darkcomet | d2799d83e4d3c952e7f37caf3c2a0df1039a96ae600d53e7323e224745667903

Analysis

max time kernel
151s
max time network
32s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
22-11-2022 20:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d2799d83e4d3c952e7f37caf3c2a0df1039a96ae600d53e7323e224745667903.exe
Size

658KB
MD5

ccc7fa962a403ca8c7cf0c713afd8bc6
SHA1

e5146146d74d630713414e92d025be1a8da70d5c
SHA256

d2799d83e4d3c952e7f37caf3c2a0df1039a96ae600d53e7323e224745667903
SHA512

d93a76914c750b6d2a77de9fe583e3a64d54aa8cf27d4c61dbd0e0b6682e49ec56aafef4ac34188bb7194af66020aa972a56adb98f36ba531fb090e9064e84e8
SSDEEP

12288:q9HFJ9rJxRX1uVVjoaWSoynxdO1FVBaOiRZTERfIhNkNCCLo9Ek5C/hT:mZ1xuVVjfFoynPaVBUR8f+kN10EB1

Score

10^/10

darkcomet rat trojan

Malware Config

Signatures

Darkcomet
DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
trojan rat darkcomet
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 23 IoCs

Processes:

d2799d83e4d3c952e7f37caf3c2a0df1039a96ae600d53e7323e224745667903.exe

description	pid	process
Token: SeIncreaseQuotaPrivilege	1792	d2799d83e4d3c952e7f37caf3c2a0df1039a96ae600d53e7323e224745667903.exe
Token: SeSecurityPrivilege	1792	d2799d83e4d3c952e7f37caf3c2a0df1039a96ae600d53e7323e224745667903.exe
Token: SeTakeOwnershipPrivilege	1792	d2799d83e4d3c952e7f37caf3c2a0df1039a96ae600d53e7323e224745667903.exe
Token: SeLoadDriverPrivilege	1792	d2799d83e4d3c952e7f37caf3c2a0df1039a96ae600d53e7323e224745667903.exe
Token: SeSystemProfilePrivilege	1792	d2799d83e4d3c952e7f37caf3c2a0df1039a96ae600d53e7323e224745667903.exe
Token: SeSystemtimePrivilege	1792	d2799d83e4d3c952e7f37caf3c2a0df1039a96ae600d53e7323e224745667903.exe
Token: SeProfSingleProcessPrivilege	1792	d2799d83e4d3c952e7f37caf3c2a0df1039a96ae600d53e7323e224745667903.exe
Token: SeIncBasePriorityPrivilege	1792	d2799d83e4d3c952e7f37caf3c2a0df1039a96ae600d53e7323e224745667903.exe
Token: SeCreatePagefilePrivilege	1792	d2799d83e4d3c952e7f37caf3c2a0df1039a96ae600d53e7323e224745667903.exe
Token: SeBackupPrivilege	1792	d2799d83e4d3c952e7f37caf3c2a0df1039a96ae600d53e7323e224745667903.exe
Token: SeRestorePrivilege	1792	d2799d83e4d3c952e7f37caf3c2a0df1039a96ae600d53e7323e224745667903.exe
Token: SeShutdownPrivilege	1792	d2799d83e4d3c952e7f37caf3c2a0df1039a96ae600d53e7323e224745667903.exe
Token: SeDebugPrivilege	1792	d2799d83e4d3c952e7f37caf3c2a0df1039a96ae600d53e7323e224745667903.exe
Token: SeSystemEnvironmentPrivilege	1792	d2799d83e4d3c952e7f37caf3c2a0df1039a96ae600d53e7323e224745667903.exe
Token: SeChangeNotifyPrivilege	1792	d2799d83e4d3c952e7f37caf3c2a0df1039a96ae600d53e7323e224745667903.exe
Token: SeRemoteShutdownPrivilege	1792	d2799d83e4d3c952e7f37caf3c2a0df1039a96ae600d53e7323e224745667903.exe
Token: SeUndockPrivilege	1792	d2799d83e4d3c952e7f37caf3c2a0df1039a96ae600d53e7323e224745667903.exe
Token: SeManageVolumePrivilege	1792	d2799d83e4d3c952e7f37caf3c2a0df1039a96ae600d53e7323e224745667903.exe
Token: SeImpersonatePrivilege	1792	d2799d83e4d3c952e7f37caf3c2a0df1039a96ae600d53e7323e224745667903.exe
Token: SeCreateGlobalPrivilege	1792	d2799d83e4d3c952e7f37caf3c2a0df1039a96ae600d53e7323e224745667903.exe
Token: 33	1792	d2799d83e4d3c952e7f37caf3c2a0df1039a96ae600d53e7323e224745667903.exe
Token: 34	1792	d2799d83e4d3c952e7f37caf3c2a0df1039a96ae600d53e7323e224745667903.exe
Token: 35	1792	d2799d83e4d3c952e7f37caf3c2a0df1039a96ae600d53e7323e224745667903.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

d2799d83e4d3c952e7f37caf3c2a0df1039a96ae600d53e7323e224745667903.exe

pid process

1792 d2799d83e4d3c952e7f37caf3c2a0df1039a96ae600d53e7323e224745667903.exe

pid	process
1792	d2799d83e4d3c952e7f37caf3c2a0df1039a96ae600d53e7323e224745667903.exe

C:\Users\Admin\AppData\Local\Temp\d2799d83e4d3c952e7f37caf3c2a0df1039a96ae600d53e7323e224745667903.exe
"C:\Users\Admin\AppData\Local\Temp\d2799d83e4d3c952e7f37caf3c2a0df1039a96ae600d53e7323e224745667903.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1792

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1792-54-0x0000000076391000-0x0000000076393000-memory.dmp

Filesize
8KB

Download