darkcomet | 174b5972d69914f05347976f206595a8a89e09968e9c52bb2b495bbd80639388

Analysis

max time kernel
152s
max time network
159s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
14/10/2022, 10:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

174b5972d69914f05347976f206595a8a89e09968e9c52bb2b495bbd80639388.exe
Size

658KB
MD5

6ef0f2f4c7bd84eceff17aa19b819690
SHA1

2405569f3b3b7e54989f5b4bb0a6dffeef961bd8
SHA256

174b5972d69914f05347976f206595a8a89e09968e9c52bb2b495bbd80639388
SHA512

15953bbe730249b73064b4a190d9dce2ed5c5755796ebc3875f1f86f75a878c25785b39db523f3cc501599932845de9d1ce79497112bc13353e2d5d9ba08e3b5
SSDEEP

12288:q9HFJ9rJxRX1uVVjoaWSoynxdO1FVBaOiRZTERfIhNkNCCLo9Ek5C/hl:mZ1xuVVjfFoynPaVBUR8f+kN10EBz

Score

10^/10

darkcomet rat trojan

Malware Config

Signatures

Darkcomet
DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
trojan rat darkcomet
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 24 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	4624	174b5972d69914f05347976f206595a8a89e09968e9c52bb2b495bbd80639388.exe
Token: SeSecurityPrivilege	4624	174b5972d69914f05347976f206595a8a89e09968e9c52bb2b495bbd80639388.exe
Token: SeTakeOwnershipPrivilege	4624	174b5972d69914f05347976f206595a8a89e09968e9c52bb2b495bbd80639388.exe
Token: SeLoadDriverPrivilege	4624	174b5972d69914f05347976f206595a8a89e09968e9c52bb2b495bbd80639388.exe
Token: SeSystemProfilePrivilege	4624	174b5972d69914f05347976f206595a8a89e09968e9c52bb2b495bbd80639388.exe
Token: SeSystemtimePrivilege	4624	174b5972d69914f05347976f206595a8a89e09968e9c52bb2b495bbd80639388.exe
Token: SeProfSingleProcessPrivilege	4624	174b5972d69914f05347976f206595a8a89e09968e9c52bb2b495bbd80639388.exe
Token: SeIncBasePriorityPrivilege	4624	174b5972d69914f05347976f206595a8a89e09968e9c52bb2b495bbd80639388.exe
Token: SeCreatePagefilePrivilege	4624	174b5972d69914f05347976f206595a8a89e09968e9c52bb2b495bbd80639388.exe
Token: SeBackupPrivilege	4624	174b5972d69914f05347976f206595a8a89e09968e9c52bb2b495bbd80639388.exe
Token: SeRestorePrivilege	4624	174b5972d69914f05347976f206595a8a89e09968e9c52bb2b495bbd80639388.exe
Token: SeShutdownPrivilege	4624	174b5972d69914f05347976f206595a8a89e09968e9c52bb2b495bbd80639388.exe
Token: SeDebugPrivilege	4624	174b5972d69914f05347976f206595a8a89e09968e9c52bb2b495bbd80639388.exe
Token: SeSystemEnvironmentPrivilege	4624	174b5972d69914f05347976f206595a8a89e09968e9c52bb2b495bbd80639388.exe
Token: SeChangeNotifyPrivilege	4624	174b5972d69914f05347976f206595a8a89e09968e9c52bb2b495bbd80639388.exe
Token: SeRemoteShutdownPrivilege	4624	174b5972d69914f05347976f206595a8a89e09968e9c52bb2b495bbd80639388.exe
Token: SeUndockPrivilege	4624	174b5972d69914f05347976f206595a8a89e09968e9c52bb2b495bbd80639388.exe
Token: SeManageVolumePrivilege	4624	174b5972d69914f05347976f206595a8a89e09968e9c52bb2b495bbd80639388.exe
Token: SeImpersonatePrivilege	4624	174b5972d69914f05347976f206595a8a89e09968e9c52bb2b495bbd80639388.exe
Token: SeCreateGlobalPrivilege	4624	174b5972d69914f05347976f206595a8a89e09968e9c52bb2b495bbd80639388.exe
Token: 33	4624	174b5972d69914f05347976f206595a8a89e09968e9c52bb2b495bbd80639388.exe
Token: 34	4624	174b5972d69914f05347976f206595a8a89e09968e9c52bb2b495bbd80639388.exe
Token: 35	4624	174b5972d69914f05347976f206595a8a89e09968e9c52bb2b495bbd80639388.exe
Token: 36	4624	174b5972d69914f05347976f206595a8a89e09968e9c52bb2b495bbd80639388.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4624	174b5972d69914f05347976f206595a8a89e09968e9c52bb2b495bbd80639388.exe

C:\Users\Admin\AppData\Local\Temp\174b5972d69914f05347976f206595a8a89e09968e9c52bb2b495bbd80639388.exe
"C:\Users\Admin\AppData\Local\Temp\174b5972d69914f05347976f206595a8a89e09968e9c52bb2b495bbd80639388.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:4624

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Windows 7 deprecation

Loading Replay Monitor...