darkcomet | 068c957905fbeaaa95e56a0d23a07800278f6b5c9d9b9cd18211d7fc656019f4

Analysis

max time kernel
184s
max time network
213s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
19/11/2022, 16:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
068c957905fbeaaa95e56a0d23a07800278f6b5c9d9b9cd18211d7fc656019f4.exe
Size 658KB
Sample221119-vg9zpsbf56
SHA256 068c957905fbeaaa95e56a0d23a07800278f6b5c9d9b9cd18211d7fc656019f4
MD5 5fa4ab9c65f0be128ff24fc7f9286a10
SHA1 f5756638d5eb2035960978313cf2e5cc95b43ae6
SHA512 259de84b42730f690c2349e29d8ae196a1abc14f13749389ef442cf7ad9519234748ffe7b0da0e347b492915b537e7d87148f418e5fa31cdd68d8023c553b583
SSDEEP 12288:C9HFJ9rJxRX1uVVjoaWSoynxdO1FVBaOiRZTERfIhNkNCCLo9Ek5C/hn:uZ1xuVVjfFoynPaVBUR8f+kN10EBN
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

darkcomet rat trojan

Malware Config

Signatures

Darkcomet
DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
trojan rat darkcomet
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 24 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	3616	068c957905fbeaaa95e56a0d23a07800278f6b5c9d9b9cd18211d7fc656019f4.exe
Token: SeSecurityPrivilege	3616	068c957905fbeaaa95e56a0d23a07800278f6b5c9d9b9cd18211d7fc656019f4.exe
Token: SeTakeOwnershipPrivilege	3616	068c957905fbeaaa95e56a0d23a07800278f6b5c9d9b9cd18211d7fc656019f4.exe
Token: SeLoadDriverPrivilege	3616	068c957905fbeaaa95e56a0d23a07800278f6b5c9d9b9cd18211d7fc656019f4.exe
Token: SeSystemProfilePrivilege	3616	068c957905fbeaaa95e56a0d23a07800278f6b5c9d9b9cd18211d7fc656019f4.exe
Token: SeSystemtimePrivilege	3616	068c957905fbeaaa95e56a0d23a07800278f6b5c9d9b9cd18211d7fc656019f4.exe
Token: SeProfSingleProcessPrivilege	3616	068c957905fbeaaa95e56a0d23a07800278f6b5c9d9b9cd18211d7fc656019f4.exe
Token: SeIncBasePriorityPrivilege	3616	068c957905fbeaaa95e56a0d23a07800278f6b5c9d9b9cd18211d7fc656019f4.exe
Token: SeCreatePagefilePrivilege	3616	068c957905fbeaaa95e56a0d23a07800278f6b5c9d9b9cd18211d7fc656019f4.exe
Token: SeBackupPrivilege	3616	068c957905fbeaaa95e56a0d23a07800278f6b5c9d9b9cd18211d7fc656019f4.exe
Token: SeRestorePrivilege	3616	068c957905fbeaaa95e56a0d23a07800278f6b5c9d9b9cd18211d7fc656019f4.exe
Token: SeShutdownPrivilege	3616	068c957905fbeaaa95e56a0d23a07800278f6b5c9d9b9cd18211d7fc656019f4.exe
Token: SeDebugPrivilege	3616	068c957905fbeaaa95e56a0d23a07800278f6b5c9d9b9cd18211d7fc656019f4.exe
Token: SeSystemEnvironmentPrivilege	3616	068c957905fbeaaa95e56a0d23a07800278f6b5c9d9b9cd18211d7fc656019f4.exe
Token: SeChangeNotifyPrivilege	3616	068c957905fbeaaa95e56a0d23a07800278f6b5c9d9b9cd18211d7fc656019f4.exe
Token: SeRemoteShutdownPrivilege	3616	068c957905fbeaaa95e56a0d23a07800278f6b5c9d9b9cd18211d7fc656019f4.exe
Token: SeUndockPrivilege	3616	068c957905fbeaaa95e56a0d23a07800278f6b5c9d9b9cd18211d7fc656019f4.exe
Token: SeManageVolumePrivilege	3616	068c957905fbeaaa95e56a0d23a07800278f6b5c9d9b9cd18211d7fc656019f4.exe
Token: SeImpersonatePrivilege	3616	068c957905fbeaaa95e56a0d23a07800278f6b5c9d9b9cd18211d7fc656019f4.exe
Token: SeCreateGlobalPrivilege	3616	068c957905fbeaaa95e56a0d23a07800278f6b5c9d9b9cd18211d7fc656019f4.exe
Token: 33	3616	068c957905fbeaaa95e56a0d23a07800278f6b5c9d9b9cd18211d7fc656019f4.exe
Token: 34	3616	068c957905fbeaaa95e56a0d23a07800278f6b5c9d9b9cd18211d7fc656019f4.exe
Token: 35	3616	068c957905fbeaaa95e56a0d23a07800278f6b5c9d9b9cd18211d7fc656019f4.exe
Token: 36	3616	068c957905fbeaaa95e56a0d23a07800278f6b5c9d9b9cd18211d7fc656019f4.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3616	068c957905fbeaaa95e56a0d23a07800278f6b5c9d9b9cd18211d7fc656019f4.exe

C:\Users\Admin\AppData\Local\Temp\068c957905fbeaaa95e56a0d23a07800278f6b5c9d9b9cd18211d7fc656019f4.exe
"C:\Users\Admin\AppData\Local\Temp\068c957905fbeaaa95e56a0d23a07800278f6b5c9d9b9cd18211d7fc656019f4.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:3616

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads