darkcomet | 88b5011527d93d7518bde32a98b8ce0365e184f97fc467901e5084d20711816c

Analysis

max time kernel
187s
max time network
45s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
30-11-2022 22:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

88b5011527d93d7518bde32a98b8ce0365e184f97fc467901e5084d20711816c.exe
Size

662KB
MD5

1eceb73a32f0a7be6a95878a20cd9f7c
SHA1

114d8b19cf4d911544d211fa286a79e1b710ede7
SHA256

88b5011527d93d7518bde32a98b8ce0365e184f97fc467901e5084d20711816c
SHA512

cc82cd161101f6e007bcca572c244bbb81e3948b533e9d239f3558c9afe2fd90523c6bcd630969b1085b73a087ff1c0553d77d1f7f154bde8296bd2f3c38f94f
SSDEEP

12288:c3OpvNW4a76S/Ddon/m09bbYlIaaMcE2YGhq3vo1RnfAvIESJgoE26yc/RO:KOA4aWNn/m09fKIaaBEtWq3A1Ov8Jgbw

Score

10^/10

darkcomet rat trojan

Malware Config

Signatures

Darkcomet
DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
trojan rat darkcomet
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 23 IoCs

Processes:

88b5011527d93d7518bde32a98b8ce0365e184f97fc467901e5084d20711816c.exe

description	pid	process
Token: SeIncreaseQuotaPrivilege	892	88b5011527d93d7518bde32a98b8ce0365e184f97fc467901e5084d20711816c.exe
Token: SeSecurityPrivilege	892	88b5011527d93d7518bde32a98b8ce0365e184f97fc467901e5084d20711816c.exe
Token: SeTakeOwnershipPrivilege	892	88b5011527d93d7518bde32a98b8ce0365e184f97fc467901e5084d20711816c.exe
Token: SeLoadDriverPrivilege	892	88b5011527d93d7518bde32a98b8ce0365e184f97fc467901e5084d20711816c.exe
Token: SeSystemProfilePrivilege	892	88b5011527d93d7518bde32a98b8ce0365e184f97fc467901e5084d20711816c.exe
Token: SeSystemtimePrivilege	892	88b5011527d93d7518bde32a98b8ce0365e184f97fc467901e5084d20711816c.exe
Token: SeProfSingleProcessPrivilege	892	88b5011527d93d7518bde32a98b8ce0365e184f97fc467901e5084d20711816c.exe
Token: SeIncBasePriorityPrivilege	892	88b5011527d93d7518bde32a98b8ce0365e184f97fc467901e5084d20711816c.exe
Token: SeCreatePagefilePrivilege	892	88b5011527d93d7518bde32a98b8ce0365e184f97fc467901e5084d20711816c.exe
Token: SeBackupPrivilege	892	88b5011527d93d7518bde32a98b8ce0365e184f97fc467901e5084d20711816c.exe
Token: SeRestorePrivilege	892	88b5011527d93d7518bde32a98b8ce0365e184f97fc467901e5084d20711816c.exe
Token: SeShutdownPrivilege	892	88b5011527d93d7518bde32a98b8ce0365e184f97fc467901e5084d20711816c.exe
Token: SeDebugPrivilege	892	88b5011527d93d7518bde32a98b8ce0365e184f97fc467901e5084d20711816c.exe
Token: SeSystemEnvironmentPrivilege	892	88b5011527d93d7518bde32a98b8ce0365e184f97fc467901e5084d20711816c.exe
Token: SeChangeNotifyPrivilege	892	88b5011527d93d7518bde32a98b8ce0365e184f97fc467901e5084d20711816c.exe
Token: SeRemoteShutdownPrivilege	892	88b5011527d93d7518bde32a98b8ce0365e184f97fc467901e5084d20711816c.exe
Token: SeUndockPrivilege	892	88b5011527d93d7518bde32a98b8ce0365e184f97fc467901e5084d20711816c.exe
Token: SeManageVolumePrivilege	892	88b5011527d93d7518bde32a98b8ce0365e184f97fc467901e5084d20711816c.exe
Token: SeImpersonatePrivilege	892	88b5011527d93d7518bde32a98b8ce0365e184f97fc467901e5084d20711816c.exe
Token: SeCreateGlobalPrivilege	892	88b5011527d93d7518bde32a98b8ce0365e184f97fc467901e5084d20711816c.exe
Token: 33	892	88b5011527d93d7518bde32a98b8ce0365e184f97fc467901e5084d20711816c.exe
Token: 34	892	88b5011527d93d7518bde32a98b8ce0365e184f97fc467901e5084d20711816c.exe
Token: 35	892	88b5011527d93d7518bde32a98b8ce0365e184f97fc467901e5084d20711816c.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

88b5011527d93d7518bde32a98b8ce0365e184f97fc467901e5084d20711816c.exe

pid process

892 88b5011527d93d7518bde32a98b8ce0365e184f97fc467901e5084d20711816c.exe

pid	process
892	88b5011527d93d7518bde32a98b8ce0365e184f97fc467901e5084d20711816c.exe

C:\Users\Admin\AppData\Local\Temp\88b5011527d93d7518bde32a98b8ce0365e184f97fc467901e5084d20711816c.exe
"C:\Users\Admin\AppData\Local\Temp\88b5011527d93d7518bde32a98b8ce0365e184f97fc467901e5084d20711816c.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:892

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/892-54-0x0000000075521000-0x0000000075523000-memory.dmp

Filesize
8KB

Download