darkcomet | ce0a6186e582fa51802b4421b9c7f9605ddb5d3179d8d317ae0535f9df6c32ba

Analysis

max time kernel
152s
max time network
180s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
28-11-2022 21:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ce0a6186e582fa51802b4421b9c7f9605ddb5d3179d8d317ae0535f9df6c32ba.exe
Size

252KB
MD5

cd6d95b3af2a8cff359128818c89380a
SHA1

67413fd4082f3f797e70d742a266708d93e55e00
SHA256

ce0a6186e582fa51802b4421b9c7f9605ddb5d3179d8d317ae0535f9df6c32ba
SHA512

d28b2136d5f211af9d2f91f61faaea19367f8704dcc7f1f7da6b32c560055adb2dc32efae7f85e9a7e769ae816f57fbe17d9b424467e1b398ad4d865dc58d3b1
SSDEEP

6144:JcNYS996KFifeVjBpeExgVTFSXFoMc5RhCaL37kKUG:JcW7KEZlPzCy373UG

Score

10^/10

darkcomet rat trojan upx

Malware Config

Signatures

Darkcomet
DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
trojan rat darkcomet

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral2/memory/4168-132-0x0000000000400000-0x00000000004B8000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 24 IoCs

Processes:

ce0a6186e582fa51802b4421b9c7f9605ddb5d3179d8d317ae0535f9df6c32ba.exe

description	pid	process
Token: SeIncreaseQuotaPrivilege	4168	ce0a6186e582fa51802b4421b9c7f9605ddb5d3179d8d317ae0535f9df6c32ba.exe
Token: SeSecurityPrivilege	4168	ce0a6186e582fa51802b4421b9c7f9605ddb5d3179d8d317ae0535f9df6c32ba.exe
Token: SeTakeOwnershipPrivilege	4168	ce0a6186e582fa51802b4421b9c7f9605ddb5d3179d8d317ae0535f9df6c32ba.exe
Token: SeLoadDriverPrivilege	4168	ce0a6186e582fa51802b4421b9c7f9605ddb5d3179d8d317ae0535f9df6c32ba.exe
Token: SeSystemProfilePrivilege	4168	ce0a6186e582fa51802b4421b9c7f9605ddb5d3179d8d317ae0535f9df6c32ba.exe
Token: SeSystemtimePrivilege	4168	ce0a6186e582fa51802b4421b9c7f9605ddb5d3179d8d317ae0535f9df6c32ba.exe
Token: SeProfSingleProcessPrivilege	4168	ce0a6186e582fa51802b4421b9c7f9605ddb5d3179d8d317ae0535f9df6c32ba.exe
Token: SeIncBasePriorityPrivilege	4168	ce0a6186e582fa51802b4421b9c7f9605ddb5d3179d8d317ae0535f9df6c32ba.exe
Token: SeCreatePagefilePrivilege	4168	ce0a6186e582fa51802b4421b9c7f9605ddb5d3179d8d317ae0535f9df6c32ba.exe
Token: SeBackupPrivilege	4168	ce0a6186e582fa51802b4421b9c7f9605ddb5d3179d8d317ae0535f9df6c32ba.exe
Token: SeRestorePrivilege	4168	ce0a6186e582fa51802b4421b9c7f9605ddb5d3179d8d317ae0535f9df6c32ba.exe
Token: SeShutdownPrivilege	4168	ce0a6186e582fa51802b4421b9c7f9605ddb5d3179d8d317ae0535f9df6c32ba.exe
Token: SeDebugPrivilege	4168	ce0a6186e582fa51802b4421b9c7f9605ddb5d3179d8d317ae0535f9df6c32ba.exe
Token: SeSystemEnvironmentPrivilege	4168	ce0a6186e582fa51802b4421b9c7f9605ddb5d3179d8d317ae0535f9df6c32ba.exe
Token: SeChangeNotifyPrivilege	4168	ce0a6186e582fa51802b4421b9c7f9605ddb5d3179d8d317ae0535f9df6c32ba.exe
Token: SeRemoteShutdownPrivilege	4168	ce0a6186e582fa51802b4421b9c7f9605ddb5d3179d8d317ae0535f9df6c32ba.exe
Token: SeUndockPrivilege	4168	ce0a6186e582fa51802b4421b9c7f9605ddb5d3179d8d317ae0535f9df6c32ba.exe
Token: SeManageVolumePrivilege	4168	ce0a6186e582fa51802b4421b9c7f9605ddb5d3179d8d317ae0535f9df6c32ba.exe
Token: SeImpersonatePrivilege	4168	ce0a6186e582fa51802b4421b9c7f9605ddb5d3179d8d317ae0535f9df6c32ba.exe
Token: SeCreateGlobalPrivilege	4168	ce0a6186e582fa51802b4421b9c7f9605ddb5d3179d8d317ae0535f9df6c32ba.exe
Token: 33	4168	ce0a6186e582fa51802b4421b9c7f9605ddb5d3179d8d317ae0535f9df6c32ba.exe
Token: 34	4168	ce0a6186e582fa51802b4421b9c7f9605ddb5d3179d8d317ae0535f9df6c32ba.exe
Token: 35	4168	ce0a6186e582fa51802b4421b9c7f9605ddb5d3179d8d317ae0535f9df6c32ba.exe
Token: 36	4168	ce0a6186e582fa51802b4421b9c7f9605ddb5d3179d8d317ae0535f9df6c32ba.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

ce0a6186e582fa51802b4421b9c7f9605ddb5d3179d8d317ae0535f9df6c32ba.exe

pid process

4168 ce0a6186e582fa51802b4421b9c7f9605ddb5d3179d8d317ae0535f9df6c32ba.exe

pid	process
4168	ce0a6186e582fa51802b4421b9c7f9605ddb5d3179d8d317ae0535f9df6c32ba.exe

C:\Users\Admin\AppData\Local\Temp\ce0a6186e582fa51802b4421b9c7f9605ddb5d3179d8d317ae0535f9df6c32ba.exe
"C:\Users\Admin\AppData\Local\Temp\ce0a6186e582fa51802b4421b9c7f9605ddb5d3179d8d317ae0535f9df6c32ba.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:4168

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4168-132-0x0000000000400000-0x00000000004B8000-memory.dmp

Filesize
736KB

Download