darkcomet | 8c3aeb06e7e6fed2ec366d63adc60e83950c96f14d5b5963ca7d72f10c6a3dda

Analysis

max time kernel
152s
max time network
50s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
29/10/2022, 23:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8c3aeb06e7e6fed2ec366d63adc60e83950c96f14d5b5963ca7d72f10c6a3dda.exe
Size

345KB
MD5

a362500fd73a71b0b42bd023192dd88b
SHA1

877236f7b833825c92adc9d26a8ac0dac8d5c682
SHA256

8c3aeb06e7e6fed2ec366d63adc60e83950c96f14d5b5963ca7d72f10c6a3dda
SHA512

093458a04e24a727ffd34ff120a98631308d1d7357d46347481feae24d9f24d65b27f99100539e31a43d94fb1969539b7351aacc79f1d2daf03d6ab0a3079966
SSDEEP

6144:wFRaI2EqBP/WsZL1PgLl4w0AidVym0EnarUBYVsKhiI2pTplSZkOiu9PZ/p:4R72EqluswR45JTnaEY2DpsNVR

Score

10^/10

darkcomet rat trojan upx

Malware Config

Signatures

Darkcomet
DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
trojan rat darkcomet

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1756-55-0x0000000000400000-0x00000000004E5000-memory.dmp	upx
behavioral1/memory/1756-56-0x0000000000400000-0x00000000004E5000-memory.dmp	upx

Suspicious use of AdjustPrivilegeToken 23 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	1756	8c3aeb06e7e6fed2ec366d63adc60e83950c96f14d5b5963ca7d72f10c6a3dda.exe
Token: SeSecurityPrivilege	1756	8c3aeb06e7e6fed2ec366d63adc60e83950c96f14d5b5963ca7d72f10c6a3dda.exe
Token: SeTakeOwnershipPrivilege	1756	8c3aeb06e7e6fed2ec366d63adc60e83950c96f14d5b5963ca7d72f10c6a3dda.exe
Token: SeLoadDriverPrivilege	1756	8c3aeb06e7e6fed2ec366d63adc60e83950c96f14d5b5963ca7d72f10c6a3dda.exe
Token: SeSystemProfilePrivilege	1756	8c3aeb06e7e6fed2ec366d63adc60e83950c96f14d5b5963ca7d72f10c6a3dda.exe
Token: SeSystemtimePrivilege	1756	8c3aeb06e7e6fed2ec366d63adc60e83950c96f14d5b5963ca7d72f10c6a3dda.exe
Token: SeProfSingleProcessPrivilege	1756	8c3aeb06e7e6fed2ec366d63adc60e83950c96f14d5b5963ca7d72f10c6a3dda.exe
Token: SeIncBasePriorityPrivilege	1756	8c3aeb06e7e6fed2ec366d63adc60e83950c96f14d5b5963ca7d72f10c6a3dda.exe
Token: SeCreatePagefilePrivilege	1756	8c3aeb06e7e6fed2ec366d63adc60e83950c96f14d5b5963ca7d72f10c6a3dda.exe
Token: SeBackupPrivilege	1756	8c3aeb06e7e6fed2ec366d63adc60e83950c96f14d5b5963ca7d72f10c6a3dda.exe
Token: SeRestorePrivilege	1756	8c3aeb06e7e6fed2ec366d63adc60e83950c96f14d5b5963ca7d72f10c6a3dda.exe
Token: SeShutdownPrivilege	1756	8c3aeb06e7e6fed2ec366d63adc60e83950c96f14d5b5963ca7d72f10c6a3dda.exe
Token: SeDebugPrivilege	1756	8c3aeb06e7e6fed2ec366d63adc60e83950c96f14d5b5963ca7d72f10c6a3dda.exe
Token: SeSystemEnvironmentPrivilege	1756	8c3aeb06e7e6fed2ec366d63adc60e83950c96f14d5b5963ca7d72f10c6a3dda.exe
Token: SeChangeNotifyPrivilege	1756	8c3aeb06e7e6fed2ec366d63adc60e83950c96f14d5b5963ca7d72f10c6a3dda.exe
Token: SeRemoteShutdownPrivilege	1756	8c3aeb06e7e6fed2ec366d63adc60e83950c96f14d5b5963ca7d72f10c6a3dda.exe
Token: SeUndockPrivilege	1756	8c3aeb06e7e6fed2ec366d63adc60e83950c96f14d5b5963ca7d72f10c6a3dda.exe
Token: SeManageVolumePrivilege	1756	8c3aeb06e7e6fed2ec366d63adc60e83950c96f14d5b5963ca7d72f10c6a3dda.exe
Token: SeImpersonatePrivilege	1756	8c3aeb06e7e6fed2ec366d63adc60e83950c96f14d5b5963ca7d72f10c6a3dda.exe
Token: SeCreateGlobalPrivilege	1756	8c3aeb06e7e6fed2ec366d63adc60e83950c96f14d5b5963ca7d72f10c6a3dda.exe
Token: 33	1756	8c3aeb06e7e6fed2ec366d63adc60e83950c96f14d5b5963ca7d72f10c6a3dda.exe
Token: 34	1756	8c3aeb06e7e6fed2ec366d63adc60e83950c96f14d5b5963ca7d72f10c6a3dda.exe
Token: 35	1756	8c3aeb06e7e6fed2ec366d63adc60e83950c96f14d5b5963ca7d72f10c6a3dda.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1756	8c3aeb06e7e6fed2ec366d63adc60e83950c96f14d5b5963ca7d72f10c6a3dda.exe

C:\Users\Admin\AppData\Local\Temp\8c3aeb06e7e6fed2ec366d63adc60e83950c96f14d5b5963ca7d72f10c6a3dda.exe
"C:\Users\Admin\AppData\Local\Temp\8c3aeb06e7e6fed2ec366d63adc60e83950c96f14d5b5963ca7d72f10c6a3dda.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1756

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1756-54-0x00000000756B1000-0x00000000756B3000-memory.dmp

Filesize
8KB

Download
memory/1756-55-0x0000000000400000-0x00000000004E5000-memory.dmp

Filesize
916KB

Download
memory/1756-56-0x0000000000400000-0x00000000004E5000-memory.dmp

Filesize
916KB

Download