Analysis
- max time kernel
128s - max time network
144s - platform
windows7_x64 - resource
win7-20220812-en - resource tags
- submitted
19/10/2022, 22:54
General
- Target 51010e0eeafcda52e9684da64713b018f3884a57f82a64e53f6615f35fbbcfc8.exe
- Size 817KB
- Sample221019-2vtcfacacm
- SHA256 51010e0eeafcda52e9684da64713b018f3884a57f82a64e53f6615f35fbbcfc8
Malware Config
Signatures
- Darkcomet
DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
- Suspicious use of SetThreadContext 1 IoCs
- Suspicious behavior: EnumeratesProcesses 1 IoCs
- Suspicious use of AdjustPrivilegeToken 23 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 13 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\51010e0eeafcda52e9684da64713b018f3884a57f82a64e53f6615f35fbbcfc8.exe"C:\Users\Admin\AppData\Local\Temp\51010e0eeafcda52e9684da64713b018f3884a57f82a64e53f6615f35fbbcfc8.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\51010e0eeafcda52e9684da64713b018f3884a57f82a64e53f6615f35fbbcfc8.exeC:\Users\Admin\AppData\Local\Temp\51010e0eeafcda52e9684da64713b018f3884a57f82a64e53f6615f35fbbcfc8.exe2⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1052-64-0x0000000000220000-0x0000000000224000-memory.dmp
memory/1052-54-0x0000000075931000-0x0000000075933000-memory.dmp
memory/1240-66-0x0000000000400000-0x0000000001400000-memory.dmp
memory/1240-68-0x0000000000400000-0x0000000001400000-memory.dmp
memory/1240-60-0x0000000000400000-0x0000000001400000-memory.dmp
memory/1240-62-0x0000000000400000-0x0000000001400000-memory.dmp
memory/1240-56-0x0000000000400000-0x0000000001400000-memory.dmp
memory/1240-65-0x0000000000400000-0x0000000001400000-memory.dmp
memory/1240-55-0x0000000000400000-0x0000000001400000-memory.dmp
memory/1240-58-0x0000000000400000-0x0000000001400000-memory.dmp
memory/1240-70-0x0000000000400000-0x0000000001400000-memory.dmp
memory/1240-72-0x0000000000400000-0x0000000001400000-memory.dmp
memory/1240-74-0x0000000000400000-0x0000000001400000-memory.dmp
memory/1240-75-0x0000000000400000-0x00000000004AF000-memory.dmp
memory/1240-76-0x0000000000400000-0x00000000004AF000-memory.dmp