Analysis
-
max time kernel
151s -
max time network
46s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
-
submitted
30/10/2022, 14:47
General
-
Target
90caf1e644dcda910cf8529c680314e7c404be7795be5305d7b75dcde8f349ab.exe
-
Size
251KB
-
MD5
9308ddb9399529c86d05d57e85b63a60
-
SHA1
0256097d531bbc4dbfdb506ad12b3a93012be4cd
-
SHA256
90caf1e644dcda910cf8529c680314e7c404be7795be5305d7b75dcde8f349ab
-
SHA512
fc1c0a11279111e326928a0f3707e0f3020e288058f5ec94a0f6cb8eae211a1aefc18d880551ab685a182a27bd38db9e4a2f54316cd3c65e77b9793b52195ca4
-
SSDEEP
6144:PcNYS996KFifeVjBpeExgVTFSXFl3w69AsQWVd2:PcW7KEZClg8d2
Malware Config
Extracted
darkcomet
Guest16
spicial-k.no-ip.biz:1604
DC_MUTEX-JZYTLX4
-
gencode
80e64A8z1ux7
-
install
false
-
offline_keylogger
true
-
persistence
false
Signatures
-
Darkcomet
DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
-
UPX packed file 2 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of AdjustPrivilegeToken 23 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\90caf1e644dcda910cf8529c680314e7c404be7795be5305d7b75dcde8f349ab.exe"C:\Users\Admin\AppData\Local\Temp\90caf1e644dcda910cf8529c680314e7c404be7795be5305d7b75dcde8f349ab.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
8KB
-
Filesize
732KB
-
Filesize
732KB