darkcomet | 802a0a16f577dd175c1c91a1b3802a5db6c00540910f7a9b7644b2829c940e7d

Analysis

max time kernel
150s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
18/10/2022, 20:40

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
802a0a16f577dd175c1c91a1b3802a5db6c00540910f7a9b7644b2829c940e7d.exe
Size 660KB
Sample221018-zfv7daeben
SHA256 802a0a16f577dd175c1c91a1b3802a5db6c00540910f7a9b7644b2829c940e7d
MD5 1c1b2b91048704b3acec27b8e7c31e77
SHA1 0290be8525d022a5c96c7bfdb25c99ce68ed08c8
SHA512 0ab98efc321f32bd157ef58b2a002f763064ddcb6cc3b6bd12c4652348724be9a4b8c7766b15bc3bcc9022e320b911b4e6c8140e0da5201d5849137a7d5a5b23
SSDEEP 12288:UXhpvNWw276S/DuoeFcfbmiJ99VPhYR5MTSHvLenELrWv1lZw4JuMkMh/fy452UD:CnAw2WWeFcfbP9VPSPMTSPL/rWvzq4Jz
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

darkcomet rat trojan

Malware Config

Signatures

Darkcomet
DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
trojan rat darkcomet
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 24 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	964	802a0a16f577dd175c1c91a1b3802a5db6c00540910f7a9b7644b2829c940e7d.exe
Token: SeSecurityPrivilege	964	802a0a16f577dd175c1c91a1b3802a5db6c00540910f7a9b7644b2829c940e7d.exe
Token: SeTakeOwnershipPrivilege	964	802a0a16f577dd175c1c91a1b3802a5db6c00540910f7a9b7644b2829c940e7d.exe
Token: SeLoadDriverPrivilege	964	802a0a16f577dd175c1c91a1b3802a5db6c00540910f7a9b7644b2829c940e7d.exe
Token: SeSystemProfilePrivilege	964	802a0a16f577dd175c1c91a1b3802a5db6c00540910f7a9b7644b2829c940e7d.exe
Token: SeSystemtimePrivilege	964	802a0a16f577dd175c1c91a1b3802a5db6c00540910f7a9b7644b2829c940e7d.exe
Token: SeProfSingleProcessPrivilege	964	802a0a16f577dd175c1c91a1b3802a5db6c00540910f7a9b7644b2829c940e7d.exe
Token: SeIncBasePriorityPrivilege	964	802a0a16f577dd175c1c91a1b3802a5db6c00540910f7a9b7644b2829c940e7d.exe
Token: SeCreatePagefilePrivilege	964	802a0a16f577dd175c1c91a1b3802a5db6c00540910f7a9b7644b2829c940e7d.exe
Token: SeBackupPrivilege	964	802a0a16f577dd175c1c91a1b3802a5db6c00540910f7a9b7644b2829c940e7d.exe
Token: SeRestorePrivilege	964	802a0a16f577dd175c1c91a1b3802a5db6c00540910f7a9b7644b2829c940e7d.exe
Token: SeShutdownPrivilege	964	802a0a16f577dd175c1c91a1b3802a5db6c00540910f7a9b7644b2829c940e7d.exe
Token: SeDebugPrivilege	964	802a0a16f577dd175c1c91a1b3802a5db6c00540910f7a9b7644b2829c940e7d.exe
Token: SeSystemEnvironmentPrivilege	964	802a0a16f577dd175c1c91a1b3802a5db6c00540910f7a9b7644b2829c940e7d.exe
Token: SeChangeNotifyPrivilege	964	802a0a16f577dd175c1c91a1b3802a5db6c00540910f7a9b7644b2829c940e7d.exe
Token: SeRemoteShutdownPrivilege	964	802a0a16f577dd175c1c91a1b3802a5db6c00540910f7a9b7644b2829c940e7d.exe
Token: SeUndockPrivilege	964	802a0a16f577dd175c1c91a1b3802a5db6c00540910f7a9b7644b2829c940e7d.exe
Token: SeManageVolumePrivilege	964	802a0a16f577dd175c1c91a1b3802a5db6c00540910f7a9b7644b2829c940e7d.exe
Token: SeImpersonatePrivilege	964	802a0a16f577dd175c1c91a1b3802a5db6c00540910f7a9b7644b2829c940e7d.exe
Token: SeCreateGlobalPrivilege	964	802a0a16f577dd175c1c91a1b3802a5db6c00540910f7a9b7644b2829c940e7d.exe
Token: 33	964	802a0a16f577dd175c1c91a1b3802a5db6c00540910f7a9b7644b2829c940e7d.exe
Token: 34	964	802a0a16f577dd175c1c91a1b3802a5db6c00540910f7a9b7644b2829c940e7d.exe
Token: 35	964	802a0a16f577dd175c1c91a1b3802a5db6c00540910f7a9b7644b2829c940e7d.exe
Token: 36	964	802a0a16f577dd175c1c91a1b3802a5db6c00540910f7a9b7644b2829c940e7d.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
964	802a0a16f577dd175c1c91a1b3802a5db6c00540910f7a9b7644b2829c940e7d.exe

C:\Users\Admin\AppData\Local\Temp\802a0a16f577dd175c1c91a1b3802a5db6c00540910f7a9b7644b2829c940e7d.exe
"C:\Users\Admin\AppData\Local\Temp\802a0a16f577dd175c1c91a1b3802a5db6c00540910f7a9b7644b2829c940e7d.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:964

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads