darkcomet | f6928e02cc9f8b34e5efbebbfc57054db69b2ee0165232a3ac73859830df2ad7

General

Target

f6928e02cc9f8b34e5efbebbfc57054db69b2ee0165232a3ac73859830df2ad7.exe
Size

784KB
MD5

5fe789210676793169d01496375b6e12
SHA1

a40a69808a5cbc51ed5cd3220b0cb82980da8bfd
SHA256

f6928e02cc9f8b34e5efbebbfc57054db69b2ee0165232a3ac73859830df2ad7
SHA512

6a48f6a6ab4d5945fbb5e8f10008d4f39155e2c24632b9716cba216eae774943e2a98b40c479e6a4fee3f32eb2e580490ebc2ce05d01247764733eee2f7edeab
SSDEEP

24576:IS5Z6DO6kBqzZ0i1l82DN1T2fVURfOv6hJ:FizZfl8+N1TfOM

Score

10^/10

darkcomet rat trojan

Malware Config

Signatures

Darkcomet
DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
trojan rat darkcomet

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1224 set thread context of 1512	1224	f6928e02cc9f8b34e5efbebbfc57054db69b2ee0165232a3ac73859830df2ad7.exe	21

Suspicious use of AdjustPrivilegeToken 23 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	1512	f6928e02cc9f8b34e5efbebbfc57054db69b2ee0165232a3ac73859830df2ad7.exe
Token: SeSecurityPrivilege	1512	f6928e02cc9f8b34e5efbebbfc57054db69b2ee0165232a3ac73859830df2ad7.exe
Token: SeTakeOwnershipPrivilege	1512	f6928e02cc9f8b34e5efbebbfc57054db69b2ee0165232a3ac73859830df2ad7.exe
Token: SeLoadDriverPrivilege	1512	f6928e02cc9f8b34e5efbebbfc57054db69b2ee0165232a3ac73859830df2ad7.exe
Token: SeSystemProfilePrivilege	1512	f6928e02cc9f8b34e5efbebbfc57054db69b2ee0165232a3ac73859830df2ad7.exe
Token: SeSystemtimePrivilege	1512	f6928e02cc9f8b34e5efbebbfc57054db69b2ee0165232a3ac73859830df2ad7.exe
Token: SeProfSingleProcessPrivilege	1512	f6928e02cc9f8b34e5efbebbfc57054db69b2ee0165232a3ac73859830df2ad7.exe
Token: SeIncBasePriorityPrivilege	1512	f6928e02cc9f8b34e5efbebbfc57054db69b2ee0165232a3ac73859830df2ad7.exe
Token: SeCreatePagefilePrivilege	1512	f6928e02cc9f8b34e5efbebbfc57054db69b2ee0165232a3ac73859830df2ad7.exe
Token: SeBackupPrivilege	1512	f6928e02cc9f8b34e5efbebbfc57054db69b2ee0165232a3ac73859830df2ad7.exe
Token: SeRestorePrivilege	1512	f6928e02cc9f8b34e5efbebbfc57054db69b2ee0165232a3ac73859830df2ad7.exe
Token: SeShutdownPrivilege	1512	f6928e02cc9f8b34e5efbebbfc57054db69b2ee0165232a3ac73859830df2ad7.exe
Token: SeDebugPrivilege	1512	f6928e02cc9f8b34e5efbebbfc57054db69b2ee0165232a3ac73859830df2ad7.exe
Token: SeSystemEnvironmentPrivilege	1512	f6928e02cc9f8b34e5efbebbfc57054db69b2ee0165232a3ac73859830df2ad7.exe
Token: SeChangeNotifyPrivilege	1512	f6928e02cc9f8b34e5efbebbfc57054db69b2ee0165232a3ac73859830df2ad7.exe
Token: SeRemoteShutdownPrivilege	1512	f6928e02cc9f8b34e5efbebbfc57054db69b2ee0165232a3ac73859830df2ad7.exe
Token: SeUndockPrivilege	1512	f6928e02cc9f8b34e5efbebbfc57054db69b2ee0165232a3ac73859830df2ad7.exe
Token: SeManageVolumePrivilege	1512	f6928e02cc9f8b34e5efbebbfc57054db69b2ee0165232a3ac73859830df2ad7.exe
Token: SeImpersonatePrivilege	1512	f6928e02cc9f8b34e5efbebbfc57054db69b2ee0165232a3ac73859830df2ad7.exe
Token: SeCreateGlobalPrivilege	1512	f6928e02cc9f8b34e5efbebbfc57054db69b2ee0165232a3ac73859830df2ad7.exe
Token: 33	1512	f6928e02cc9f8b34e5efbebbfc57054db69b2ee0165232a3ac73859830df2ad7.exe
Token: 34	1512	f6928e02cc9f8b34e5efbebbfc57054db69b2ee0165232a3ac73859830df2ad7.exe
Token: 35	1512	f6928e02cc9f8b34e5efbebbfc57054db69b2ee0165232a3ac73859830df2ad7.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1224	f6928e02cc9f8b34e5efbebbfc57054db69b2ee0165232a3ac73859830df2ad7.exe

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 1224 wrote to memory of 1512	1224	f6928e02cc9f8b34e5efbebbfc57054db69b2ee0165232a3ac73859830df2ad7.exe	21
PID 1224 wrote to memory of 1512	1224	f6928e02cc9f8b34e5efbebbfc57054db69b2ee0165232a3ac73859830df2ad7.exe	21
PID 1224 wrote to memory of 1512	1224	f6928e02cc9f8b34e5efbebbfc57054db69b2ee0165232a3ac73859830df2ad7.exe	21
PID 1224 wrote to memory of 1512	1224	f6928e02cc9f8b34e5efbebbfc57054db69b2ee0165232a3ac73859830df2ad7.exe	21
PID 1224 wrote to memory of 1512	1224	f6928e02cc9f8b34e5efbebbfc57054db69b2ee0165232a3ac73859830df2ad7.exe	21
PID 1224 wrote to memory of 1512	1224	f6928e02cc9f8b34e5efbebbfc57054db69b2ee0165232a3ac73859830df2ad7.exe	21
PID 1224 wrote to memory of 1512	1224	f6928e02cc9f8b34e5efbebbfc57054db69b2ee0165232a3ac73859830df2ad7.exe	21
PID 1224 wrote to memory of 1512	1224	f6928e02cc9f8b34e5efbebbfc57054db69b2ee0165232a3ac73859830df2ad7.exe	21
PID 1224 wrote to memory of 1512	1224	f6928e02cc9f8b34e5efbebbfc57054db69b2ee0165232a3ac73859830df2ad7.exe	21
PID 1224 wrote to memory of 1512	1224	f6928e02cc9f8b34e5efbebbfc57054db69b2ee0165232a3ac73859830df2ad7.exe	21
PID 1224 wrote to memory of 1512	1224	f6928e02cc9f8b34e5efbebbfc57054db69b2ee0165232a3ac73859830df2ad7.exe	21
PID 1224 wrote to memory of 1512	1224	f6928e02cc9f8b34e5efbebbfc57054db69b2ee0165232a3ac73859830df2ad7.exe	21
PID 1224 wrote to memory of 1512	1224	f6928e02cc9f8b34e5efbebbfc57054db69b2ee0165232a3ac73859830df2ad7.exe	21
PID 1224 wrote to memory of 1512	1224	f6928e02cc9f8b34e5efbebbfc57054db69b2ee0165232a3ac73859830df2ad7.exe	21
PID 1224 wrote to memory of 1512	1224	f6928e02cc9f8b34e5efbebbfc57054db69b2ee0165232a3ac73859830df2ad7.exe	21

C:\Users\Admin\AppData\Local\Temp\f6928e02cc9f8b34e5efbebbfc57054db69b2ee0165232a3ac73859830df2ad7.exe
"C:\Users\Admin\AppData\Local\Temp\f6928e02cc9f8b34e5efbebbfc57054db69b2ee0165232a3ac73859830df2ad7.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1224
- C:\Users\Admin\AppData\Local\Temp\f6928e02cc9f8b34e5efbebbfc57054db69b2ee0165232a3ac73859830df2ad7.exe
  "C:\Users\Admin\AppData\Local\Temp\f6928e02cc9f8b34e5efbebbfc57054db69b2ee0165232a3ac73859830df2ad7.exe"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1512

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1224-62-0x000000000062F000-0x0000000000645000-memory.dmp

Filesize
88KB

Download
memory/1224-65-0x000000000062F000-0x0000000000645000-memory.dmp

Filesize
88KB

Download
memory/1224-56-0x000000000062F000-0x0000000000645000-memory.dmp

Filesize
88KB

Download
memory/1224-58-0x000000000062F000-0x0000000000645000-memory.dmp

Filesize
88KB

Download
memory/1224-60-0x000000000062F000-0x0000000000645000-memory.dmp

Filesize
88KB

Download
memory/1224-71-0x000000000062F000-0x0000000000645000-memory.dmp

Filesize
88KB

Download
memory/1224-73-0x000000000062F000-0x0000000000645000-memory.dmp

Filesize
88KB

Download
memory/1224-72-0x000000000062F000-0x0000000000645000-memory.dmp

Filesize
88KB

Download
memory/1224-69-0x000000000062F000-0x0000000000645000-memory.dmp

Filesize
88KB

Download
memory/1224-64-0x000000000062F000-0x0000000000645000-memory.dmp

Filesize
88KB

Download
memory/1224-63-0x000000000062F000-0x0000000000645000-memory.dmp

Filesize
88KB

Download
memory/1224-66-0x000000000062F000-0x0000000000645000-memory.dmp

Filesize
88KB

Download
memory/1224-67-0x000000000062F000-0x0000000000645000-memory.dmp

Filesize
88KB

Download
memory/1512-78-0x0000000000400000-0x00000000004B5000-memory.dmp

Filesize
724KB

Download
memory/1512-79-0x0000000000400000-0x00000000004B5000-memory.dmp

Filesize
724KB

Download
memory/1512-74-0x0000000000400000-0x00000000004B5000-memory.dmp

Filesize
724KB

Download
memory/1512-76-0x0000000000400000-0x00000000004B5000-memory.dmp

Filesize
724KB

Download
memory/1512-77-0x0000000076041000-0x0000000076043000-memory.dmp

Filesize
8KB

Download
memory/1512-80-0x0000000000400000-0x00000000004B5000-memory.dmp

Filesize
724KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads