darkcomet | 6a5d56869c1c4d57e28831503c888e166a760e8268d0a4e69c6167022dea6ac8

Analysis

max time kernel
175s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
29/11/2022, 14:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6a5d56869c1c4d57e28831503c888e166a760e8268d0a4e69c6167022dea6ac8.exe
Size

658KB
MD5

5c3a8b71081b1cb4b5d82a8b58065752
SHA1

97e995ed2a8b30281469e21b985fcebe2d64e78d
SHA256

6a5d56869c1c4d57e28831503c888e166a760e8268d0a4e69c6167022dea6ac8
SHA512

7b4544b83fcfd052743da3f546ae27c090c47a3b313fed2bc317882f9fe3a85f9e33b4db5dec70c037caf2d5dcb87d8258fc1101d892874c136d22e311ae7673
SSDEEP

12288:i9HFJ9rJxRX1uVVjoaWSoynxdO1FVBaOiRZTERfIhNkNCCLo9Ek5C/hE:OZ1xuVVjfFoynPaVBUR8f+kN10EBO

Score

10^/10

darkcomet rat trojan

Malware Config

Signatures

Darkcomet
DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
trojan rat darkcomet
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 23 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	896	6a5d56869c1c4d57e28831503c888e166a760e8268d0a4e69c6167022dea6ac8.exe
Token: SeSecurityPrivilege	896	6a5d56869c1c4d57e28831503c888e166a760e8268d0a4e69c6167022dea6ac8.exe
Token: SeTakeOwnershipPrivilege	896	6a5d56869c1c4d57e28831503c888e166a760e8268d0a4e69c6167022dea6ac8.exe
Token: SeLoadDriverPrivilege	896	6a5d56869c1c4d57e28831503c888e166a760e8268d0a4e69c6167022dea6ac8.exe
Token: SeSystemProfilePrivilege	896	6a5d56869c1c4d57e28831503c888e166a760e8268d0a4e69c6167022dea6ac8.exe
Token: SeSystemtimePrivilege	896	6a5d56869c1c4d57e28831503c888e166a760e8268d0a4e69c6167022dea6ac8.exe
Token: SeProfSingleProcessPrivilege	896	6a5d56869c1c4d57e28831503c888e166a760e8268d0a4e69c6167022dea6ac8.exe
Token: SeIncBasePriorityPrivilege	896	6a5d56869c1c4d57e28831503c888e166a760e8268d0a4e69c6167022dea6ac8.exe
Token: SeCreatePagefilePrivilege	896	6a5d56869c1c4d57e28831503c888e166a760e8268d0a4e69c6167022dea6ac8.exe
Token: SeBackupPrivilege	896	6a5d56869c1c4d57e28831503c888e166a760e8268d0a4e69c6167022dea6ac8.exe
Token: SeRestorePrivilege	896	6a5d56869c1c4d57e28831503c888e166a760e8268d0a4e69c6167022dea6ac8.exe
Token: SeShutdownPrivilege	896	6a5d56869c1c4d57e28831503c888e166a760e8268d0a4e69c6167022dea6ac8.exe
Token: SeDebugPrivilege	896	6a5d56869c1c4d57e28831503c888e166a760e8268d0a4e69c6167022dea6ac8.exe
Token: SeSystemEnvironmentPrivilege	896	6a5d56869c1c4d57e28831503c888e166a760e8268d0a4e69c6167022dea6ac8.exe
Token: SeChangeNotifyPrivilege	896	6a5d56869c1c4d57e28831503c888e166a760e8268d0a4e69c6167022dea6ac8.exe
Token: SeRemoteShutdownPrivilege	896	6a5d56869c1c4d57e28831503c888e166a760e8268d0a4e69c6167022dea6ac8.exe
Token: SeUndockPrivilege	896	6a5d56869c1c4d57e28831503c888e166a760e8268d0a4e69c6167022dea6ac8.exe
Token: SeManageVolumePrivilege	896	6a5d56869c1c4d57e28831503c888e166a760e8268d0a4e69c6167022dea6ac8.exe
Token: SeImpersonatePrivilege	896	6a5d56869c1c4d57e28831503c888e166a760e8268d0a4e69c6167022dea6ac8.exe
Token: SeCreateGlobalPrivilege	896	6a5d56869c1c4d57e28831503c888e166a760e8268d0a4e69c6167022dea6ac8.exe
Token: 33	896	6a5d56869c1c4d57e28831503c888e166a760e8268d0a4e69c6167022dea6ac8.exe
Token: 34	896	6a5d56869c1c4d57e28831503c888e166a760e8268d0a4e69c6167022dea6ac8.exe
Token: 35	896	6a5d56869c1c4d57e28831503c888e166a760e8268d0a4e69c6167022dea6ac8.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
896	6a5d56869c1c4d57e28831503c888e166a760e8268d0a4e69c6167022dea6ac8.exe

C:\Users\Admin\AppData\Local\Temp\6a5d56869c1c4d57e28831503c888e166a760e8268d0a4e69c6167022dea6ac8.exe
"C:\Users\Admin\AppData\Local\Temp\6a5d56869c1c4d57e28831503c888e166a760e8268d0a4e69c6167022dea6ac8.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:896

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/896-54-0x0000000076411000-0x0000000076413000-memory.dmp

Filesize
8KB

Download