darkcomet | b4c1c4905b766e0a744b6c6084a07bdfd6830c267505bc16354deb2ba89e2da9

Analysis

max time kernel
193s
max time network
45s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
20/10/2022, 21:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b4c1c4905b766e0a744b6c6084a07bdfd6830c267505bc16354deb2ba89e2da9.exe
Size

251KB
MD5

a00dfa4b09eed88ed647d6847f341ff0
SHA1

a35f48b767d0c0ce1114b36a0be3c64c2c987728
SHA256

b4c1c4905b766e0a744b6c6084a07bdfd6830c267505bc16354deb2ba89e2da9
SHA512

c2e1ae5ece170bd08a76d07a379d999d831015d36771e172327cca781b1cef7c8e1e7d44cf3ec0bb5cae6fea914cfbdf8471ee3c5a26720388709597aecb0f74
SSDEEP

6144:WcNYS996KFifeVjBpeExgVTFSXFoMc5o3AYEok:WcW7KEZlPow

Score

10^/10

darkcomet safa7 rat trojan upx

Malware Config

Extracted

Family

darkcomet

Botnet

SaFa7

127.0.0.1:14312

Mutex

DC_MUTEX-YJJJGML

Attributes

gencode
Pf6aQEENDAeA
install
false
offline_keylogger
true
password
11
persistence
false

Signatures

Darkcomet
DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
trojan rat darkcomet

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1388-54-0x0000000000400000-0x00000000004B7000-memory.dmp	upx
behavioral1/memory/1388-56-0x0000000000400000-0x00000000004B7000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 23 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	1388	b4c1c4905b766e0a744b6c6084a07bdfd6830c267505bc16354deb2ba89e2da9.exe
Token: SeSecurityPrivilege	1388	b4c1c4905b766e0a744b6c6084a07bdfd6830c267505bc16354deb2ba89e2da9.exe
Token: SeTakeOwnershipPrivilege	1388	b4c1c4905b766e0a744b6c6084a07bdfd6830c267505bc16354deb2ba89e2da9.exe
Token: SeLoadDriverPrivilege	1388	b4c1c4905b766e0a744b6c6084a07bdfd6830c267505bc16354deb2ba89e2da9.exe
Token: SeSystemProfilePrivilege	1388	b4c1c4905b766e0a744b6c6084a07bdfd6830c267505bc16354deb2ba89e2da9.exe
Token: SeSystemtimePrivilege	1388	b4c1c4905b766e0a744b6c6084a07bdfd6830c267505bc16354deb2ba89e2da9.exe
Token: SeProfSingleProcessPrivilege	1388	b4c1c4905b766e0a744b6c6084a07bdfd6830c267505bc16354deb2ba89e2da9.exe
Token: SeIncBasePriorityPrivilege	1388	b4c1c4905b766e0a744b6c6084a07bdfd6830c267505bc16354deb2ba89e2da9.exe
Token: SeCreatePagefilePrivilege	1388	b4c1c4905b766e0a744b6c6084a07bdfd6830c267505bc16354deb2ba89e2da9.exe
Token: SeBackupPrivilege	1388	b4c1c4905b766e0a744b6c6084a07bdfd6830c267505bc16354deb2ba89e2da9.exe
Token: SeRestorePrivilege	1388	b4c1c4905b766e0a744b6c6084a07bdfd6830c267505bc16354deb2ba89e2da9.exe
Token: SeShutdownPrivilege	1388	b4c1c4905b766e0a744b6c6084a07bdfd6830c267505bc16354deb2ba89e2da9.exe
Token: SeDebugPrivilege	1388	b4c1c4905b766e0a744b6c6084a07bdfd6830c267505bc16354deb2ba89e2da9.exe
Token: SeSystemEnvironmentPrivilege	1388	b4c1c4905b766e0a744b6c6084a07bdfd6830c267505bc16354deb2ba89e2da9.exe
Token: SeChangeNotifyPrivilege	1388	b4c1c4905b766e0a744b6c6084a07bdfd6830c267505bc16354deb2ba89e2da9.exe
Token: SeRemoteShutdownPrivilege	1388	b4c1c4905b766e0a744b6c6084a07bdfd6830c267505bc16354deb2ba89e2da9.exe
Token: SeUndockPrivilege	1388	b4c1c4905b766e0a744b6c6084a07bdfd6830c267505bc16354deb2ba89e2da9.exe
Token: SeManageVolumePrivilege	1388	b4c1c4905b766e0a744b6c6084a07bdfd6830c267505bc16354deb2ba89e2da9.exe
Token: SeImpersonatePrivilege	1388	b4c1c4905b766e0a744b6c6084a07bdfd6830c267505bc16354deb2ba89e2da9.exe
Token: SeCreateGlobalPrivilege	1388	b4c1c4905b766e0a744b6c6084a07bdfd6830c267505bc16354deb2ba89e2da9.exe
Token: 33	1388	b4c1c4905b766e0a744b6c6084a07bdfd6830c267505bc16354deb2ba89e2da9.exe
Token: 34	1388	b4c1c4905b766e0a744b6c6084a07bdfd6830c267505bc16354deb2ba89e2da9.exe
Token: 35	1388	b4c1c4905b766e0a744b6c6084a07bdfd6830c267505bc16354deb2ba89e2da9.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1388	b4c1c4905b766e0a744b6c6084a07bdfd6830c267505bc16354deb2ba89e2da9.exe

C:\Users\Admin\AppData\Local\Temp\b4c1c4905b766e0a744b6c6084a07bdfd6830c267505bc16354deb2ba89e2da9.exe
"C:\Users\Admin\AppData\Local\Temp\b4c1c4905b766e0a744b6c6084a07bdfd6830c267505bc16354deb2ba89e2da9.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1388

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1388-54-0x0000000000400000-0x00000000004B7000-memory.dmp

Filesize
732KB

Download
memory/1388-55-0x00000000763F1000-0x00000000763F3000-memory.dmp

Filesize
8KB

Download
memory/1388-56-0x0000000000400000-0x00000000004B7000-memory.dmp

Filesize
732KB

Download