darkcomet | e2bbb1d7e8a22d19a3c099a67e37de4b1105749635fa57de563f879d97026d57

Analysis

max time kernel
160s
max time network
17s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
21-10-2022 02:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e2bbb1d7e8a22d19a3c099a67e37de4b1105749635fa57de563f879d97026d57.exe
Size

658KB
MD5

5141276ef65d163581db762d778d03ec
SHA1

2b6c62793d4e13e9bc4eb22eddd39021704cece5
SHA256

e2bbb1d7e8a22d19a3c099a67e37de4b1105749635fa57de563f879d97026d57
SHA512

5baccfcc0451c25a196e827f99285ccc8641a98d21fd616dbc88a850c78b6072658b7bc21b14b56837d3861857c9dacf99e1bf0f5e31d70569e832c7107fdf3c
SSDEEP

12288:B9AFlAd0Z+89cxTGzO4AucTD8QP2lmFSrVs9LqnK5:3AQ6Zx9cxTmOrucTIEFSpOGY

Score

10^/10

darkcomet rat trojan

Malware Config

Signatures

Darkcomet
DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
trojan rat darkcomet

Checks BIOS information in registry 2 TTPs 1 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate	e2bbb1d7e8a22d19a3c099a67e37de4b1105749635fa57de563f879d97026d57.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	e2bbb1d7e8a22d19a3c099a67e37de4b1105749635fa57de563f879d97026d57.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	e2bbb1d7e8a22d19a3c099a67e37de4b1105749635fa57de563f879d97026d57.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	e2bbb1d7e8a22d19a3c099a67e37de4b1105749635fa57de563f879d97026d57.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	e2bbb1d7e8a22d19a3c099a67e37de4b1105749635fa57de563f879d97026d57.exe

Enumerates system info in registry 2 TTPs 1 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	e2bbb1d7e8a22d19a3c099a67e37de4b1105749635fa57de563f879d97026d57.exe

Suspicious use of AdjustPrivilegeToken 24 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	3924	e2bbb1d7e8a22d19a3c099a67e37de4b1105749635fa57de563f879d97026d57.exe
Token: SeSecurityPrivilege	3924	e2bbb1d7e8a22d19a3c099a67e37de4b1105749635fa57de563f879d97026d57.exe
Token: SeTakeOwnershipPrivilege	3924	e2bbb1d7e8a22d19a3c099a67e37de4b1105749635fa57de563f879d97026d57.exe
Token: SeLoadDriverPrivilege	3924	e2bbb1d7e8a22d19a3c099a67e37de4b1105749635fa57de563f879d97026d57.exe
Token: SeSystemProfilePrivilege	3924	e2bbb1d7e8a22d19a3c099a67e37de4b1105749635fa57de563f879d97026d57.exe
Token: SeSystemtimePrivilege	3924	e2bbb1d7e8a22d19a3c099a67e37de4b1105749635fa57de563f879d97026d57.exe
Token: SeProfSingleProcessPrivilege	3924	e2bbb1d7e8a22d19a3c099a67e37de4b1105749635fa57de563f879d97026d57.exe
Token: SeIncBasePriorityPrivilege	3924	e2bbb1d7e8a22d19a3c099a67e37de4b1105749635fa57de563f879d97026d57.exe
Token: SeCreatePagefilePrivilege	3924	e2bbb1d7e8a22d19a3c099a67e37de4b1105749635fa57de563f879d97026d57.exe
Token: SeBackupPrivilege	3924	e2bbb1d7e8a22d19a3c099a67e37de4b1105749635fa57de563f879d97026d57.exe
Token: SeRestorePrivilege	3924	e2bbb1d7e8a22d19a3c099a67e37de4b1105749635fa57de563f879d97026d57.exe
Token: SeShutdownPrivilege	3924	e2bbb1d7e8a22d19a3c099a67e37de4b1105749635fa57de563f879d97026d57.exe
Token: SeDebugPrivilege	3924	e2bbb1d7e8a22d19a3c099a67e37de4b1105749635fa57de563f879d97026d57.exe
Token: SeSystemEnvironmentPrivilege	3924	e2bbb1d7e8a22d19a3c099a67e37de4b1105749635fa57de563f879d97026d57.exe
Token: SeChangeNotifyPrivilege	3924	e2bbb1d7e8a22d19a3c099a67e37de4b1105749635fa57de563f879d97026d57.exe
Token: SeRemoteShutdownPrivilege	3924	e2bbb1d7e8a22d19a3c099a67e37de4b1105749635fa57de563f879d97026d57.exe
Token: SeUndockPrivilege	3924	e2bbb1d7e8a22d19a3c099a67e37de4b1105749635fa57de563f879d97026d57.exe
Token: SeManageVolumePrivilege	3924	e2bbb1d7e8a22d19a3c099a67e37de4b1105749635fa57de563f879d97026d57.exe
Token: SeImpersonatePrivilege	3924	e2bbb1d7e8a22d19a3c099a67e37de4b1105749635fa57de563f879d97026d57.exe
Token: SeCreateGlobalPrivilege	3924	e2bbb1d7e8a22d19a3c099a67e37de4b1105749635fa57de563f879d97026d57.exe
Token: 33	3924	e2bbb1d7e8a22d19a3c099a67e37de4b1105749635fa57de563f879d97026d57.exe
Token: 34	3924	e2bbb1d7e8a22d19a3c099a67e37de4b1105749635fa57de563f879d97026d57.exe
Token: 35	3924	e2bbb1d7e8a22d19a3c099a67e37de4b1105749635fa57de563f879d97026d57.exe
Token: 36	3924	e2bbb1d7e8a22d19a3c099a67e37de4b1105749635fa57de563f879d97026d57.exe

C:\Users\Admin\AppData\Local\Temp\e2bbb1d7e8a22d19a3c099a67e37de4b1105749635fa57de563f879d97026d57.exe
"C:\Users\Admin\AppData\Local\Temp\e2bbb1d7e8a22d19a3c099a67e37de4b1105749635fa57de563f879d97026d57.exe"
1⤵
- Checks BIOS information in registry
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious use of AdjustPrivilegeToken
PID:3924

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads