec90
SHA256

a5534269c31ad45388e95500ca5189387e9dfeb9ce67976713064f217e006f47
SHA512

1ef7bfc9a72135da78f94aee153355659eddb514100d23ed5ad558436fedcee6f673658d2af9210e829630a2fd282abacc38f0330646717a43754c387e3528c8

Score

10^/10

darkcomet rat trojan

Malware Config

Signatures

Darkcomet
DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
trojan rat darkcomet

Suspicious use of SetThreadContext 1 IoCs

Processes:

a5534269c31ad45388e95500ca5189387e9dfeb9ce67976713064f217e006f47.exe

description	pid	process	target process
PID 636 set thread context of 100	636	a5534269c31ad45388e95500ca5189387e9dfeb9ce67976713064f217e006f47.exe	a5534269c31ad45388e95500ca5189387e9dfeb9ce67976713064f217e006f47.exe

Suspicious use of AdjustPrivilegeToken 25 IoCs

Processes:

a5534269c31ad45388e95500ca5189387e9dfeb9ce67976713064f217e006f47.exea5534269c31ad45388e95500ca5189387e9dfeb9ce67976713064f217e006f47.exe

description	pid	process
Token: SeDebugPrivilege	636	a5534269c31ad45388e95500ca5189387e9dfeb9ce67976713064f217e006f47.exe
Token: SeIncreaseQuotaPrivilege	100	a5534269c31ad45388e95500ca5189387e9dfeb9ce67976713064f217e006f47.exe
Token: SeSecurityPrivilege	100	a5534269c31ad45388e95500ca5189387e9dfeb9ce67976713064f217e006f47.exe
Token: SeTakeOwnershipPrivilege	100	a5534269c31ad45388e95500ca5189387e9dfeb9ce67976713064f217e006f47.exe
Token: SeLoadDriverPrivilege	100	a5534269c31ad45388e95500ca5189387e9dfeb9ce67976713064f217e006f47.exe
Token: SeSystemProfilePrivilege	100	a5534269c31ad45388e95500ca5189387e9dfeb9ce67976713064f217e006f47.exe
Token: SeSystemtimePrivilege	100	a5534269c31ad45388e95500ca5189387e9dfeb9ce67976713064f217e006f47.exe
Token: SeProfSingleProcessPrivilege	100	a5534269c31ad45388e95500ca5189387e9dfeb9ce67976713064f217e006f47.exe
Token: SeIncBasePriorityPrivilege	100	a5534269c31ad45388e95500ca5189387e9dfeb9ce67976713064f217e006f47.exe
Token: SeCreatePagefilePrivilege	100	a5534269c31ad45388e95500ca5189387e9dfeb9ce67976713064f217e006f47.exe
Token: SeBackupPrivilege	100	a5534269c31ad45388e95500ca5189387e9dfeb9ce67976713064f217e006f47.exe
Token: SeRestorePrivilege	100	a5534269c31ad45388e95500ca5189387e9dfeb9ce67976713064f217e006f47.exe
Token: SeShutdownPrivilege	100	a5534269c31ad45388e95500ca5189387e9dfeb9ce67976713064f217e006f47.exe
Token: SeDebugPrivilege	100	a5534269c31ad45388e95500ca5189387e9dfeb9ce67976713064f217e006f47.exe
Token: SeSystemEnvironmentPrivilege	100	a5534269c31ad45388e95500ca5189387e9dfeb9ce67976713064f217e006f47.exe
Token: SeChangeNotifyPrivilege	100	a5534269c31ad45388e95500ca5189387e9dfeb9ce67976713064f217e006f47.exe
Token: SeRemoteShutdownPrivilege	100	a5534269c31ad45388e95500ca5189387e9dfeb9ce67976713064f217e006f47.exe
Token: SeUndockPrivilege	100	a5534269c31ad45388e95500ca5189387e9dfeb9ce67976713064f217e006f47.exe
Token: SeManageVolumePrivilege	100	a5534269c31ad45388e95500ca5189387e9dfeb9ce67976713064f217e006f47.exe
Token: SeImpersonatePrivilege	100	a5534269c31ad45388e95500ca5189387e9dfeb9ce67976713064f217e006f47.exe
Token: SeCreateGlobalPrivilege	100	a5534269c31ad45388e95500ca5189387e9dfeb9ce67976713064f217e006f47.exe
Token: 33	100	a5534269c31ad45388e95500ca5189387e9dfeb9ce67976713064f217e006f47.exe
Token: 34	100	a5534269c31ad45388e95500ca5189387e9dfeb9ce67976713064f217e006f47.exe
Token: 35	100	a5534269c31ad45388e95500ca5189387e9dfeb9ce67976713064f217e006f47.exe
Token: 36	100	a5534269c31ad45388e95500ca5189387e9dfeb9ce67976713064f217e006f47.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

a5534269c31ad45388e95500ca5189387e9dfeb9ce67976713064f217e006f47.exe

pid process

100 a5534269c31ad45388e95500ca5189387e9dfeb9ce67976713064f217e006f47.exe

pid	process
100	a5534269c31ad45388e95500ca5189387e9dfeb9ce67976713064f217e006f47.exe

Suspicious use of WriteProcessMemory 5 IoCs

Processes:

a5534269c31ad45388e95500ca5189387e9dfeb9ce67976713064f217e006f47.exe

description	pid	process	target process
PID 636 wrote to memory of 100	636	a5534269c31ad45388e95500ca5189387e9dfeb9ce67976713064f217e006f47.exe	a5534269c31ad45388e95500ca5189387e9dfeb9ce67976713064f217e006f47.exe
PID 636 wrote to memory of 100	636	a5534269c31ad45388e95500ca5189387e9dfeb9ce67976713064f217e006f47.exe	a5534269c31ad45388e95500ca5189387e9dfeb9ce67976713064f217e006f47.exe
PID 636 wrote to memory of 100	636	a5534269c31ad45388e95500ca5189387e9dfeb9ce67976713064f217e006f47.exe	a5534269c31ad45388e95500ca5189387e9dfeb9ce67976713064f217e006f47.exe
PID 636 wrote to memory of 100	636	a5534269c31ad45388e95500ca5189387e9dfeb9ce67976713064f217e006f47.exe	a5534269c31ad45388e95500ca5189387e9dfeb9ce67976713064f217e006f47.exe
PID 636 wrote to memory of 100	636	a5534269c31ad45388e95500ca5189387e9dfeb9ce67976713064f217e006f47.exe	a5534269c31ad45388e95500ca5189387e9dfeb9ce67976713064f217e006f47.exe

C:\Users\Admin\AppData\Local\Temp\a5534269c31ad45388e95500ca5189387e9dfeb9ce67976713064f217e006f47.exe
"C:\Users\Admin\AppData\Local\Temp\a5534269c31ad45388e95500ca5189387e9dfeb9ce67976713064f217e006f47.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:636

C:\Users\Admin\AppData\Local\Temp\a5534269c31ad45388e95500ca5189387e9dfeb9ce67976713064f217e006f47.exe
C:\Users\Admin\AppData\Local\Temp\a5534269c31ad45388e95500ca5189387e9dfeb9ce67976713064f217e006f47.exe
2⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:100

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/100-131-0x0000000000000000-mapping.dmp

Download
memory/100-133-0x0000000000400000-0x00000000004B3000-memory.dmp

Filesize
716KB

Download
memory/100-132-0x0000000000400000-0x00000000004B3000-memory.dmp

Filesize
716KB

Download
memory/100-134-0x0000000000400000-0x00000000004B3000-memory.dmp

Filesize
716KB

Download
memory/100-135-0x0000000000400000-0x00000000004B3000-memory.dmp

Filesize
716KB

Download
memory/100-137-0x0000000000400000-0x00000000004B3000-memory.dmp

Filesize
716KB

Download
memory/636-130-0x00000000754C0000-0x0000000075A71000-memory.dmp

Filesize
5.7MB

Download
memory/636-136-0x00000000754C0000-0x0000000075A71000-memory.dmp

Filesize
5.7MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads