darkcomet | 1f1d35c7afb5178b9e98b71c433108743ba6d9d7f9aecf647c4b9130ea084ab8

General

Target

1f1d35c7afb5178b9e98b71c433108743ba6d9d7f9aecf647c4b9130ea084ab8.exe
Size

1.5MB
MD5

255d824058f18f2d9dac2dda2214e08a
SHA1

95ebcbae50218bc8ca8d472a5b1b7f23d7a0c061
SHA256

1f1d35c7afb5178b9e98b71c433108743ba6d9d7f9aecf647c4b9130ea084ab8
SHA512

65451253c32711991f742a045c4158d3219ed473a1b9120eeae888f6caa59ad108fe2133a3e95f8b98d224d119c905bed26073f29a10cf125bb73677de23a0d5
SSDEEP

24576:mZ1xuVVjfFoynPaVBUR8f+kN10EBiKzn1AAHEvtcwOwnvzuEG9WlE:2QDgok309qA3c5VFkW

Score

10^/10

darkcomet rat trojan

Malware Config

Signatures

Darkcomet
DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
trojan rat darkcomet

Suspicious use of SetThreadContext 1 IoCs

Processes:

1f1d35c7afb5178b9e98b71c433108743ba6d9d7f9aecf647c4b9130ea084ab8.exe

description	pid	process	target process
PID 1000 set thread context of 2008	1000	1f1d35c7afb5178b9e98b71c433108743ba6d9d7f9aecf647c4b9130ea084ab8.exe	iexplore.exe

Suspicious use of AdjustPrivilegeToken 46 IoCs

Processes:

1f1d35c7afb5178b9e98b71c433108743ba6d9d7f9aecf647c4b9130ea084ab8.exeiexplore.exe

description	pid	process
Token: SeIncreaseQuotaPrivilege	1000	1f1d35c7afb5178b9e98b71c433108743ba6d9d7f9aecf647c4b9130ea084ab8.exe
Token: SeSecurityPrivilege	1000	1f1d35c7afb5178b9e98b71c433108743ba6d9d7f9aecf647c4b9130ea084ab8.exe
Token: SeTakeOwnershipPrivilege	1000	1f1d35c7afb5178b9e98b71c433108743ba6d9d7f9aecf647c4b9130ea084ab8.exe
Token: SeLoadDriverPrivilege	1000	1f1d35c7afb5178b9e98b71c433108743ba6d9d7f9aecf647c4b9130ea084ab8.exe
Token: SeSystemProfilePrivilege	1000	1f1d35c7afb5178b9e98b71c433108743ba6d9d7f9aecf647c4b9130ea084ab8.exe
Token: SeSystemtimePrivilege	1000	1f1d35c7afb5178b9e98b71c433108743ba6d9d7f9aecf647c4b9130ea084ab8.exe
Token: SeProfSingleProcessPrivilege	1000	1f1d35c7afb5178b9e98b71c433108743ba6d9d7f9aecf647c4b9130ea084ab8.exe
Token: SeIncBasePriorityPrivilege	1000	1f1d35c7afb5178b9e98b71c433108743ba6d9d7f9aecf647c4b9130ea084ab8.exe
Token: SeCreatePagefilePrivilege	1000	1f1d35c7afb5178b9e98b71c433108743ba6d9d7f9aecf647c4b9130ea084ab8.exe
Token: SeBackupPrivilege	1000	1f1d35c7afb5178b9e98b71c433108743ba6d9d7f9aecf647c4b9130ea084ab8.exe
Token: SeRestorePrivilege	1000	1f1d35c7afb5178b9e98b71c433108743ba6d9d7f9aecf647c4b9130ea084ab8.exe
Token: SeShutdownPrivilege	1000	1f1d35c7afb5178b9e98b71c433108743ba6d9d7f9aecf647c4b9130ea084ab8.exe
Token: SeDebugPrivilege	1000	1f1d35c7afb5178b9e98b71c433108743ba6d9d7f9aecf647c4b9130ea084ab8.exe
Token: SeSystemEnvironmentPrivilege	1000	1f1d35c7afb5178b9e98b71c433108743ba6d9d7f9aecf647c4b9130ea084ab8.exe
Token: SeChangeNotifyPrivilege	1000	1f1d35c7afb5178b9e98b71c433108743ba6d9d7f9aecf647c4b9130ea084ab8.exe
Token: SeRemoteShutdownPrivilege	1000	1f1d35c7afb5178b9e98b71c433108743ba6d9d7f9aecf647c4b9130ea084ab8.exe
Token: SeUndockPrivilege	1000	1f1d35c7afb5178b9e98b71c433108743ba6d9d7f9aecf647c4b9130ea084ab8.exe
Token: SeManageVolumePrivilege	1000	1f1d35c7afb5178b9e98b71c433108743ba6d9d7f9aecf647c4b9130ea084ab8.exe
Token: SeImpersonatePrivilege	1000	1f1d35c7afb5178b9e98b71c433108743ba6d9d7f9aecf647c4b9130ea084ab8.exe
Token: SeCreateGlobalPrivilege	1000	1f1d35c7afb5178b9e98b71c433108743ba6d9d7f9aecf647c4b9130ea084ab8.exe
Token: 33	1000	1f1d35c7afb5178b9e98b71c433108743ba6d9d7f9aecf647c4b9130ea084ab8.exe
Token: 34	1000	1f1d35c7afb5178b9e98b71c433108743ba6d9d7f9aecf647c4b9130ea084ab8.exe
Token: 35	1000	1f1d35c7afb5178b9e98b71c433108743ba6d9d7f9aecf647c4b9130ea084ab8.exe
Token: SeIncreaseQuotaPrivilege	2008	iexplore.exe
Token: SeSecurityPrivilege	2008	iexplore.exe
Token: SeTakeOwnershipPrivilege	2008	iexplore.exe
Token: SeLoadDriverPrivilege	2008	iexplore.exe
Token: SeSystemProfilePrivilege	2008	iexplore.exe
Token: SeSystemtimePrivilege	2008	iexplore.exe
Token: SeProfSingleProcessPrivilege	2008	iexplore.exe
Token: SeIncBasePriorityPrivilege	2008	iexplore.exe
Token: SeCreatePagefilePrivilege	2008	iexplore.exe
Token: SeBackupPrivilege	2008	iexplore.exe
Token: SeRestorePrivilege	2008	iexplore.exe
Token: SeShutdownPrivilege	2008	iexplore.exe
Token: SeDebugPrivilege	2008	iexplore.exe
Token: SeSystemEnvironmentPrivilege	2008	iexplore.exe
Token: SeChangeNotifyPrivilege	2008	iexplore.exe
Token: SeRemoteShutdownPrivilege	2008	iexplore.exe
Token: SeUndockPrivilege	2008	iexplore.exe
Token: SeManageVolumePrivilege	2008	iexplore.exe
Token: SeImpersonatePrivilege	2008	iexplore.exe
Token: SeCreateGlobalPrivilege	2008	iexplore.exe
Token: 33	2008	iexplore.exe
Token: 34	2008	iexplore.exe
Token: 35	2008	iexplore.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

iexplore.exe

pid process

2008 iexplore.exe

pid	process
2008	iexplore.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

1f1d35c7afb5178b9e98b71c433108743ba6d9d7f9aecf647c4b9130ea084ab8.exe

description	pid	process	target process
PID 1000 wrote to memory of 2008	1000	1f1d35c7afb5178b9e98b71c433108743ba6d9d7f9aecf647c4b9130ea084ab8.exe	iexplore.exe
PID 1000 wrote to memory of 2008	1000	1f1d35c7afb5178b9e98b71c433108743ba6d9d7f9aecf647c4b9130ea084ab8.exe	iexplore.exe
PID 1000 wrote to memory of 2008	1000	1f1d35c7afb5178b9e98b71c433108743ba6d9d7f9aecf647c4b9130ea084ab8.exe	iexplore.exe
PID 1000 wrote to memory of 2008	1000	1f1d35c7afb5178b9e98b71c433108743ba6d9d7f9aecf647c4b9130ea084ab8.exe	iexplore.exe
PID 1000 wrote to memory of 2008	1000	1f1d35c7afb5178b9e98b71c433108743ba6d9d7f9aecf647c4b9130ea084ab8.exe	iexplore.exe
PID 1000 wrote to memory of 2008	1000	1f1d35c7afb5178b9e98b71c433108743ba6d9d7f9aecf647c4b9130ea084ab8.exe	iexplore.exe

C:\Users\Admin\AppData\Local\Temp\1f1d35c7afb5178b9e98b71c433108743ba6d9d7f9aecf647c4b9130ea084ab8.exe
"C:\Users\Admin\AppData\Local\Temp\1f1d35c7afb5178b9e98b71c433108743ba6d9d7f9aecf647c4b9130ea084ab8.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1000

C:\Program Files (x86)\Internet Explorer\iexplore.exe
"C:\Program Files (x86)\Internet Explorer\iexplore.exe"
2⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2008

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1000-54-0x0000000076561000-0x0000000076563000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads