darkcomet | 3b6e542a73af91343ba9985b469ee6d59300b7697a626936efc8467bc659cf7d

Analysis

max time kernel
150s
max time network
49s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
23-11-2022 15:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3b6e542a73af91343ba9985b469ee6d59300b7697a626936efc8467bc659cf7d.exe
Size

251KB
MD5

a014bc7ebf136ade8fa1ac17eec66fda
SHA1

2016702485e11d3ac413511d606938a6b0d3e5fc
SHA256

3b6e542a73af91343ba9985b469ee6d59300b7697a626936efc8467bc659cf7d
SHA512

8415d12d1735a14c17c854ec88a6f72acf30c314c0dee8e29be5f7d119d7a5f80ea579c036c1a393fa841670b72beae05dbb850312c92ab1d9c5c35aa63a586e
SSDEEP

6144:icNYS996KFifeVjBpeExgVTFSXFoMc5RhCaL37:icW7KEZlPzCy37

Score

10^/10

darkcomet guest16 rat trojan upx

Malware Config

Extracted

Family

darkcomet

Botnet

Guest16

127.0.0.1:1604

Mutex

DC_MUTEX-UJMWXY6

Attributes

gencode
NhRfrdifhrWy
install
false
offline_keylogger
true
persistence
false

Signatures

Darkcomet
DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
trojan rat darkcomet

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral1/memory/1760-55-0x0000000000400000-0x00000000004B7000-memory.dmp	upx
behavioral1/memory/1760-56-0x0000000000400000-0x00000000004B7000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 23 IoCs

Processes:

3b6e542a73af91343ba9985b469ee6d59300b7697a626936efc8467bc659cf7d.exe

description	pid	process
Token: SeIncreaseQuotaPrivilege	1760	3b6e542a73af91343ba9985b469ee6d59300b7697a626936efc8467bc659cf7d.exe
Token: SeSecurityPrivilege	1760	3b6e542a73af91343ba9985b469ee6d59300b7697a626936efc8467bc659cf7d.exe
Token: SeTakeOwnershipPrivilege	1760	3b6e542a73af91343ba9985b469ee6d59300b7697a626936efc8467bc659cf7d.exe
Token: SeLoadDriverPrivilege	1760	3b6e542a73af91343ba9985b469ee6d59300b7697a626936efc8467bc659cf7d.exe
Token: SeSystemProfilePrivilege	1760	3b6e542a73af91343ba9985b469ee6d59300b7697a626936efc8467bc659cf7d.exe
Token: SeSystemtimePrivilege	1760	3b6e542a73af91343ba9985b469ee6d59300b7697a626936efc8467bc659cf7d.exe
Token: SeProfSingleProcessPrivilege	1760	3b6e542a73af91343ba9985b469ee6d59300b7697a626936efc8467bc659cf7d.exe
Token: SeIncBasePriorityPrivilege	1760	3b6e542a73af91343ba9985b469ee6d59300b7697a626936efc8467bc659cf7d.exe
Token: SeCreatePagefilePrivilege	1760	3b6e542a73af91343ba9985b469ee6d59300b7697a626936efc8467bc659cf7d.exe
Token: SeBackupPrivilege	1760	3b6e542a73af91343ba9985b469ee6d59300b7697a626936efc8467bc659cf7d.exe
Token: SeRestorePrivilege	1760	3b6e542a73af91343ba9985b469ee6d59300b7697a626936efc8467bc659cf7d.exe
Token: SeShutdownPrivilege	1760	3b6e542a73af91343ba9985b469ee6d59300b7697a626936efc8467bc659cf7d.exe
Token: SeDebugPrivilege	1760	3b6e542a73af91343ba9985b469ee6d59300b7697a626936efc8467bc659cf7d.exe
Token: SeSystemEnvironmentPrivilege	1760	3b6e542a73af91343ba9985b469ee6d59300b7697a626936efc8467bc659cf7d.exe
Token: SeChangeNotifyPrivilege	1760	3b6e542a73af91343ba9985b469ee6d59300b7697a626936efc8467bc659cf7d.exe
Token: SeRemoteShutdownPrivilege	1760	3b6e542a73af91343ba9985b469ee6d59300b7697a626936efc8467bc659cf7d.exe
Token: SeUndockPrivilege	1760	3b6e542a73af91343ba9985b469ee6d59300b7697a626936efc8467bc659cf7d.exe
Token: SeManageVolumePrivilege	1760	3b6e542a73af91343ba9985b469ee6d59300b7697a626936efc8467bc659cf7d.exe
Token: SeImpersonatePrivilege	1760	3b6e542a73af91343ba9985b469ee6d59300b7697a626936efc8467bc659cf7d.exe
Token: SeCreateGlobalPrivilege	1760	3b6e542a73af91343ba9985b469ee6d59300b7697a626936efc8467bc659cf7d.exe
Token: 33	1760	3b6e542a73af91343ba9985b469ee6d59300b7697a626936efc8467bc659cf7d.exe
Token: 34	1760	3b6e542a73af91343ba9985b469ee6d59300b7697a626936efc8467bc659cf7d.exe
Token: 35	1760	3b6e542a73af91343ba9985b469ee6d59300b7697a626936efc8467bc659cf7d.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

3b6e542a73af91343ba9985b469ee6d59300b7697a626936efc8467bc659cf7d.exe

pid process

1760 3b6e542a73af91343ba9985b469ee6d59300b7697a626936efc8467bc659cf7d.exe

pid	process
1760	3b6e542a73af91343ba9985b469ee6d59300b7697a626936efc8467bc659cf7d.exe

C:\Users\Admin\AppData\Local\Temp\3b6e542a73af91343ba9985b469ee6d59300b7697a626936efc8467bc659cf7d.exe
"C:\Users\Admin\AppData\Local\Temp\3b6e542a73af91343ba9985b469ee6d59300b7697a626936efc8467bc659cf7d.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1760

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1760-54-0x0000000075281000-0x0000000075283000-memory.dmp

Filesize
8KB

Download
memory/1760-55-0x0000000000400000-0x00000000004B7000-memory.dmp

Filesize
732KB

Download
memory/1760-56-0x0000000000400000-0x00000000004B7000-memory.dmp

Filesize
732KB

Download