darkcomet | 8362038982ae5c1ebec24d4c5b1ad15e7da657ebaac2496d9a1a2865463edfb2

Analysis

max time kernel
155s
max time network
158s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
03-10-2022 16:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8362038982ae5c1ebec24d4c5b1ad15e7da657ebaac2496d9a1a2865463edfb2.exe
Size

689KB
MD5

6026423e7940d5405e9d6e8e4491e4a0
SHA1

e59c79df90af9a7915c9e654c74854c9ca75ee41
SHA256

8362038982ae5c1ebec24d4c5b1ad15e7da657ebaac2496d9a1a2865463edfb2
SHA512

e73a7a89009e181903f71bb78976df21241b2c104c9a5349f83c925e0469c1a2bd8ad57acbcd5ce009667d15bf08c7ee9c04da6f27d3609272b7aeb4432131d3
SSDEEP

12288:R9HFJ9rJxRX1uVVjoaWSoynxdO1FVBaOiRZTERfIhNkNCCLo9Ek5C/h4n:LZ1xuVVjfFoynPaVBUR8f+kN10EBQ

Score

10^/10

darkcomet rat trojan

Malware Config

Signatures

Darkcomet
DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
trojan rat darkcomet
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 24 IoCs

Processes:

8362038982ae5c1ebec24d4c5b1ad15e7da657ebaac2496d9a1a2865463edfb2.exe

description	pid	process
Token: SeIncreaseQuotaPrivilege	4500	8362038982ae5c1ebec24d4c5b1ad15e7da657ebaac2496d9a1a2865463edfb2.exe
Token: SeSecurityPrivilege	4500	8362038982ae5c1ebec24d4c5b1ad15e7da657ebaac2496d9a1a2865463edfb2.exe
Token: SeTakeOwnershipPrivilege	4500	8362038982ae5c1ebec24d4c5b1ad15e7da657ebaac2496d9a1a2865463edfb2.exe
Token: SeLoadDriverPrivilege	4500	8362038982ae5c1ebec24d4c5b1ad15e7da657ebaac2496d9a1a2865463edfb2.exe
Token: SeSystemProfilePrivilege	4500	8362038982ae5c1ebec24d4c5b1ad15e7da657ebaac2496d9a1a2865463edfb2.exe
Token: SeSystemtimePrivilege	4500	8362038982ae5c1ebec24d4c5b1ad15e7da657ebaac2496d9a1a2865463edfb2.exe
Token: SeProfSingleProcessPrivilege	4500	8362038982ae5c1ebec24d4c5b1ad15e7da657ebaac2496d9a1a2865463edfb2.exe
Token: SeIncBasePriorityPrivilege	4500	8362038982ae5c1ebec24d4c5b1ad15e7da657ebaac2496d9a1a2865463edfb2.exe
Token: SeCreatePagefilePrivilege	4500	8362038982ae5c1ebec24d4c5b1ad15e7da657ebaac2496d9a1a2865463edfb2.exe
Token: SeBackupPrivilege	4500	8362038982ae5c1ebec24d4c5b1ad15e7da657ebaac2496d9a1a2865463edfb2.exe
Token: SeRestorePrivilege	4500	8362038982ae5c1ebec24d4c5b1ad15e7da657ebaac2496d9a1a2865463edfb2.exe
Token: SeShutdownPrivilege	4500	8362038982ae5c1ebec24d4c5b1ad15e7da657ebaac2496d9a1a2865463edfb2.exe
Token: SeDebugPrivilege	4500	8362038982ae5c1ebec24d4c5b1ad15e7da657ebaac2496d9a1a2865463edfb2.exe
Token: SeSystemEnvironmentPrivilege	4500	8362038982ae5c1ebec24d4c5b1ad15e7da657ebaac2496d9a1a2865463edfb2.exe
Token: SeChangeNotifyPrivilege	4500	8362038982ae5c1ebec24d4c5b1ad15e7da657ebaac2496d9a1a2865463edfb2.exe
Token: SeRemoteShutdownPrivilege	4500	8362038982ae5c1ebec24d4c5b1ad15e7da657ebaac2496d9a1a2865463edfb2.exe
Token: SeUndockPrivilege	4500	8362038982ae5c1ebec24d4c5b1ad15e7da657ebaac2496d9a1a2865463edfb2.exe
Token: SeManageVolumePrivilege	4500	8362038982ae5c1ebec24d4c5b1ad15e7da657ebaac2496d9a1a2865463edfb2.exe
Token: SeImpersonatePrivilege	4500	8362038982ae5c1ebec24d4c5b1ad15e7da657ebaac2496d9a1a2865463edfb2.exe
Token: SeCreateGlobalPrivilege	4500	8362038982ae5c1ebec24d4c5b1ad15e7da657ebaac2496d9a1a2865463edfb2.exe
Token: 33	4500	8362038982ae5c1ebec24d4c5b1ad15e7da657ebaac2496d9a1a2865463edfb2.exe
Token: 34	4500	8362038982ae5c1ebec24d4c5b1ad15e7da657ebaac2496d9a1a2865463edfb2.exe
Token: 35	4500	8362038982ae5c1ebec24d4c5b1ad15e7da657ebaac2496d9a1a2865463edfb2.exe
Token: 36	4500	8362038982ae5c1ebec24d4c5b1ad15e7da657ebaac2496d9a1a2865463edfb2.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

8362038982ae5c1ebec24d4c5b1ad15e7da657ebaac2496d9a1a2865463edfb2.exe

pid process

4500 8362038982ae5c1ebec24d4c5b1ad15e7da657ebaac2496d9a1a2865463edfb2.exe

pid	process
4500	8362038982ae5c1ebec24d4c5b1ad15e7da657ebaac2496d9a1a2865463edfb2.exe

C:\Users\Admin\AppData\Local\Temp\8362038982ae5c1ebec24d4c5b1ad15e7da657ebaac2496d9a1a2865463edfb2.exe
"C:\Users\Admin\AppData\Local\Temp\8362038982ae5c1ebec24d4c5b1ad15e7da657ebaac2496d9a1a2865463edfb2.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:4500

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads