darkcomet | adca00db81cc70ecc929abd536fcf42b151ae31262161b0d45ccb1fe086efdc5

Resubmissions

05/02/2025, 07:31

250205-jchtwaxrdr 10

05/02/2025, 07:08

250205-hypnwaxlbn 10

01/10/2022, 22:21

221001-194laabben 10

Analysis

max time kernel
45s
max time network
49s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
01/10/2022, 22:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

adca00db81cc70ecc929abd536fcf42b151ae31262161b0d45ccb1fe086efdc5.exe
Size

912KB
MD5

76646fd5ea2d2751ac7b511e779a2bb0
SHA1

6fe54343774059ecd1514f64244ef1c716226764
SHA256

adca00db81cc70ecc929abd536fcf42b151ae31262161b0d45ccb1fe086efdc5
SHA512

0a680679f345f26e7054a28561043e882a94d4abaff107a129ea3650d241def6ace3e10f8f5743b653ed82582960ca5529c55949cc4684f1a5ac26b2ea305b19
SSDEEP

12288:YFWvfST6ZtZJYSgkNyevrtJNt4wShikgfEYq4wWz0hanJ8/75uKgu8QUjgmN:YKfSTwoSbMivwRhVtuAf8gmN

Score

10^/10

darkcomet rat trojan

Malware Config

Signatures

Darkcomet
DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
trojan rat darkcomet

Loads dropped DLL 1 IoCs

pid	Process
1064	adca00db81cc70ecc929abd536fcf42b151ae31262161b0d45ccb1fe086efdc5.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
1064	adca00db81cc70ecc929abd536fcf42b151ae31262161b0d45ccb1fe086efdc5.exe
1064	adca00db81cc70ecc929abd536fcf42b151ae31262161b0d45ccb1fe086efdc5.exe
1064	adca00db81cc70ecc929abd536fcf42b151ae31262161b0d45ccb1fe086efdc5.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1064	adca00db81cc70ecc929abd536fcf42b151ae31262161b0d45ccb1fe086efdc5.exe
1064	adca00db81cc70ecc929abd536fcf42b151ae31262161b0d45ccb1fe086efdc5.exe

Suspicious use of WriteProcessMemory 22 IoCs

description	pid	Process	procid_target
PID 1064 wrote to memory of 1732	1064	adca00db81cc70ecc929abd536fcf42b151ae31262161b0d45ccb1fe086efdc5.exe	27
PID 1064 wrote to memory of 1732	1064	adca00db81cc70ecc929abd536fcf42b151ae31262161b0d45ccb1fe086efdc5.exe	27
PID 1064 wrote to memory of 1732	1064	adca00db81cc70ecc929abd536fcf42b151ae31262161b0d45ccb1fe086efdc5.exe	27
PID 1064 wrote to memory of 1732	1064	adca00db81cc70ecc929abd536fcf42b151ae31262161b0d45ccb1fe086efdc5.exe	27
PID 1064 wrote to memory of 1960	1064	adca00db81cc70ecc929abd536fcf42b151ae31262161b0d45ccb1fe086efdc5.exe	28
PID 1064 wrote to memory of 1960	1064	adca00db81cc70ecc929abd536fcf42b151ae31262161b0d45ccb1fe086efdc5.exe	28
PID 1064 wrote to memory of 1960	1064	adca00db81cc70ecc929abd536fcf42b151ae31262161b0d45ccb1fe086efdc5.exe	28
PID 1064 wrote to memory of 1960	1064	adca00db81cc70ecc929abd536fcf42b151ae31262161b0d45ccb1fe086efdc5.exe	28
PID 1064 wrote to memory of 1960	1064	adca00db81cc70ecc929abd536fcf42b151ae31262161b0d45ccb1fe086efdc5.exe	28
PID 1064 wrote to memory of 1960	1064	adca00db81cc70ecc929abd536fcf42b151ae31262161b0d45ccb1fe086efdc5.exe	28
PID 1732 wrote to memory of 1608	1732	cmd.exe	30
PID 1732 wrote to memory of 1608	1732	cmd.exe	30
PID 1732 wrote to memory of 1608	1732	cmd.exe	30
PID 1732 wrote to memory of 1608	1732	cmd.exe	30
PID 1064 wrote to memory of 1960	1064	adca00db81cc70ecc929abd536fcf42b151ae31262161b0d45ccb1fe086efdc5.exe	28
PID 1064 wrote to memory of 1960	1064	adca00db81cc70ecc929abd536fcf42b151ae31262161b0d45ccb1fe086efdc5.exe	28
PID 1064 wrote to memory of 1960	1064	adca00db81cc70ecc929abd536fcf42b151ae31262161b0d45ccb1fe086efdc5.exe	28
PID 1608 wrote to memory of 268	1608	net.exe	31
PID 1608 wrote to memory of 268	1608	net.exe	31
PID 1608 wrote to memory of 268	1608	net.exe	31
PID 1608 wrote to memory of 268	1608	net.exe	31
PID 1064 wrote to memory of 1960	1064	adca00db81cc70ecc929abd536fcf42b151ae31262161b0d45ccb1fe086efdc5.exe	28

C:\Users\Admin\AppData\Local\Temp\adca00db81cc70ecc929abd536fcf42b151ae31262161b0d45ccb1fe086efdc5.exe
"C:\Users\Admin\AppData\Local\Temp\adca00db81cc70ecc929abd536fcf42b151ae31262161b0d45ccb1fe086efdc5.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1064
- C:\Windows\SysWOW64\cmd.exe
  /c net stop MpsSvc
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1732
- - C:\Windows\SysWOW64\net.exe
    net stop MpsSvc
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1608
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop MpsSvc
      4⤵
      PID:268
- C:\Users\Admin\AppData\Local\Temp\adca00db81cc70ecc929abd536fcf42b151ae31262161b0d45ccb1fe086efdc5.exe
  C:\Users\Admin\AppData\Local\Temp\adca00db81cc70ecc929abd536fcf42b151ae31262161b0d45ccb1fe086efdc5.exe
  2⤵
  PID:1960

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\adca00db81cc70ecc929abd536fcf42b151ae31262161b0d45ccb1fe086efdc5.exe

Filesize
912KB

MD5
76646fd5ea2d2751ac7b511e779a2bb0

SHA1
6fe54343774059ecd1514f64244ef1c716226764

SHA256
adca00db81cc70ecc929abd536fcf42b151ae31262161b0d45ccb1fe086efdc5

SHA512
0a680679f345f26e7054a28561043e882a94d4abaff107a129ea3650d241def6ace3e10f8f5743b653ed82582960ca5529c55949cc4684f1a5ac26b2ea305b19

Download Submit
memory/1064-71-0x0000000000250000-0x0000000000254000-memory.dmp

Filesize
16KB

Download
memory/1064-54-0x0000000075BB1000-0x0000000075BB3000-memory.dmp

Filesize
8KB

Download
memory/1960-58-0x0000000000400000-0x00000000004B5000-memory.dmp

Filesize
724KB

Download
memory/1960-63-0x0000000000400000-0x00000000004B5000-memory.dmp

Filesize
724KB

Download
memory/1960-65-0x0000000000400000-0x00000000004B5000-memory.dmp

Filesize
724KB

Download
memory/1960-60-0x0000000000400000-0x00000000004B5000-memory.dmp

Filesize
724KB

Download
memory/1960-67-0x0000000000400000-0x00000000004B5000-memory.dmp

Filesize
724KB

Download
memory/1960-69-0x0000000000400000-0x00000000004B5000-memory.dmp

Filesize
724KB

Download
memory/1960-57-0x0000000000400000-0x00000000004B5000-memory.dmp

Filesize
724KB

Download